Your Personal Data Misused or Leaked by a Company: Filing a Complaint with the Philippine Privacy Commission

First check whether your situation is an NPC matter

The Philippine data privacy law regulates organisations that process personal information: companies, schools, hospitals, banks, telcos, lending apps, condominium administrators and employers. When they collect, use, store, share or dispose of your data they need a lawful basis, must tell you the purpose and must protect it properly. Sharing your data with third parties without consent, using it for purposes you were not told about, losing it through poor security, or refusing your request to access or correct it are all matters the NPC can take up.

Some situations are not purely NPC matters or need other agencies at the same time. A dispute between individuals, such as an ex-partner posting your photos online, is mainly a cybercrime or defamation issue for the police or cybercrime units: see how to report cybercrime in the Philippines. A lending app that uses your contact list to harass friends and family may breach the privacy law and the rules on debt collection: see harassment by online lending apps. Service complaints against banks or e-wallets have their own regulator channels.

Foreigners whose data is processed in the Philippines are also protected by the law and can complain as data subjects. Whether a complaint is accepted and how jurisdiction is decided depends on the Commission's current rules and its review of your case. If you are unsure, prepare your file as described below and let the Commission decide whether to take the case or refer it elsewhere. Preparing well costs little, and a clear file also helps with any of the other channels you may need.

Step one: preserve evidence of who did what, and when

Whether a complaint moves forward depends heavily on evidence. Keep material that proves three things: which organisation processed your information, what it did with it and how it affected you.

• Records of giving them your information: application forms, contracts, app sign-up screenshots, privacy notices or consent terms.
• Evidence of misuse or leakage: screenshots of calls and texts from strangers showing number and time, recordings or chats in which someone recites your details, screenshots and links where your data appears online, and any breach notice the organisation sent you.
• Evidence of impact: how often and when you were harassed, records of accounts or loans opened in your name, and any resulting loss or medical treatment.

Screenshots should show time and source; save links and full-page captures for web pages. Do not impersonate anyone, break into systems or obtain internal documents improperly to build your case. Material obtained that way will not help and could put you on the wrong side of the law. If you suspect your data was used to open accounts or take loans, check your credit record and the accounts concerned straight away: see when your identity is used to open loans. Keep everything in one dated folder so you can add new evidence as it arrives. Number each item in the order it happened and write one line describing what it shows. When the Commission or the organisation asks a question later, you will be able to point to the exact item instead of searching through your phone, and the overall pattern of misuse becomes much easier for an outsider to see.

Step two: write to the organisation first. This step is rarely skippable

Before complaining to the NPC you are generally expected to raise the problem with the organisation in writing and give it a chance to respond. The precise requirement and waiting period are set by the Commission's current complaint rules, but in practice you will almost always be asked whether you contacted the organisation first.

Write to its Data Protection Officer, whose contact details are usually in the privacy notice, or to customer service. Include only the identification needed, your relationship with the organisation, what you found, the supporting evidence and what you want. Be specific: stop using or sharing your data, delete or correct it, tell you who received it and explain what remedial steps it has taken.

If your request is to access, correct or delete your own data, that is your right as a data subject and the organisation should reply within a reasonable time. For how organisations should handle such requests, see how companies should answer data subject requests, which is written from the company side but shows what you can expect.

Send it by email and keep proof of sending. Save every reply, whether it is a refusal, a brush-off or an admission. If the organisation fixes the problem, that may be the end of it. If it ignores you or replies unsatisfactorily, you now have the prior-contact record the complaint needs. If you are not sure who the right recipient is, send the notice to both the published privacy contact and the general customer service address, and say in the email that you have done so. Give a reasonable time for a reply and diarise the date, so you know when to move to the next step rather than waiting indefinitely.

Step three: file with the NPC. Documents, method and what happens next

If the organisation does nothing or its response is unsatisfactory, you can file a complaint with the NPC. The Commission usually provides written or online channels. The exact method, forms and whether the complaint must be sworn or notarised are set out in the procedure on its official website, so follow the current version.

A complaint file usually contains the complaint itself (your identity, the organisation, the facts, which obligations you believe were breached and what you are asking for), your ID, the evidence you gathered, your written notice to the organisation and its reply. Write the facts in date order and tag each statement with the matching evidence number. Filing in English is smoother, with translations for anything in Chinese.

Once accepted, the Commission may ask both sides for more information, hold mediation or move to investigation and decision. It takes time. Outcomes can include orders for the organisation to fix its practices or stop the unlawful processing, and serious cases may lead to further legal liability. A complaint does not automatically produce compensation; damages are often pursued separately through civil proceedings, and whether that is worth it is a question for a lawyer.

While the complaint is pending, keep collecting evidence, such as whether harassment continues. Do not retaliate by posting the organisation's staff details online, which would put you in the same position you are complaining about. If the organisation contacts you directly after you file, keep the conversation in writing, avoid agreeing to anything verbally and let the Commission know about any settlement offer. A written record of how the organisation behaved after the complaint can matter as much as the original incident.

Beyond the complaint: things to do at the same time

An NPC complaint deals with the organisation's compliance and often will not stop the harassment quickly, so run these steps alongside it.

• Stop the spread: ask each platform to remove posts containing your data through its privacy reporting tools, and ask search engines to remove results showing your personal information.
• Secure your accounts: change key passwords, turn on two-factor authentication and check banks and e-wallets for unusual logins. If your number is controlled by or registered to someone else, see moving a SIM registered in someone else's name into your own.
• Personal safety: if harassment has reached your home, involves following or threats, report it to the police and alert building security. Your safety comes before any complaint process.
• Report crimes: fraud, loans taken in your name or extortion should be reported to the police or cybercrime units, and the report can supplement your NPC file.

These channels are not mutually exclusive. Keep one dated list of all your material and pull from it for each agency, which saves a great deal of effort. Note each agency's reference number next to the items you gave it, so you can answer follow-up questions quickly and avoid sending inconsistent versions. If the volume becomes overwhelming, ask a trusted friend or a professional adviser to help you keep the file in order. Harassment cases often drag on, and a tidy, consistent record is what lets each agency act on your report rather than asking you to start again from the beginning. Make a backup copy of the folder somewhere other than your phone, in case the phone itself is lost or compromised during the dispute.

Reducing misuse from now on, and how Yixing can help

Once personal data is handed over it is hard to take back, so ask one more question before you hand it over. A few habits help in daily life in the Philippines:

• Write the purpose and date across ID copies you hand over, and give only what is genuinely needed.
• Check which permissions lending and shopping apps request, and refuse contact list and photo access where you can.
• Do not post passports, visas, addresses or phone numbers in group chats or on social media.
• When a transaction is finished, you can ask in writing for your data to be deleted once it is no longer needed.

When Yixing handles visa and settling-in matters for clients, we process client data in line with the data privacy law, collect only what the service needs and do not share it with unrelated third parties. If you are unsure whether an organisation is entitled to a document it is asking for, ask it to explain the purpose in writing before you provide it. A legitimate organisation will usually be able to tell you why it needs the document, how long it keeps it and who else may see it.

Yixing Travel Consultancy (SEC Registration No. CS202009551, Bureau of Immigration Accredited Agency No. CA-202624381-1, DOLE-accredited) can help through our settling-in services by organising your evidence list, preparing bilingual notices to the organisation and complaint documents, and connecting you with licensed lawyers when needed. We do not act in complaints or litigation and cannot promise any outcome. For your specific case consult a licensed lawyer; this article is not legal advice.