[Data Privacy & Security] Reporting a Data Privacy or Security Concern

If you suspect a data breach, lost device, suspicious email, or any incident involving personal data, report it promptly — early reporting limits harm and is required under the Data Privacy Act (RA 10173).

Report immediately if you notice:
- A lost or stolen device containing official files
- An email asking for passwords or personal data (possible phishing)
- Personal data sent to the wrong recipient
- Any unauthorized access to systems or records

How to report:
1. Submit a ticket under "Data Privacy & Security" and mark the priority High.
2. Describe what happened, when you noticed it, and what data may be involved — without including the sensitive data itself in the ticket.
3. Do not delete or alter anything related to the incident; it may be needed for assessment.

The Data Protection Officer will assess the report and advise on next steps.