First decide whether this is a personal data breach in the legal sense
A personal data breach is any unauthorised access to, disclosure of, alteration of or loss of personal data. It is not limited to hacking. The breaches that small and mid-sized foreign companies actually suffer are usually mundane: a staff member sends the customer spreadsheet to the wrong chat group, a departing employee takes the client list, a laptop holding scanned passports is stolen, a shared drive link is left open to anyone with the address, or a customer service account is taken over and orders are exported in bulk. Every one of these counts and should be handled as an incident, not brushed off as an internal slip.
Answer three questions. Is the information personal data, meaning it can identify a living individual: names, phone numbers, addresses, identity document numbers, account details, health or financial information? Has it left your control, or are you unable to confirm that it has not? Does it concern people in the Philippines, or was it processed here? If the first two answers are yes, start the incident response now. Do not wait for proof that the data has been misused.
Some events are urgent without being personal data breaches. A leaked price list or contract floor is a trade secret problem that runs through contract and civil remedies. A defaced website whose database was never touched is a system compromise, covered in what to do when a company website or social account is hacked. Classifying the event correctly sets everything that follows: the notification duty, the public message and what evidence matters. When in doubt, prepare for the heavier scenario. Over-preparing costs a few hours of work, while being found to have played down a reportable incident costs the company its credibility with both the regulator and its customers.
The first twenty-four hours: six actions in this order
One: stop the bleeding without destroying evidence. Disable the exposed link, suspend the compromised account, reset the related passwords and take the affected device off the network. Isolate, do not reformat. Reinstalling a system or clearing its logs erases the only record that can tell you how much was taken and when it started. Two: appoint one incident lead. If you have a data protection officer, that person leads. If not, the owner names someone who can direct IT, customer service and administration, and every internal and external message flows through that one person.
Three: write the timeline. Who noticed, when, how, what they saw and what was done afterwards, each line with a time. The timeline is the first thing a regulator asks for. Four: preserve evidence. Export access logs, sign-in records, mail forwarding rules, file sharing history and chat screenshots to a read-only location. If an employee's personal device is involved, instruct them in writing not to delete anything.
Five: make a first count. Which table or system, how many records, which fields, which groups of people: customers, staff, supplier contacts. Give a conservative estimate now and refine it later. Six: do not characterise the incident publicly yet. Until the scope is known, do not post that there was no breach or that it was minor, and do not publicly name an employee or former employee as the culprit. The first is misleading if wrong; the second can expose you to a claim of cyber libel. Day one has three goals only: the hole is closed, the evidence is safe, and you have a working number for the scope. Everything else, including blame, compensation and long-term fixes, can wait until those three are done.
Whether to notify the NPC and the individuals: three conditions and what the report contains
Notification is neither automatic for every incident nor optional when it is inconvenient. It turns on three conditions being met together. First, the data involved is sensitive personal information or information that could enable identity fraud, such as identity numbers, account details, health or financial data and passwords. Second, there is reason to believe an unauthorised person has acquired it. Third, that acquisition is likely to create a real risk of serious harm to the people concerned. When all three hold, the incident is notifiable: the company must report to the NPC and inform the affected individuals within the period the NPC prescribes. That period is short and runs from the moment the company knew or had reason to believe a breach occurred, not from the end of its investigation. Check the NPC's current rules for the exact window.
A report normally covers the nature and sequence of the incident, the categories of data and approximate number of people affected, the likely consequences, the measures already taken and planned, and a contact person for individuals. You can file what you know and supplement later. Incomplete information is not an excuse for a late report. Reports to the NPC are currently lodged through its online system; keep the acknowledgement.
If you are unsure whether the threshold is met, write an internal assessment recording why you concluded it was or was not, signed by the incident lead. Even if you do not notify, that record shows the company took the question seriously. If you process data on behalf of someone else, for example as an outsourced support or operations provider, tell your client at once so they can assess their own duty. Have a licensed lawyer review the decision to notify and the wording.
How to tell customers: four facts, no blame-shifting, no scare tactics, no promises you cannot keep
A customer notice should state four things plainly: what happened, which of your information was involved, what we have done, and what you should do now. It is not a press release, and blaming unknown hackers is not an answer. Customers want to know whether to change a password, whether to expect impostor calls and what to watch for now that their identity details are out. Give concrete actions: change the password, be suspicious of any message claiming to be from the company and asking for payment, and verify every payment request by calling back on the official number you already have.
