Cybersecurity Act
Filed on February 23, 2026, and referred to the Committees on Science and Technology, Civil Service, Government Reorganization and Professional Regulation, and Finance; it has been pending in committee since then with no recorded action.
The bill addresses the growing cybersecurity threats faced by the Philippines, which has seen a rise in cyber incidents.
The bill responds to increasing cybersecurity threats and the need for a coordinated response.
Cybersecurity Act
The Cybersecurity Act aims to strengthen the National Cybersecurity Inter-Agency Committee by renaming it to the National Cybersecurity Council and enhancing its powers and functions to address cybersecurity threats in the Philippines.
Compared with current law:
No formal cybersecurity council exists with these powers.
Establishes the National Cybersecurity Council with defined powers and responsibilities.
No mandatory reporting of data breaches.
Requires all entities to report data breaches to the Council.
No formal training programs for cybersecurity stakeholders.
Mandates the Council to conduct cybersecurity training.
The Cybersecurity Act aims to institutionalize and strengthen the National Cybersecurity Inter-Agency Committee, renaming it to the National Cybersecurity Council, to better address cybersecurity threats in the Philippines.
Source · full text✦ Dashed tags are AI-suggested nuance; solid tags follow the committee taxonomy.
Stalled: the bill has sat in committee for several months with no action since it was filed on February 23, 2026.
No floor deliberations yet — this measure has not reached plenary. Its committee-stage actions appear under Legislative history above.
Office of tige 49. 1.1012 TWENTIETH CONGRESS OF THE ) REPUBLIC OF THE PHILIPPINES FEB 23 P3:54 First Regular Session S.B. No. SE 1891 RECEIVED BY. Introduced by SENATOR IMEE R. MARCOS AN ACT INSTITUTIONALIZING AND STRENGTHENING THE NATIONAL CYBERSECURITY INTER-AGENCY COMMITTEE CREATED UNDER EXECUTIVE ORDER NO. 95 (S. 2019), RENAMING IT TO NATIONAL CYBERSECURITY COUNCIL, AND FOR OTHER PURPOSES EXPLANATORY NOTE Article 2, Section 5 of the Constitution provides that "the maintenance of peace and order, the protection of life, liberty and property and the promotion of the general welfare are essential for the enjoyment of the people of all the blessings of democracy." The evolution of Information Computer Technology (ICT) has brought tremendous advantages to the growth of our economy, as well as to the success of businesses in the country. Our countrymen, from all walks of life, are equally benefiting from the said advancement of technology. However, there is an urgent need to step- up and ensure the country's readiness against deliberate cyber-attacks which has become a serious national security threat. The International Telecommunications Union's 2024 Global Cybersecurity Index (GCI) places the Philippines in Tier 2 or the Advancing Tier along with countries like Benin, Canada, China, Israel, Switzerland, and Zambia in terms of commitment in adopting cybersecurity practices. In February 2025, Russian cybersecurity firm Kaspersky came up with a global ranking of countries with most online threats detected in 2024 where the Philippines moved up to 3rd place from 4th in the past year, with 42.3 percent of Filipino users encountering cyber risks in 2024. Kaspersky's report noted that a total of 14.10 million web threats targeted Filipino users last year, a decline from the 26.16 million incidents recorded in 2023. Despite this drop in volume, the Philippines moved up in rank, following Moldova with 43.2 percent of users attacked, and Belarus with 43.7 percent. Russia and Ukraine tied at the 4th place with 42 percent of their users attacked.
In order to enhance our cybersecurity capabilities, this bill seeks to institutionalize and strengthen the National Cybersecurity Inter-Agency Committee (NCIAC) and empower it to be the main authority that will address all cybersecurity related matter. It shall assess the vulnerabilities and risks of the country's cybersecurity and issue updated protocols to all government employees for the proper handling, distribution and storage of all forms of documents and communications as well as to enhance public-private partnership in promoting cybersecurity. The National Cybersecurity Inter-Agency Committee shall be transformed into a council with more powers and functions. It shall be reorganized by designating the Secretary of DICT as its Chairperson, adding other secretaries of government agencies as its members, and the appointing permanent personnel as its secretariat to be headed by an Executive Director in order to ensure its continuous and focused performance. Thus, it shall be renamed the "National Cybersecurity Council." For the abovementioned reasons, the passage of this bill is earnestly sought. Ence h. marca ¡MEE R. MARCOS
Difter of the seat iary TWENTIETH CONGRESS OF THE ) REPUBLIC OF THE PHILIPPINES First Regular Session FEB 23 P3,:54 SENATE S.B. No. 1891 RECEIVED BY: Introduced by SENATOR IMEE R. MARCOS AN ACT INSTITUTIONALIZING AND STRENGTHENING THE NATIONAL CYBERSECURITY INTER-AGENCY COMMITTEE CREATED UNDER EXECUTIVE ORDER NO. 95 (S. 2019), RENAMING IT TO NATIONAL CYBERSECURITY COUNCIL, AND FOR OTHER PURPOSES Be it enacted by the Senate and House of Representatives of the Philippines in Congress assembled:
SECTION 1. Short Title. - This Act shall be known as the "Cybersecurity Act."
SEC 2. Declaration of Policy. - The growth of information computer technology
is accompanied by new and serious threats. As such, the state recognizes as vitally important the establishment of a more secure cyberspace and a data protection regime that is compliant with international standards and ensures the free flow of information. Towards this end, there is a need to institutionalize and strengthen the National Inter- Agency Cybersecurity Committee (NIAC) to enhance the protection of the nation's critical information structures, ensuring their continuous operations even during crises and emergencies.
