How to File an NPC Data Privacy Complaint Philippines (2026) — GPS Tracking & Lending Apps (RA 10173)

Step-by-Step Guide

1. 1
   Understand when this applies. Under the Data Privacy Act of 2012 (RA 10173), you may have a data-privacy complaint if you believe a company processed your personal data unlawfully — for example: collecting or continuing to use your location, contacts, photos, or other data beyond what is necessary and proportionate for the purpose it stated (RA 10173 §11); collecting your data without valid, freely-given, specific consent; or sharing your data with a third-party collector, or with people in your contact list, without your consent. This is your own assessment of what happened to you — it is not LabanPH stating that any specific company has committed a violation; that determination belongs to the NPC.
2. 2
   Gather your evidence before contacting anyone: the loan or device agreement (including any GPS-tracking, location, or data-collection clause), screenshots of the app's or device's consent and permission screens, any messages sent to you or to people in your contact list, and a dated written timeline of what happened.
3. 3
   Consider notifying the company first — recommended, not required. Under the NPC's 2021 Rules of Procedure (NPC Circular 2021-01, as amended by NPC Circular 2024-01), raising the concern with the company (the "personal information controller") — typically in writing to its Data Protection Officer (DPO) — before filing is not a mandatory prerequisite, but it can resolve the issue faster and strengthens your file; the NPC can still act on a complaint, especially for a serious violation, even without prior notice. In that notice you can invoke your data-subject rights under RA 10173 §16: to be informed how your data is used and to access what is held (§16(c)); to object to, or ask for blocking of, processing you believe is unlawful, unnecessary, or excessive; to demand correction, erasure, or blocking of data that is inaccurate, no longer needed, or was unlawfully processed (§16(e)); and to withdraw consent (§34). If you do send a notice, keep proof you sent it and any reply, or non-reply.
4. 4
   File your complaint with the NPC — primarily through the online eComplaint Portal at complaints.privacy.gov.ph, which gives you an instant docket number. Email to complaints@privacy.gov.ph is a fallback for when the portal is unavailable (see the contact link below). Your complaint must be a sworn/verified statement (some filings are notarized — sources vary on how strictly; use the NPC's official complaint template) identifying the parties, the facts, the RA 10173 rights or provisions you believe apply, the remedy you are requesting, a Certification against forum shopping, and your supporting evidence. Filing is free for you as a data subject — only a corporation filing for competitive-harm reasons pays a ₱1,000 fee. You can build a ready-to-send NPC complaint with LabanPH (link below).
5. 5
   Know the timeline. Under NPC Circular 2021-01, the NPC dockets a complaint within 5 days, then runs a Sufficiency Evaluation within 15 days; if the complaint is sufficient, the NPC issues an Order to Comment and the respondent has 15 days to answer.
6. 6
   Know your filing window. Under NPC Circular 2021-01 §6, you generally have 1 year from when you discovered the violation to file, but not more than 5 years from when it was committed — and filing a complaint or pursuing alternative dispute resolution interrupts (pauses) that period. Because delay can still bar remedies, the safer course is to file as soon as you discover the issue rather than wait.
7. 7
   Know what the NPC can do. After evaluating a complaint, the NPC can investigate, issue compliance or cease-and-desist orders, order data corrected, blocked, or deleted, impose administrative fines, and refer serious violations for criminal prosecution. If you suffered actual damage from unlawful or unauthorized processing, RA 10173 §16(f) also provides a right to be indemnified for that damage — pursued through the NPC process and, ultimately, the courts.
8. 8
   A data-privacy complaint can run alongside other filings on the same facts. If the same company's collection conduct may also be an unfair collection practice under SEC rules, or the company is separately supervised by the BSP, you can file with each regulator in parallel — filing with the NPC does not require you to give up filing elsewhere.