Quick answer

If someone posts your personal information online without consent, you may demand removal or correction, report the content to the platform, exercise your rights under the Data Privacy Act, complain to the National Privacy Commission (NPC), and—depending on the content and harm—pursue civil or criminal remedies.

However, lack of consent does not automatically make every post illegal. Consent is only one possible lawful basis for processing ordinary personal information. Publication may also be justified by law, a legitimate interest that outweighs the privacy impact, the performance of a public function, or another ground recognized by law. Journalistic, artistic, literary and research processing, and certain information connected with public office, are also treated differently.

The decisive questions are:

What information was posted?
Who posted it, and where did the information come from?
Why and how widely was it published?
Was there another lawful basis for publication?
Was the disclosure excessive, misleading, malicious, sexual, threatening or harmful?
Does the poster fall within the Data Privacy Act’s coverage or an exclusion?
Is another law—such as the Anti-Photo and Video Voyeurism Act, Safe Spaces Act or Cybercrime Prevention Act—a better fit?

Act quickly, but preserve evidence before requesting deletion.

What counts as personal information?

Under the Data Privacy Act of 2012, personal information is information that identifies a person directly or that, when combined with other information, would directly and certainly identify that person. Online examples include:

Full name combined with an address, workplace or school
Mobile number, email address or social-media account
Home address or real-time location
Identification cards, signatures and account numbers
Photographs, videos and voice recordings
Private messages and correspondence
Employment, financial or family information
Information used to impersonate or locate someone

“Sensitive personal information” receives stricter protection. It includes information about matters such as health, education, sexual life, marital status, age, religious or political affiliations, alleged or proven offenses, government-issued identifiers, and other information classified as sensitive by law.

Posting, uploading, sharing, reproducing and disclosing personal data are forms of “processing.” A screenshot, repost or forwarded message can therefore create a separate legal issue even if the information originally came from someone else.

No consent does not always mean unlawful publication

For ordinary personal information, Section 12 of the Data Privacy Act recognizes lawful grounds other than consent. These include necessity for a contract, compliance with a legal obligation, protection of vital interests, performance of a public mandate, and legitimate interests that are not overridden by the data subject’s fundamental rights.

Sensitive personal information is subject to narrower exceptions under Section 13.

Even when a lawful basis exists, the processing must still comply with the principles of:

Transparency: The person should generally know what information is being processed, by whom and for what purpose.
Legitimate purpose: The purpose must not be contrary to law, morals or public policy.
Proportionality: The information disclosed must be relevant and not excessive for the stated purpose.

For example, warning others about a genuine safety concern does not necessarily justify posting a person’s home address, identification card, children’s details or unrelated medical information.

Information already visible to the public is not automatically free for every use. Section 17 of the NPC’s Guidelines on Consent states that placing personal data on a publicly accessible platform does not amount to blanket consent for processing it for any purpose. The new use must still have a lawful basis.

When the Data Privacy Act may not apply

The Data Privacy Act is not a universal law against gossip, criticism or unwanted attention. Its application can depend on the identity and role of the poster.

Among the important qualifications are:

An individual handling information solely in connection with personal, family or household affairs is excluded from the definition of a personal information controller. Whether a public or systematic online disclosure remains within that exclusion is fact-dependent.
Personal information processed for journalistic, artistic, literary or research purposes is outside specified parts of the Act’s coverage.
Certain information about government officers, government contractors and public benefits is excluded when it relates to official positions, functions, contracts or benefits.
Public authorities may process information when necessary to perform constitutional or statutory duties.
Privacy must be balanced with freedom of expression, access to information, public accountability and other protected interests.

These are not blanket permissions to harass, threaten, defame or disclose information excessively. Other civil or criminal laws may still apply.

The Supreme Court has also warned that privacy in social media depends partly on the user’s actual privacy settings and conduct. In Vivares v. St. Theresa’s College, the Court recognized informational privacy online but held that a writ of habeas data requires more than an allegation of unauthorized access. The claimant must establish an actionable expectation of privacy and the required connection to life, liberty or security.

Match the remedy to what happened

Situation	Possible legal route
A company, employer, school, hospital, government office or other data controller disclosed your information without lawful authority	Data-subject request and NPC complaint under the Data Privacy Act
Personal data was collected for one purpose and posted publicly for another	Data Privacy Act complaint; possible civil or criminal liability depending on the facts
An intimate or private-area photo or video was recorded or distributed	Anti-Photo and Video Voyeurism Act
The post is sexual, gender-based, threatening, stalking-related or intended to humiliate through unauthorized photos, recordings or information	Safe Spaces Act; report to the PNP Anti-Cybercrime Group
Someone used your identity or identifying information without right	Computer-related identity theft under the Cybercrime Prevention Act
The post falsely and maliciously imputes a crime, vice, defect or discreditable act	Possible cyberlibel and civil defamation remedies
A husband, former husband, boyfriend or former dating partner uses posting to cause a woman or her child mental anguish, public ridicule or humiliation	Possible remedies under the Anti-Violence Against Women and Their Children Act
Sexual material involving a child is created, possessed, shared or offered online	Immediate reporting under the Anti-OSAEC and Anti-CSAEM Act
Unlawful data gathering or publication threatens life, liberty or security	Possible petition for a writ of habeas data
The disclosure invades privacy or causes injury even if no specific crime fits	Civil action for prevention, injunction and damages

