How do I file an NPC complaint against a lending app?

Yes — as a rule, you must. Rule II §2 of the NPC's 2021 Rules of Procedure (as amended, 4 March 2024) provides that no complaint shall be given due course unless it is established that you informed the personal information controller in writing, and that it did not take timely or appropriate action, or did not respond within fifteen (15) calendar days from receiving your written notice. The NPC may waive this at its discretion for good cause, or where the violation is serious — for example where the harm is grave and irreparable, where the company can give no adequate remedy, or where its conduct is patently illegal. Do not rely on the waiver: send the notice in writing, keep proof of sending, and attach both the notice and any reply to your complaint.

File through the NPC's eComplaint Portal at complaints.privacy.gov.ph first — it's the primary channel and gives you an instant docket number. E-mail to complaints@privacy.gov.ph is a fallback for when the portal is unavailable.

A sworn/verified complaint stating the parties, the facts, the rights you believe were violated, and the relief requested, plus a Certification against forum shopping — some filings are notarized; use the NPC's complaint template as your guide. Attach your evidence (screenshots of the messages and permission screen, loan documents, the lender's SEC registration name), any written notice to the lender, and valid ID.

There is a prescriptive period, but not the one usually quoted. Rule I §6 of the Rules is titled 'Prescriptive Period of the Penal provision of the DPA' and adopts the periods in Act No. 3326, the general prescription law for special acts. It does not set a one-year filing deadline for data subjects, and no such deadline appears anywhere in the Rules — so how long you have depends on which DPA offence is involved. Treat the practical deadline as evidence rather than the calendar: app messages, call logs and device records are routinely deleted on short retention cycles, so file early.

Assume there is one, and ask before you file. Rule II §4 of the amended Rules provides that no further action will be taken on a complaint unless the appropriate filing fees have been paid, with three exceptions: government complainants; an indigent complainant as defined in the Rules of Court, or as the NPC prescribes by advisory; and a waiver granted by the NPC on motion for good cause. The Rules themselves state no amount — the schedule sits in a separate NPC circular — so ask the NPC what is payable in your case, and raise indigency or move for a waiver if you cannot pay. The widely repeated claim that filing is simply free for data subjects is not supported by the text of the Rules.