Can a company share my personal information without my consent?
Last updated: 2026-07-11 · Educational content; not legal advice.
Short answer
Generally no, unless it has another lawful basis. The Data Privacy Act (RA 10173) allows processing of personal information only where a criterion in §12 is met — such as your consent, performance of a contract you are party to, a legal obligation, or a legitimate interest that is not overridden by your rights. Sharing your data outside those grounds — for example, disclosing your debt to your contacts or selling your details to third parties — is unauthorized disclosure punishable under §32, and you can complain to the National Privacy Commission.
Primary sources
Frequently asked
What are the lawful bases besides consent?
RA 10173 §12 lists them for personal information: your consent; a contract you are party to; compliance with a legal obligation of the controller; protection of vital interests; a task in the public interest; or a legitimate interest of the controller not overridden by your fundamental rights. Sensitive personal information has stricter grounds under §13.
Can they claim 'legitimate interest' to share my debt with my contacts?
No. A legitimate interest cannot override your rights and cannot justify disclosing your debt to third parties who are not co-makers or guarantors. That is unauthorized disclosure under §32 and, for lenders, an unfair collection practice under SEC MC 18.
What if I agreed in the fine print?
Blanket fine-print consent to share your data for unrelated purposes may not be valid; RA 10173 requires consent to be specific and informed, and processing to stay proportional. Overbroad sharing can still be challenged before the NPC.
Take action
Related companies
Got a similar problem?
File a complaint and we'll pre-fill BSP, SEC, DTI, and small-claims letters for you.
Contact-list scraping, unauthorized data use, and how to file with the NPC.