The ASIR must be filed online via the NPC's Data Breach Notification Management System (DBNMS). Personal information controllers (PIC) and processors (PIP) with zero security incidents during the covered period must still file the ASIR, indicating "0" in the relevant fields. Submissions through paper or electronic mail shall not be considered compliant. For more information on the DBNMS, please refer to our previous client alert here.
Failure to submit the ASIR is a violation of NPC's issuances and may be taken into consideration by the NPC in its evaluation or examination of a PIC's or PIP's compliance with the requirements of the Data Privacy Act of 2012.
Recommended action
Clients covered by the DPA are urged to prepare their 2023 ASIR in order to ensure timely submission to the NPC via the DBNMS by the deadline on 31 March 2024.
Please feel free to reach out to Quisumbing Torres’ Intellectual Property, Data, and Technology Practice Group for assistance on these data privacy compliance matters.
1 "Security Incident" is an event or occurrence that affects or tends to affect data protection, or may compromise the availability, integrity, and confidentiality of personal data. It shall include incidents that would result to a personal data breach, if not for safeguards that have been put in place (NPC Circular No. 16-03).
2 “Personal data breach" refers to a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored, or otherwise processed. A personal data breach may be in the nature of any or all of the following:
a) An availability breach resulting from loss, accidental or unlawful destruction of personal data
b) Integrity breach resulting from alteration of personal data
c) A confidentiality breach resulting from the unauthorized disclosure of or access to personal data (NPC Circular No. 16-03).
Please contact QTInfoDesk@quisumbingtorres.com for inquiries.
VISIT QUISUMBING TORRES SITE
