What are my rights as a data subject under the Data Privacy Act?
Last updated: 2026-07-11 · Educational content; not legal advice.
Short answer
The Data Privacy Act (RA 10173 §16) gives you the right to be informed that your data is being processed; to access your data, its sources, and who received it; to dispute and correct inaccurate data; to suspend, withdraw, or order the blocking, removal, or destruction of your data; and to be indemnified for damages from inaccurate, unlawfully obtained, or unauthorized use. RA 10173 also gives a right to data portability (§18). Any organization that processes your personal data — a lender, bank, app, or employer — must respect these rights, and the National Privacy Commission enforces them.
Primary sources
Frequently asked
What is the right to access?
RA 10173 §16(c) lets you demand reasonable access to your data held by an organization — the contents, the sources, the recipients it was shared with, and the manner of processing. Ask the organization's Data Protection Officer in writing.
What is the right to erasure or blocking?
§16(e) lets you order the suspension, withdrawal, blocking, removal, or destruction of your personal data when it is incomplete, outdated, false, unlawfully obtained, used without authorization, or no longer needed for the purpose it was collected.
How do I enforce these rights?
Assert them in writing to the controller first. If ignored or refused, file a complaint with the NPC, which can compel compliance, order deletion, fine the organization, and refer criminal violations for prosecution.
Take action
Related companies
Got a similar problem?
File a complaint and we'll pre-fill BSP, SEC, DTI, and small-claims letters for you.
Contact-list scraping, unauthorized data use, and how to file with the NPC.