How long do I have to file a data-privacy complaint with the NPC?
Last updated: 2026-07-12 · Educational content; not legal advice.
Short answer
Don't wait — file promptly, and take a required first step. Under the NPC's 2021 Rules of Procedure (NPC Circular No. 2021-01), before the Commission takes up your complaint you are generally expected to have first brought the matter to the company (the personal information controller), usually to its Data Protection Officer, and given it a reasonable chance to respond. Data-privacy claims are also subject to prescriptive limits, so both administrative action and criminal prosecution under RA 10173 can be time-barred if you delay. Because the exact window depends on the nature of the violation, the safest course is to complain internally as soon as you discover it and file with the NPC without unnecessary delay.
Primary sources
Frequently asked
Do I have to complain to the company first?
Usually yes. The NPC's 2021 Rules generally expect you to have raised the issue with the company's Data Protection Officer and given it a chance to act before the NPC will entertain the complaint — so send a written complaint to the DPO and keep proof and their reply (or non-reply).
Is there a hard deadline in years?
The window depends on the type of violation, and the exact period is set by the Rules and the general prescription rules for offenses. Rather than rely on a fixed number, treat any privacy violation as time-sensitive: act as soon as you discover it, because both administrative and criminal remedies can lapse.
What proof helps if timing is questioned?
Keep dated evidence of when you discovered the violation, your written complaint to the company and the date sent, and the company's response or silence. This anchors when your clock started and shows you moved promptly.
Take action
Related companies
Got a similar problem?
File a complaint and we'll pre-fill BSP, SEC, DTI, and small-claims letters for you.
Contact-list scraping, unauthorized data use, and how to file with the NPC.