How do I report a data privacy violation in the Philippines?
Last updated: 2026-09-05 · Educational content; not legal advice.
Short answer
File with the National Privacy Commission (NPC) — primarily through its online eComplaint Portal at complaints.privacy.gov.ph, which issues an instant docket number; e-mail to complaints@privacy.gov.ph is a fallback if the portal is down. The Data Privacy Act of 2012 (RA 10173) gives the NPC authority to investigate, order data deletion, fine controllers, and refer criminal cases to the DOJ. Before you file, you must first tell the company in writing: Rule II §2 of the NPC's Rules of Procedure provides that no complaint is given due course unless you informed the controller in writing and it failed to act, or did not respond within fifteen (15) calendar days. The complaint must be a sworn/verified statement identifying the data controller, describing the alleged violation, and attaching documentary evidence — including that written notice and any reply.
Need a letter for this?
Primary sources
Frequently asked
Is there a filing fee?
Assume yes, and ask. Rule II §4 of the Rules of Procedure (as amended, 4 March 2024) provides that no further action is taken on a complaint unless the appropriate filing fees have been paid — the exceptions being government complainants, an indigent complainant as defined in the Rules of Court, and a waiver by the NPC on motion for good cause. No amount appears in the Rules themselves. File through the online eComplaint Portal (complaints.privacy.gov.ph) — the primary channel, which issues an instant docket number — with e-mail (complaints@privacy.gov.ph) and walk-in at the NCR field office as fallbacks, and ask what is payable in your case before you file.
How long do I have to file?
Not as commonly stated. Rule I §6 of the Rules concerns the prescriptive period of the PENAL provisions of the Data Privacy Act and adopts the periods in Act No. 3326; it sets no one-year filing deadline for data subjects, and no such deadline appears in the Rules. How long you have depends on the offence involved — so treat evidence, not the calendar, as the binding constraint and file early, because app messages, call logs and device records are deleted on short retention cycles.
What can the NPC actually do?
Issue cease-and-desist orders, order deletion of data, impose administrative fines (up to ₱5M per offence under NPC Circular 2022-01), and refer for criminal prosecution under RA 10173 (penalties up to 6 years and ₱4M).
Take action
More questions
Is there a filing fee?
No. NPC complaints are filed without charge; the agency accepts online portal, e-mail (complaints@privacy.gov.ph), and walk-in submissions.
Anong evidence ang dapat i-attach?
Loan contract, app permission screenshots, third-party messages na may PII, breach notification email, at lahat ng written correspondence sa data controller.
Related companies
Got a similar problem?
File a complaint and we'll pre-fill BSP, SEC, DTI, and small-claims letters for you.
Contact-list scraping, unauthorized data use, and how to file with the NPC.