NMMJ Law Office - Crossing Puan

Call Directions Website

NMMJ Law Office - Crossing Puan Helping people with legal matters. Consultations, notary public and litigation. Contact us now for consultation!

💡 The National Privacy Commission (NPC) may authorize the postponement of breach notification when providing immediate n...
30/08/2026

💡 The National Privacy Commission (NPC) may authorize the postponement of breach notification when providing immediate notice could impede the progress of a criminal investigation involving a serious data breach.

This allows authorities to protect the integrity of an ongoing investigation while balancing the need to inform affected data subjects about a serious breach.

📌 Legal Basis: Republic Act No. 10173 – Data Privacy Act of 2012

📖 For educational purposes only and not intended as legal advice. For specific legal concerns, consult a lawyer.

💡 The National Privacy Commission (NPC) may exempt a Personal Information Controller (PIC) from the breach notification ...
29/08/2026

💡 The National Privacy Commission (NPC) may exempt a Personal Information Controller (PIC) from the breach notification requirement when it determines that notifying the affected parties would not be in the public interest or would not serve the interests of the affected data subjects.

This recognizes that, in certain circumstances, notification may not provide a meaningful benefit to the public or the individuals affected by the breach.

📌 Legal Basis: Republic Act No. 10173 – Data Privacy Act of 2012

📖 For educational purposes only and not intended as legal advice. For specific legal concerns, consult a lawyer.

💡 Breach notification may be delayed only when necessary to determine the scope of the breach, prevent further disclosur...
28/08/2026

💡 Breach notification may be delayed only when necessary to determine the scope of the breach, prevent further disclosure or unauthorized access, or restore the reasonable integrity of the information and communications system.

This limited exception allows organizations to take immediate steps to contain and control a breach before providing the required notification, while ensuring that the delay is not used to avoid or unnecessarily postpone reporting the incident.

📌 Legal Basis: Republic Act No. 10173 – Data Privacy Act of 2012

📖 For educational purposes only and not intended as legal advice. For specific legal concerns, consult a lawyer.

💡 A data breach notification must contain, at a minimum, key information that helps the National Privacy Commission (NPC...
27/08/2026

💡 A data breach notification must contain, at a minimum, key information that helps the National Privacy Commission (NPC) and affected data subjects understand the incident and the response taken.

At the minimum, the notification should include:

• The nature of the breach;
• The Sensitive Personal Information (SPI) that may have been involved; and
• The measures taken to address the breach.

Providing these details promotes transparency and helps affected individuals understand the potential risks and the steps taken to protect their personal information.

📌 Legal Basis: Republic Act No. 10173 – Data Privacy Act of 2012

📖 For educational purposes only and not intended as legal advice. For specific legal concerns, consult a lawyer.

💡 A Personal Information Controller (PIC) must notify the National Privacy Commission (NPC) and the affected data subjec...
26/08/2026

💡 A Personal Information Controller (PIC) must notify the National Privacy Commission (NPC) and the affected data subjects when a personal data breach involves Sensitive Personal Information (SPI) or information that may be used to enable identity fraud, and there is reasonable belief that the information was acquired by an unauthorized person and the breach is likely to result in a real risk of serious harm to the affected data subjects.

This notification requirement helps ensure that serious data breaches are addressed promptly and that affected individuals have an opportunity to take appropriate protective measures.

📌 Legal Basis: Republic Act No. 10173 – Data Privacy Act of 2012

📖 For educational purposes only and not intended as legal advice. For specific legal concerns, consult a lawyer.

💡 The duty of confidentiality does not end when an employee leaves an organization. Under the Data Privacy Act of 2012, ...
25/08/2026

💡 The duty of confidentiality does not end when an employee leaves an organization. Under the Data Privacy Act of 2012, employees who have access to personal information must continue to observe confidentiality even after leaving the organization, transferring to another position, or the termination of their employment or contractual relationship.

