THE PHILIPPINES has one of the region’s stricter breach-disclosure regimes on paper. Under the Data Privacy Act, personal information controllers must notify the National Privacy Commission within 72 hours of discovering a breach likely to cause serious harm, then submit a full report within five days.