PAGCOR checks alleged online posting of its restricted-persons database after privacy regulator lists it among 10 agencies with breach notifications

The Philippine Amusement and Gaming Corporation (PAGCOR) is checking whether an online posting that allegedly contains data from its National Database of Restricted Persons (NDRP) is genuine, the regulator said in a public advisory on November 11, 2026.

In the advisory, posted on its website at 6:00 p.m. Manila time, PAGCOR said it "is aware of a recent online posting allegedly containing information associated with" the NDRP. Its Computer Emergency Response Team (PAGCOR-CERT) "is verifying the authenticity, source, and extent of the alleged disclosure, including whether it relates to a previously reported incident," the regulator said. The advisory does not say how many records the posting claims to contain or what kinds of personal data appear in it.

The NDRP is the list that PAGCOR-licensed operators use to turn away people who are barred from gambling. Under PAGCOR's Responsible Gaming Code of Practice, the database is accessible online to authorised representatives of gaming operators.

Privacy regulator's list of breach notifications

The advisory came a day after the National Privacy Commission (NPC) said that, as of November 10, it had received personal data breach notifications from 10 government agencies, including PAGCOR. The others were the Presidential Commission on Good Government, the Department of Information and Communications Technology, the Department of Labor and Employment's Bureau of Local Employment, the Bureau of Internal Revenue, the Department of Justice's Office for Alternative Dispute Resolution, the Securities and Exchange Commission, the Philippine Coast Guard, the Department of Trade and Industry and the Philippine Institute of Volcanology and Seismology.

The NPC statement does not say what PAGCOR's notification concerned, and PAGCOR's advisory does not mention it.

According to NPC spokesperson and Deputy Privacy Commissioner Jose Belarmino II, each notification is assessed by the commission's Compliance and Monitoring Division, which reports its findings and recommendations to the Commission En Banc for a decision. The NPC also said government agencies remain accountable for personal data under their control "even when the processing of such data is outsourced or subcontracted to third-party service providers," citing Section 21 of the Data Privacy Act of 2012.

In an earlier statement on November 6, the NPC said it was aware of reports of alleged data leaks involving several government agencies on November 5 and had not yet received breach notifications. It said reports of alleged leaks "do not, by themselves, establish that a personal data breach has occurred." Under NPC Circular No. 16-03, organisations must notify the commission and affected people within 72 hours when a breach requiring mandatory notification has occurred.

What PAGCOR said after the 2025 incident

This is not the first time the database has been reported hacked. On September 2, 2025, PAGCOR said the hacked list did not come from the PAGCOR website "but was likely obtained from one of its gaming licensees who have access to the NDRP."

At the time, PAGCOR said the NDRP was "not a list of gambling addicts." Ma. Vina Claudette Oca, assistant vice president of PAGCOR's Gaming Licensing and Development Department, which maintains the database, said it contained "over 560,000 names only, mainly elected officials" sourced from the Department of the Interior and Local Government website. Government officials are included because they are barred by law from entering gambling establishments. Oca said the database also held 1,711 banned persons, people subject to self-exclusion, family exclusion or exclusion requested by licensees.

The excluded part of the database has grown since then. PAGCOR's exclusion data sheet shows 40,551 active exclusion records filed in 2026 as of October 31, including 40,043 self-exclusions. The 2025 and 2026 figures are counted differently, so they are not directly comparable. AskSpinner set out how the register grew this year in its report on PAGCOR's self-exclusion register.

The rule barring public officials from casinos was at issue this week in the Ombudsman's suspension of a Cavite mayor over alleged casino gambling.

PAGCOR has not said when it will finish its review.