This continuing obligation helps ensure that personal information remains protected even after an individual's relationship with the organization has ended.

📌 Legal Basis: Section 20(d), Republic Act No. 10173 – Data Privacy Act of 2012

📖 For educational purposes only and not intended as legal advice. For specific legal concerns, consult a lawyer.

💡 Under Section 20(c) of the Data Privacy Act of 2012, organizations must implement appropriate security measures to pro...
24/08/2026

💡 Under Section 20(c) of the Data Privacy Act of 2012, organizations must implement appropriate security measures to protect personal information. These include:

• Network safeguards to protect information systems against unauthorized access or other security threats;
• A security policy governing the processing of personal information;
• A process for identifying and addressing security vulnerabilities in the organization's systems; and
• Regular monitoring for security breaches and the implementation of appropriate measures to prevent or mitigate their effects.

These measures help organizations identify security risks, strengthen their systems, and respond promptly to potential data breaches.

📌 Legal Basis: Section 20(c), Republic Act No. 10173 – Data Privacy Act of 2012

📖 For educational purposes only and not intended as legal advice. For specific legal concerns, consult a lawyer.

💡 The appropriate level of security measures for protecting personal information depends on several factors. Under the D...
23/08/2026

💡 The appropriate level of security measures for protecting personal information depends on several factors. Under the Data Privacy Act of 2012, these include:

• Nature of the personal information being processed;
• Risks associated with the processing, particularly those that may affect the rights and freedoms of data subjects;
• Size and complexity of the organization; and
• Current best practices and the cost of implementing security measures.

Considering these factors helps organizations establish security measures that are appropriate to the nature and risks of their personal data processing activities.

📌 Legal Basis: Republic Act No. 10173 – Data Privacy Act of 2012

📖 For educational purposes only and not intended as legal advice. For specific legal concerns, consult a lawyer.

💡 Security measures for personal information must protect against two broad categories of dangers: natural and human dan...
22/08/2026

💡 Security measures for personal information must protect against two broad categories of dangers: natural and human dangers.

• Natural dangers – include accidental loss or destruction of personal information, such as those caused by natural events or unforeseen circumstances.
• Human dangers – include unlawful access, fraudulent misuse, unlawful destruction, alteration, or contamination of personal information.

These safeguards help ensure that personal information remains secure, accurate, and protected from unauthorized or accidental harm.

📌 Legal Basis: Republic Act No. 10173 – Data Privacy Act of 2012

📖 For educational purposes only and not intended as legal advice. For specific legal concerns, consult a lawyer.

💡 A Personal Information Controller (PIC) is required to implement appropriate security measures to protect personal inf...
21/08/2026

💡 A Personal Information Controller (PIC) is required to implement appropriate security measures to protect personal information against unauthorized access, disclosure, alteration, destruction, or other unlawful processing.

The Data Privacy Act of 2012 identifies three types of security measures that should be adopted:

• Organizational Measures – policies, procedures, and personnel practices that promote data protection;
• Physical Measures – safeguards that protect facilities, equipment, and records; and
• Technical Measures – security tools and technologies used to protect personal information and information systems.

These measures work together to ensure the confidentiality, integrity, and availability of personal information.

📌 Legal Basis: Republic Act No. 10173 – Data Privacy Act of 2012

📖 For educational purposes only and not intended as legal advice. For specific legal concerns, consult a lawyer.

Address

2nd Floor, Door 2, KenMar Building (above 7-Eleven), Crossing Puan
Davao City
8000

Opening Hours

Monday 8:30am - 4:30pm
Tuesday 8:30am - 4:30pm
Wednesday 8:30am - 4:30pm
Thursday 8:30am - 4:30pm
Friday 8:30am - 4:30pm

Telephone

+639760302266

Website

Alerts

Be the first to know and let us send you an email when NMMJ Law Office - Crossing Puan posts news and promotions. Your email address will not be used for any other purpose, and you can unsubscribe at any time.

Shortcuts

Share

Category