SEC. 3. Cybersecurity Council. - The National Cybersecurity Inter-Agency
Committee created under executive order no. 95 (s. 2019) is hereby institutionalized, reorganized, and renamed as the National Cybersecurity Council (NCC) under the administrative supervision of the Office the President.
SEC. 4. Reorganization of the Council. - The Council is chaired by the Secretary
of the Department of Information and Communications Technology (DICT) and co- chaired by the Executive Secretary and the National Security Adviser and Director- General of the National Security Council (NSC), and shall further be composed of the following officials as members:
• Secretary of the Department of Foreign Affairs (DFA); • Secretary of the Department of Finance (DOF); • Secretary of the Department of Science and Technology (DOST); • Secretary of the Department of Interior and Local Government (DILG); • Secretary of the Department of Justice (DOJ); • Secretary of the Department of Energy (DOE); • Secretary of the Department of National Defense (DND); • Secretary of the Department of Transportation (DOTr); • Secretary of the Presidential Communication Operations Office (PCOO); • Commissioner of the National Telecommunications Commission (NTC); • Director-General of the National Intelligence Coordinating Agency (NICA); • Director of the National Bureau of Investigation (NBI); • Chief of the Philippine National Police (PNP); • Chief of Staff of the Armed Forces of the Philippines; • Chairman of the National Privacy Commission (NPC); • Executive Director of the Anti-Terrorism Council-Program Management Center (ATM-PMC); • Executive Director of the Cybercrime Investigation and Coordinating Center (CICC); and • Governor of the Bangko Sentral ng Pilipinas (BSP) as members. The National Cybersecurity Council shall have a secretariat to be headed by an Executive Director. The organizational structure and staffing pattern of the secretariat shall be formulated by the Secretary of the Department Information and Communication Technology (DICT), subject to the approval of the Department of Budget and Management (DBM) in accordance with executive order no. 292, otherwise known as the "Administrative code of 1987". The National Cybersecurity Council may invite concerned public and private agencies or entities to participate, complement, and assist in the performance of its functions. The Council shall collaborate with the Anti-Terrorism Council (ATC) on matters relating to cyber-terrorism.
SEC. 5. Powers and Functions. - The National Cybersecurity Council shall be the
main authority to exercise powers and functions that would address all cybersecurity related matter. It shall perform the following functions: a. Assess the vulnerabilities of the country's cybersecurity; b. Implement capacity building measures for the purpose of responding to Cybersecurity threats and emergencies; c. Issue updated security protocols to all government employees involved in the storage, handling and distribution of all forms (digital, electronic, snail mail, etc.) of documents and communications, following best practices. These protocols shall be updated periodically and, as necessary, in light of the rapid developments in information and communications technology. d. Enhance the public-private partnership in the field of information sharing involving cyberattacks, threats and vulnerabilities to cyber threats; e. Conduct periodic strategic planning and workshop activities that will reduce the country's vulnerabilities to cyber threats; f. Direct its member agencies and appropriate agencies to implement cybersecurity measures as may be required by the situation; g. Serve as the country's coordinating arm on domestic, international, and transnational efforts pertaining to cybersecurity; h. Make such recommendations and/or such other reports as the president may from time to time direct; and i. Perform such other functions as may be necessary.
SEC. 6. Meetings of the Council. - The Council shall hold regular meeting every
quarter and such special meetings as may be necessary upon the request of the chairman or at least two (2) of its members.
SEC. 7. Report of Data Breach. - Government institutions, agencies,
instrumentalities, including government owned and controlled corporations, all private corporations, companies and business establishments, operating wholly or partly in the
1 Philippines, are required to report to the National Cybersecurity Council, within a reasonable period of time, all kinds of data breach occurring in their jurisdiction. The Council shall conduct trainings on cybersecurity to all stakeholders for the effective implementation of this proviso. Failure to make the required report shall be penalized with imprisonment of not less than six (6) months but not more than two (2) years or a fine of not more than One (1) million pesos, or both at the discretion of the court. In case of penalty of imprisonment, the same shall be imposed on the officials or persons who are responsible to make the report as determined in the implementing rules and regulations;
SEC. 8. Reportorial Requirement. - The National Cybersecurity Council shall
submit quarterly report, or as often as may be necessary, to the President of the Philippines and to Congress on the state of cybersecurity threats and other related information. The Council may request for an executive session from Congress if it may deem necessary.
SEC. 9. Appropriations. - The amount of necessary to carry out its functions
shall be included in the annual General Appropriations Act.
SEC. 10. Implementing Rules and Regulations. - The DICT, the DOJ, the DILG
and the NSC shall jointly formulate the necessary rules and regulations within ninety (90) days from approval of this Act, for its effective implementation.
SEC. 11. Separability Clause. - If any provision of this Act is held invalid, the
other provisions not affected shall remain in full force and effect.
SEC. 12. Repealing Clause. - All laws, decrees, orders, rules and regulations or
other issuances or parts thereof inconsistent with the provisions of this Act are hereby repealed or modified accordingly.
SEC. 13. Effectivity. - This Act shall take effect fifteen (15) days after its
publication in the Official Gazette or in any two (2) newspapers of general circulation in the Philippines. Approved,
Reproduced from the Senate document. The official PDF is the authoritative version.