The same incident may involve more than one law, but each offense has elements that must be proved. A hurtful or embarrassing post is not automatically cyberlibel, a Data Privacy Act offense or online sexual harassment.

Immediate steps to take

1. Preserve the evidence before it disappears

Record enough information to prove what was posted, who appeared to post it and how it circulated:

Full screenshots showing the post, account name, date, time and surrounding context
The exact post URL and the poster’s profile URL
Screen recordings showing how the post is reached
Copies of photographs, messages, captions, comments and threats
Visible reactions, shares or reposts
Dates when you discovered the post and when other people saw it
Messages showing where the poster obtained the information
Platform-report confirmation numbers and takedown correspondence
Proof of resulting harm, such as fraudulent transactions, unwanted calls, workplace action, medical records or counseling expenses

Keep original files unchanged and make secure backup copies. Do not crop every screenshot so tightly that the account, URL or context becomes unrecognizable. An independent witness who personally saw the content may execute an affidavit if formal proceedings become necessary.

For intimate content, avoid creating unnecessary copies or forwarding it to friends. If a child is involved, do not redistribute the material in an attempt to collect evidence; report it promptly and follow law-enforcement instructions.

2. Reduce the immediate risk

If addresses, account details or identification documents were exposed:

Change affected passwords and enable multi-factor authentication.
End active sessions on compromised accounts.
Notify the bank, e-wallet, telecommunications provider or issuing agency if fraud is possible.
Tighten privacy settings and remove location information from current posts.
Warn household members, school personnel or workplace security if there is a credible stalking or safety risk.

Do not publicly repost the offending material to “expose” the poster. That can increase the harm, compromise evidence and potentially create liability for further disclosure.

3. Report the content to the platform and host

Use the platform’s reporting category that most closely matches the problem—privacy violation, doxxing, impersonation, harassment, intimate imagery or child sexual exploitation.

Ask for:

Removal of the original post and duplicate uploads
Suspension of the responsible account where appropriate
Preservation of relevant account and access records for lawful investigation
Removal of cached previews or search results, if available

A platform report can be faster than a formal case, but it does not determine legal liability. Search-result removal also does not necessarily delete the source page.

4. Send a focused written demand

Unless contacting the poster would endanger you, send a written notice to the poster and, where applicable, the organization’s data protection officer or privacy contact. State:

The exact URLs or files involved
The information belonging to you
Why the processing appears unauthorized, excessive, inaccurate or harmful
Whether you ever consented and, if so, the limited purpose of that consent
The action you want: removal, blocking, correction, cessation of sharing, notice to recipients, or identification of the source and recipients
A request to preserve relevant logs and records
The date by which you expect a response

Keep proof that the notice was received. Do not threaten unlawful retaliation or demand money in exchange for silence.

Exercising your rights under the Data Privacy Act

If the person or organization is acting as a personal information controller, Section 16 of the Act may allow you to:

Ask whether and how your information is being processed
Request access to the information, its source and its recipients
Correct inaccurate or incomplete data
Object to processing in appropriate cases
Withdraw consent where consent is the basis of processing
Seek blocking, removal or destruction upon substantial proof that the information is incomplete, outdated, false, unlawfully obtained, used for an unauthorized purpose or no longer necessary
Seek indemnity for damage caused by inaccurate, unlawfully obtained or unauthorized use of personal information

These rights are not absolute. A controller may have a lawful obligation to retain records, may need information for a legal claim, or may rely on another legally sufficient ground.

Filing a complaint with the National Privacy Commission

Under the NPC’s current complaint procedure, you generally must first give the respondent a written opportunity to address the violation. If the respondent takes no timely or appropriate action, or does not respond within 15 calendar days after receiving your written notice, you may proceed with the complaint.

The NPC may waive this exhaustion requirement for good cause or a serious violation, including circumstances involving grave and irreparable harm, the absence of an adequate remedy, or action that is patently illegal. Explain and prove the urgency rather than simply skipping the written notice.

A formal complaint should be:

In writing and signed
Verified or made using the NPC’s complaint-assisted form
Notarized
Specific about the parties, acts, affected information and relief requested
Supported by correspondence, documents, affidavits and other evidence

The NPC’s filing page currently allows submission in person, by courier, or by scanning and emailing the complaint to complaints@privacy.gov.ph. Check that page and the linked schedule of fees before filing because administrative requirements and charges can change.

