The legal framework
The Data Privacy Act 2012 gives rights of information, access, correction, erasure, damages and data portability, enforced by the National Privacy Commission. Unusually, it carries criminal penalties — including imprisonment — for unauthorised processing and malicious disclosure.
Key points
| Rights | Information, access, correction, erasure or blocking, damages, portability |
|---|---|
| Timeframe | Organisations must respond promptly; the NPC sets expectations |
| Breach notification | Mandatory within 72 hours for breaches involving sensitive data and risk of harm |
| Data protection officer | Mandatory for personal information controllers |
| Criminal penalties | Imprisonment and fines for unauthorised processing and malicious disclosure |
| Sensitive personal information | Includes health, sexual life, and government identifiers |
| Regulator | National Privacy Commission |
| Criminal offences | Unauthorised processing, negligent access and malicious disclosure are crimes |
| 72-hour notification | For breaches involving sensitive personal information |
| Registration | Data processing systems above thresholds must be registered |
| Damages | The Act provides for indemnity in addition to penalties |
In practice
- Write to the organisation first, citing the relevant statutory right; keep proof of the date.
- Set out clearly what you want: a copy of your data, deletion, or an end to marketing.
- If there is no adequate reply within the statutory period, complain to the regulator — it is free.
- For dating, health and fertility apps, ask specifically about third-party sharing and overseas transfers.
- File the complaint with the National Privacy Commission using its prescribed form.
- Exhaust the organisation's internal process first — the Commission requires it.
Cost and coverage
Complaints to the NPC are free; the Commission mediates many disputes.
Recent changes
The NPC has been particularly active on online lending applications that harvest contact lists to shame borrowers — a practice it has repeatedly sanctioned.
Where to go
- National Privacy Commission — complaints and advisory opinions.
- Data protection officers, whose details must be published.
- Cybercrime units of the police and NBI for criminal matters.
Worth knowing
If a lending app has accessed your contacts and messaged them, that is a recognised violation with an established complaints route at the NPC — screenshots and the app's privacy policy are the key evidence. The Philippine Act provides both criminal penalties and indemnity to the individual, which is unusual in the region and makes complaints worth pursuing.
Official sources and links
- gov.ph — official government portal