If your data is exposed
What we do, when you would hear from us, and what you can do about it.
Last checked against the platform: 27 August 2026
What counts as a breach
A personal data breach is a security incident that leads to your personal data being destroyed, lost, altered, disclosed or accessed by someone who should not have it — whether by accident or deliberately.
When you would hear from us
Within 72 hours of us knowing. NPC Circular 2016-03 requires notification within 72 hours of becoming aware of a breach involving sensitive personal information, or affecting 100 or more people. We notify the National Privacy Commission and, where the breach is likely to cause you real risk of serious harm, we notify you directly.
The clock runs from when we become aware, not from when we finish investigating. You would be told what we know at the time, and told again when we know more.
Which data would concern us most
Not all data is equally sensitive, and our response is not the same for all of it. These are treated as the most serious:
| Data | Why it matters |
|---|---|
| Biometric data and ID images | Sensitive personal information under NPC Advisory 2017-03. You cannot change your face the way you can change a password. |
| Session recordings | They show you, in your home, saying what a document says about you. |
| Notarized documents | Deeds, affidavits and powers of attorney disclose a great deal by their nature. |
| Register entries | They link a person to an act, a document and an identity document. |
What we would tell you
- What happened, in plain language.
- Which of your data was involved.
- What the likely consequences are.
- What we have done and are doing about it.
- What you can do to protect yourself.
- How to reach our Data Protection Officer, and how to complain to the NPC.
What we do internally
Detection and assessment within four hours; containment within 24; notification within 72. Every step is recorded on an audit trail that cannot be edited afterwards, which is what makes the timeline checkable rather than merely asserted.
Reporting something to us
If you believe your data has been exposed — or you have found a vulnerability — tell us at support@daloytechsolutions.com, marked for the Data Protection Officer. We will confirm we received it.
We will not take action against anyone who reports a genuine security problem to us in good faith and does not exploit it further.
Complaining independently
You can complain to the National Privacy Commission directly, whether or not you have raised it with us. You do not need our permission and you do not need to go through us first.
Related
What we collect and how long we keep it is in the privacy notice. To exercise a right over your own data, use the data request form.