Senator Bam Aquino has filed a bill to create a National Cybersecurity Agency (NCSA) that would lead the country’s cybersecurity strategy. The measure aims to protect personal data, prevent data breaches and curb online scams. It follows a series of hacking incidents involving government and private entities.
Aquino filed Senate Bill No. 2248, the proposed National Cybersecurity and Critical Information Infrastructure Protection Act. He chairs the Senate Committee on Science and Technology.
On Tuesday, cybersecurity monitoring group Deep Web Konek announced data breach and exposure incidents involving 23 major national government agencies, educational institutions and private entities. The National Privacy Commission (NPC) confirmed that 10 government agencies have reported personal data breach incidents.
They are the Presidential Commission on Good Government, the Department of Information and Communications Technology, the Department of Labor and Employment, the Bureau of Internal Revenue, the Philippine Amusement and Gaming Corporation, the Department of Justice, the Securities and Exchange Commission, the Philippine Coast Guard, the Department of Trade and Industry, and the Department of Science and Technology – Philippine Institute of Volcanology and Seismology. The mobile application of healthcare provider St. Luke’s Medical Center was also reported to have been hit by a cybersecurity incident.
Aquino said the proposed agency would serve as a shield against hacking and data leaks. He described these as the source of online scams, because the data used comes from government and private companies.
“Ang ahensiyang ito ang magsisilbing panangga natin laban sa mga hacking at data leak, na siyang pinag-uugatan ng mga online scam dahil sa mga datos na nakukuha sa gobyerno at mga pribadong kumpanya,” said Aquino.
Under the bill, the NCSA would be the government’s primary institution for developing and implementing the national cybersecurity strategy. It would oversee the implementation of cybersecurity policies and coordinate government agencies, private companies and international partners. The agency would also be tasked with setting cybersecurity standards to prevent and respond to cyber incidents.
The bill also covers training for businesses. Aquino said micro, small and medium enterprises (MSMEs) would receive data security training under the agency.
“Sa ahensiyang ito, mabibigyan ng training ukol sa data security ang mga pribadong kumpanya, gaya ng ating micro, small and medium enterprises (MSMEs), para maprotektahan ang kanilang mga record laban sa hacking,” Aquino explained.
The measure promotes cybersecurity research and development. It also provides for partnerships with academic institutions and international counterparts to build local expertise. Government agencies, government-owned and controlled corporations, and local government units would be required to adopt minimum cybersecurity and resilience measures for their information systems, networks and digital services.
Operators of Critical Information Infrastructure would have to conduct regular cybersecurity risk assessments, submit audit reports and keep up continuous monitoring. They would also have to promptly report critical and high-risk cybersecurity incidents.
The House of Representatives has its own version. House Bill No. 9605, the “National Cybersecurity and Critical Information Infrastructure Protection Act of 2026,” passed third reading on August 12 and now moves to the Senate.
