Data Privacy Act of 2012 — personal data breach notification

The statutory trigger is narrow and specific: notification is owed where sensitive personal information, or information that could enable identity fraud, is reasonably believed to have been acquired by an unauthorized person AND the acquisition is likely to give rise to a real risk of serious harm. Where it applies, NPC Circular 16-03 gives 72 hours from knowledge or reasonable belief to notify BOTH the National Privacy Commission and the affected data subjects — the Philippines does not split the two onto different clocks or different thresholds the way the GDPR does. Delay is permitted only to determine scope, prevent further disclosure, or restore system integrity, and is not permitted at all where at least 100 data subjects are affected or where disclosing the sensitive personal information will harm the data subject.