What Should a Company Do After a Data Breach?
July 9, 2024
Last Modified On: October 8, 2026
After a data breach, a company should act fast: alert IT, legal, and its Data Protection Officer, contain the affected systems, and assess what data was exposed. In the Philippines, if sensitive personal information was exposed and could cause serious harm, the Data Privacy Act (RA 10173) requires notifying the National Privacy Commission (NPC) and affected individuals within 72 hours.
The 7 steps below walk through what to do, in order.
What is a data breach?
A data breach happens when someone accesses, discloses, or uses protected data without authorization. It’s worth distinguishing three related terms, since companies often use them loosely:
| Term | What It Means |
|---|---|
| Cyber attack | Any deliberate attempt to exploit systems, networks, or devices for malicious purposes |
| Data breach | A specific type of cyber attack where sensitive or confidential information is accessed, stolen, or exposed |
| Push bombing | A flood of unsolicited messages meant to overwhelm systems or distract security teams, often used alongside a breach attempt |
Is your company legally required to report It?
Under NPC Circular 16-03, notify the NPC and affected individuals within 72 hours of knowing, or reasonably believing, that a breach occurred. Submit the full breach report to the NPC within 5 days, unless the NPC grants more time.
Notification is required when all three apply: sensitive personal information (or information that could enable identity fraud) is involved, it was likely acquired by an unauthorized person, and the breach is likely to cause a real risk of serious harm.
For step-by-step instructions, see the NPC’s breach reporting procedures. In June 2026, NPC Advisory No. 2026-02 clarified how to submit reports through the NPC’s online system. For the bigger picture, see our article on data privacy trends.
Are companies liable for data breaches?
Yes, companies can face liability, though it depends on the circumstances. According to Respicio & Co.’s overview of data privacy remedies, affected individuals can claim damages through civil action or NPC proceedings if they can show the breach caused them harm.
Consequently, transparency actually works in your favor here: notifying customers promptly and demonstrating that you took reasonable security measures both factor into how regulators and courts assess liability.
What a data breach actually costs
The global average cost of a data breach reached $4.99 million in 2026, a 12% increase over the previous year and a record high, according to IBM’s Cost of a Data Breach Report 2026. In other words, the speed of your first response directly affects the final bill, not just your regulatory standing.
7 steps to take after a data breach
Once you confirm a breach, work through these steps in order:
1. Notify IT, legal, and your Data Protection Officer (DPO) immediately. Your DPO coordinates the breach response and any notification to the NPC.
2. Secure affected systems and data. Isolate compromised systems, restore from backups where needed, and tighten access controls to stop further exposure.
3. Communicate with customers and stakeholders. Give regular, honest updates on what happened and what you’re doing about it, since transparency protects trust even when the news is bad.
4. Contact law enforcement and the NPC if required. Report the breach within 72 hours if it meets the notification threshold above, and involve law enforcement for unlawful access.
5. Add security measures to prevent a repeat. Patch known vulnerabilities, roll out multi-factor authentication, and run a security audit to catch what let the breach happen. Strengthen protection with managed cybersecurity, regular system maintenance, and staff training on threats like push bombing.
6. Support affected individuals. Offer credit monitoring or identity-theft guidance so people know how to protect themselves.
7. Keep monitoring for further exposure. Watch for unusual logins or file activity for weeks after the initial incident, since attackers sometimes return through the same weakness.
Because many breaches trace back to gaps a routine security review would have caught, our guide on why computer system maintenance matters covers the preventive habits that reduce your odds of needing this checklist at all.
Frequently Asked Questions
What should a company do immediately after a data breach?
Alert your IT team, legal team, and Data Protection Officer right away so they can secure the affected systems and assess whether the breach must be reported.
Do companies in the Philippines have to report data breaches?
Yes, when the breach involves sensitive personal information or data that could enable identity fraud, the data was likely acquired by an unauthorized person, and there is a real risk of serious harm to the people affected.
How long does a company have to report a data breach in the Philippines?
The NPC and affected individuals must be notified within 72 hours of knowing or reasonably believing a breach occurred. The full report to the NPC is due within 5 days, unless the NPC allows more time.
What is the difference between a cyber attack and a data breach?
A cyber attack is an attempt to damage or access systems. A data breach is when protected data is actually accessed, disclosed, or stolen without authorization.
Can a company be held liable for a data breach?
Yes. Affected individuals can seek damages through civil action or a complaint with the NPC if the breach caused them harm, as explained in Respicio & Co.’s overview. Prompt notification and documented security measures help reduce liability.
Need help preventing or responding to a breach?
CloudConsole helps Philippine businesses secure their systems, monitor for threats, and prepare an incident response plan through our cybersecurity services, supporting Data Privacy Act compliance. Get a free cybersecurity assessment quote.