Deliver the notice through the contact channel each customer originally gave you. Use a website announcement as a supplement only when the numbers are large or contact details are incomplete. Do not expose the data a second time in the notice itself. Use blind copy for bulk email rather than listing every address in the recipient line, and do not attach a full printout of each customer's record. Set up one dedicated enquiry channel, a mailbox or a support line, and give front-line staff a single script so that ten people do not give ten versions.
On tone: admit the facts, explain the measures, name a contact. That is enough. Do not promise it will never happen again, do not commit to compensation you have not yet decided, and do not warn customers against talking about it. Overseas Chinese business communities are tightly connected and news travels fast; an honest and useful notice protects trust better than any denial. If fraudsters are already using the leaked data to impersonate the company and collect payments, see what to do when payments are diverted to a fake account and file a complaint through the cybercrime reporting process without delay.
Aftermath: police report, accountability, insurance and remediation run on separate tracks
The aftermath of a breach runs on four tracks, and none substitutes for another. The first is criminal. Where the breach came from an intrusion, an account takeover or an insider copying data unlawfully, you can file a complaint with the police or the National Bureau of Investigation's cybercrime units, bringing your timeline and preserved logs. A complaint starts an investigation and creates an official record, which helps later when you face customer claims or regulator questions and need to show that the company was itself a victim and acted.
The second is internal accountability. If the source is a current or former employee, discipline must follow the due process labour law requires: written notice, a chance to explain, then a decision. Summary dismissal or public naming creates a second legal problem. The sequence of evidence and procedure is the same as in handling employee theft. The third is contracts and insurance. Review agreements with customers, platforms and outsourcing vendors for data security clauses and notice duties, and if the company holds cyber or liability cover, report within the time the policy sets.
The fourth is remediation, the track a regulator weighs most heavily. Fix the specific cause, whether excessive access rights, a public sharing link, an account not closed on departure or an unencrypted device, and document the fix in writing. Where the breach came from a lost or stolen device, the steps are in what to do when a work laptop with company data is stolen. Regulators and customers can accept that an incident occurred. What they do not accept is an incident followed by no change. For compensation talks, replies to regulator enquiries and disciplinary decisions, consult a licensed lawyer.
Put the basics in place afterwards: five minimum items, and what Yixing can do
A company that has lived through one breach gets more from five basic items than from expensive security products. First, a data inventory: what personal data the company actually holds, where it sits and who can see it. Many firms learn only after an incident that scanned customer passports are scattered across three employees' personal cloud drives. Second, access control and offboarding: give each role the minimum access it needs and close every account on the day someone leaves. Third, a one-page incident procedure: who to call, who decides on notification and who speaks externally.
Fourth, the data protection officer and registration question: confirm whether the company must designate a DPO and whether it falls within the NPC's registration scope, and keep the contact details current. Fifth, basic staff habits: no customer files through personal email, no clicking unknown links, check the recipient before sending to a group. These habits sit under the same law that governs everyday processing such as timekeeping and monitoring; the boundaries are explained in privacy rules for fingerprint and face attendance systems.
Yixing Travel Consultancy (SEC Registration No. CS202009551, Bureau of Immigration Accredited Agency No. CA-202624381-1) provides compliance retainer services to foreign-owned companies in the Philippines: helping map the data inventory and internal policies, preparing registration and reporting documents for regulators, assembling the timeline and supporting papers after an incident, and coordinating with licensed lawyers and forensic technicians. We are not a law firm or a cybersecurity vendor and do not replace their judgment. What we do is keep the paperwork and the sequence under control during the most chaotic days. For your specific case consult a licensed lawyer; this article is not legal advice.
Frequently Asked Questions
Our customer data was leaked. What is the first thing to do?
Must every data breach be reported to the NPC?
Can we wait until the investigation is finished before notifying?
Do we have to tell customers? Will that not cause panic?
A former employee took the client list. Is that a data breach?
We are a small company with no data protection officer. Does this still apply?
What if customers demand compensation after the breach?
Let’s talk through your situation — free
Every company is different. Leave your details and a Chinese-speaking advisor will get back within 1 business day with practical, industry-specific guidance and a transparent quote.
Get help with Compliance & Retainer → Free consultation