How do I file an NPC complaint against a lending app?
Last updated: 2026-07-11 · Educational content; not legal advice.
Short answer
File with the National Privacy Commission at privacy.gov.ph, which handles Data Privacy Act (RA 10173) violations by lending apps such as contact-list scraping and debt-shaming. Before filing, NPC Circular 16-04 generally expects you to have notified the lender of the violation and given it 15 days to respond; keep that written notice as an exhibit. Your complaint must identify the lending company (the data controller), describe the violation, and attach evidence — screenshots of the messages, the app's permission screen, and your loan record. Filing is free, needs no lawyer, and can be done online.
Primary sources
Frequently asked
Do I have to contact the lender first?
As a rule, yes. NPC Circular 16-04 requires a complainant to have informed the personal information controller of the privacy violation and allowed it a chance to respond (generally 15 days) before the NPC takes the complaint — unless doing so is futile or would cause further harm. Send that notice in writing and keep proof.
What do I attach to the complaint?
A sworn complaint-affidavit narrating what happened, your evidence (screenshots of the messages and permission screen, loan documents, the lender's SEC registration name), your written notice to the lender, and valid ID. The NPC's portal lists the current requirements.
Is there a deadline?
NPC Circular 16-04 sets a prescriptive period (generally within one year of learning of the violation). File early — evidence like app messages can disappear, and a prompt filing improves your chance of an interim order.
Take action
Got a similar problem?
File a complaint and we'll pre-fill BSP, SEC, DTI, and small-claims letters for you.
Contact-list scraping, unauthorized data use, and how to file with the NPC.