How to File an NPC Data Privacy Complaint Philippines (2026) — GPS Tracking & Lending Apps (RA 10173)

Step-by-Step Guide

1. 1
   Understand when this applies. Under the Data Privacy Act of 2012 (RA 10173), you may have a data-privacy complaint if you believe a company processed your personal data unlawfully — for example: collecting or continuing to use your location, contacts, photos, or other data beyond what is necessary and proportionate for the purpose it stated (RA 10173 §11); collecting your data without valid, freely-given, specific consent; or sharing your data with a third-party collector, or with people in your contact list, without your consent. This is your own assessment of what happened to you — it is not LabanPH stating that any specific company has committed a violation; that determination belongs to the NPC.
2. 2
   Gather your evidence before contacting anyone: the loan or device agreement (including any GPS-tracking, location, or data-collection clause), screenshots of the app's or device's consent and permission screens, any messages sent to you or to people in your contact list, and a dated written timeline of what happened.
3. 3
   Notify the company first — this is required, not optional, and it is the step most complaints are dismissed for skipping. Under the NPC's 2021 Rules of Procedure (NPC Circular 2021-01, as amended by NPC Circular 2024-01), Rule II §2 provides that no complaint shall be given due course unless you informed the company (the "personal information controller") in writing — typically its Data Protection Officer (DPO) — and it failed to take timely or appropriate action, or did not respond within fifteen (15) calendar days from receiving your notice. Rule IV §1(2) then lists "the complainant does not give the respondent an opportunity to address the complaint" as a ground for outright dismissal. The NPC may waive the requirement for good cause or where the violation is serious — grave and irreparable harm, no adequate remedy from the company, or patently illegal conduct — but plan on complying, not on being excused. In that notice you can invoke your data-subject rights under RA 10173 §16: to be informed how your data is used and to access what is held (§16(c)); to object to, or ask for blocking of, processing you believe is unlawful, unnecessary, or excessive; to demand correction, erasure, or blocking of data that is inaccurate, no longer needed, or was unlawfully processed (§16(e)); and to withdraw consent (§34). If you do send a notice, keep proof you sent it and any reply, or non-reply.
4. 4
   File your complaint with the NPC — primarily through the online eComplaint Portal at complaints.privacy.gov.ph, which gives you an instant docket number. Email to complaints@privacy.gov.ph is a fallback for when the portal is unavailable (see the contact link below). Your complaint must be a sworn/verified statement (some filings are notarized — sources vary on how strictly; use the NPC's official complaint template) identifying the parties, the facts, the RA 10173 rights or provisions you believe apply, the remedy you are requesting, a Certification against forum shopping, and your supporting evidence. Do not assume filing is free: Rule II §4 provides that no further action is taken on a complaint unless the appropriate filing fees have been paid, except for government complainants, an indigent complainant as defined in the Rules of Court, or where the NPC waives the fee on motion for good cause. The Rules state no amount, so ask the NPC what is payable in your case before you file. You can build a ready-to-send NPC complaint with LabanPH (link below).
5. 5
   Know the timeline. Under the Rules as amended, the NPC assigns your complaint to an investigating officer within 5 calendar days (Rule II §6). The investigating officer then has 30 calendar days from receipt to give the complaint due course or dismiss it without prejudice (Rule IV §1). If it is given due course, the respondent is ordered to file a verified comment within 15 calendar days, and the complaint may be submitted for resolution if it does not (Rule IV §9).
6. 6
   Know your filing window — and be careful what you are told about it. Rule I §6 of the Rules concerns the prescriptive period of the PENAL provisions of the Data Privacy Act and adopts the periods in Act No. 3326; it does not set a one-year filing deadline for data subjects, and no such deadline appears anywhere in the Rules. How long you have therefore depends on the offence involved. The binding constraint in practice is evidence rather than the calendar: app messages, call logs, device records and server-side logs are deleted on short retention cycles, so file as soon as you discover the issue.
7. 7
   Know what the NPC can do. After evaluating a complaint, the NPC can investigate, issue compliance or cease-and-desist orders, order data corrected, blocked, or deleted, impose administrative fines, and refer serious violations for criminal prosecution. If you suffered actual damage from unlawful or unauthorized processing, RA 10173 §16(f) also provides a right to be indemnified for that damage — pursued through the NPC process and, ultimately, the courts.
8. 8
   A data-privacy complaint can run alongside other filings on the same facts. If the same company's collection conduct may also be an unfair collection practice under SEC rules, or the company is separately supervised by the BSP, you can file with each regulator in parallel — filing with the NPC does not require you to give up filing elsewhere.