How do I file an NPC complaint about the GPS tracking on my loan?
Last updated: 2026-09-05 · Educational content; not legal advice.
Short answer
You file with the National Privacy Commission (NPC) at privacy.gov.ph. Raise the matter with the company first — this is a requirement, not a courtesy: Rule II §2 of the NPC's Rules of Procedure provides that no complaint is given due course unless you informed the controller in writing and it failed to take timely or appropriate action, or did not respond within fifteen (15) calendar days. So send a written request or objection to the lender's Data Protection Officer, keep proof of sending, and let the fifteen days run before you file. If it is unresolved, submit your NPC complaint with a clear statement of the violation, your evidence (the loan contract, tracking or kill-switch clauses, screenshots, and proof you contacted the DPO), and your identity. The NPC can investigate, order the data deleted or the processing stopped, and impose penalties. No lawyer is required.
Need a letter for this?
Primary sources
Frequently asked
Do I have to complain to the lender first?
Yes. Rule II §2 of the NPC's Rules of Procedure provides that no complaint shall be given due course unless you informed the controller in writing and it did not take timely or appropriate action, or did not respond within fifteen (15) calendar days. The NPC may waive this for good cause or where the violation is serious, but do not plan around a waiver. Keep proof that you wrote to its Data Protection Officer, and attach that notice to the complaint.
Is there a filing fee?
Ask before you assume. Rule II §4 of the amended Rules provides that no further action is taken on a complaint unless the appropriate filing fees have been paid, except for government complainants, an indigent complainant as defined in the Rules of Court, or where the NPC waives the fee on motion for good cause. No amount appears in the Rules. File through the online portal, by e-mail (complaints@privacy.gov.ph), or in person at the NCR field office — and ask what is payable in your case. No lawyer is needed.
What can the NPC order?
After investigating it can order the controller to stop the processing and delete the data, issue compliance orders, and impose administrative fines; serious violations can be referred to the DOJ for prosecution.
Take action
Related companies
Related issues
Got a similar problem?
File a complaint and we'll pre-fill BSP, SEC, DTI, and small-claims letters for you.
The legality of remote engine-disable devices installed on financed vehicles.