How do I report a data privacy violation in the Philippines?
Last updated: 2026-05-04 · Educational content; not legal advice.
Short answer
File with the National Privacy Commission (NPC) at privacy.gov.ph using the official complaint form. The Data Privacy Act of 2012 (RA 10173) gives the NPC authority to investigate, order data deletion, fine controllers, and refer criminal cases to the DOJ. The complaint must identify the data controller, describe the alleged violation, and attach documentary evidence.
Primary sources
Frequently asked
Is there a filing fee?
No. NPC complaints are filed without charge; the agency operates an online portal, e-mail intake (complaints@privacy.gov.ph), and walk-in at its NCR field office.
How long do I have to file?
NPC Circular 16-04 sets a 1-year prescriptive period from the date the complainant knew of the violation, but earlier filings (within 30 days of discovery) preserve evidence and increase the chance of a temporary order.
What can the NPC actually do?
Issue cease-and-desist orders, order deletion of data, impose administrative fines (up to ₱5M per offence under NPC Circular 2022-01), and refer for criminal prosecution under RA 10173 (penalties up to 6 years and ₱4M).
Take action
More questions
Is there a filing fee?
No. NPC complaints are filed without charge; the agency accepts online portal, e-mail (complaints@privacy.gov.ph), and walk-in submissions.
- Source:NPC complaint portal
Anong evidence ang dapat i-attach?
Loan contract, app permission screenshots, third-party messages na may PII, breach notification email, at lahat ng written correspondence sa data controller.
Related companies
Got a similar problem?
File a complaint and we'll pre-fill BSP, SEC, DTI, and small-claims letters for you.