A parent representing a minor may attach the child’s birth certificate as proof of relationship. A court-appointed guardian should attach the guardianship order. The 2024 amendments to the NPC Rules also prescribe authentication requirements for non-resident Filipino complainants without a Philippine representative.

If a complaint is upheld, the NPC may award indemnity, impose administrative fines, order compliance, prohibit processing, or recommend criminal prosecution to the Department of Justice. Administrative fines are separate from damages payable to the victim. Under NPC Circular No. 2022-01, fines for major or grave infractions may be calculated as a percentage of annual gross income, subject to a ₱5 million cap for a single act resulting in one or multiple infractions.

The current rules do not reproduce the former six-month/30-day complaint cutoff found in the repealed 2016 procedure. Nevertheless, file promptly. Separate criminal and civil prescriptive periods still apply.

When criminal remedies may apply

Unauthorized processing or disclosure

The Data Privacy Act creates several distinct crimes. For example, unauthorized processing of ordinary personal information is punishable by one to three years’ imprisonment and a fine of ₱500,000 to ₱2 million. For sensitive personal information, the statutory range is three to six years and ₱500,000 to ₱4 million. Different penalties apply to processing for unauthorized purposes, malicious disclosure, unauthorized disclosure and a series of violations.

These penalties are not triggered merely because the complainant says “I did not consent.” Prosecutors must prove all elements, including the absence of consent and any other authority under the Act or existing law.

Intimate images

Under the Anti-Photo and Video Voyeurism Act, it is unlawful in covered circumstances to record a sexual act or private area without consent and reasonable expectation of privacy. It is also unlawful to copy, distribute, publish, broadcast or exhibit the covered recording without the required written consent—even if the person consented to the original recording.

The statutory penalty is three to seven years’ imprisonment, a fine of ₱100,000 to ₱500,000, or both.

Gender-based online sexual harassment

The Safe Spaces Act covers specified online conduct that causes or is likely to cause mental, emotional or psychological distress or fear for safety. It includes sexual or gender-based threats and remarks, cyberstalking, impersonation, and certain unauthorized recordings or sharing of photos, videos or information.

The PNP Anti-Cybercrime Group is the primary body designated to receive these complaints. The statutory penalty for gender-based online sexual harassment is prision correccional in its medium period, a fine of ₱100,000 to ₱500,000, or both. A higher penalty may apply in the qualifying circumstances listed in the Act.

Identity theft, hacking and cyberlibel

The Cybercrime Prevention Act may apply when someone hacks an account, unlawfully accesses a system, or intentionally acquires, uses, transfers, possesses, alters or deletes another person’s identifying information without right.

Cyberlibel is narrower than “a harmful online post.” It requires the elements of libel, including a public and malicious defamatory imputation referring to an identifiable person. Truth, privileged communication, good faith and public-interest considerations can materially affect the case.

The Supreme Court’s April 2026 resolution in Causing v. People confirms that cyberlibel prescribes in one year from discovery by the offended party, the authorities or their agents, subject to the legal rules on interruption and computation. Seek advice immediately if cyberlibel may be involved.

Violence involving a partner or former partner

If the victim is a woman and the poster is a spouse, former spouse, person with whom she has or had a dating or sexual relationship, or the father of her child, the conduct may fall under the Anti-Violence Against Women and Their Children Act when the required elements are present. The law includes conduct causing mental or emotional anguish, public ridicule or humiliation. Protection orders and criminal remedies may be available.

Sexual material involving children

Any sexual image or exploitation involving a child requires immediate handling under the Anti-OSAEC and Anti-CSAEM Act. Report it to law enforcement or through MAKABATA Helpline 1383, whose referral role is confirmed by Executive Order No. 79. Do not download, forward or publicly repost the material.

For cybercrime assistance, you may also use the NBI online complaint facility or contact the NBI Cybercrime Division. The DOJ maintains an official page for reporting cybercrime incidents.

Civil action for prevention, injunction or damages

Articles 19, 20, 21 and 26 of the Civil Code may support a civil action when an online disclosure abuses a right, violates law, is contrary to morals or public policy, or improperly meddles with private life and causes injury. Depending on the evidence and procedural requirements, a court may award damages or grant preventive relief.

Civil claims have different prescriptive periods. The Civil Code generally provides four years for injury to rights or quasi-delict, but only one year for defamation. The correct characterization and starting date can be contested, so do not assume that a demand letter indefinitely preserves a claim.

A lawyer should also determine whether pre-filing barangay conciliation, venue rules or an application for a temporary restraining order applies.

The writ of habeas data is an exceptional remedy

A writ of habeas data is not an automatic takedown procedure for every unauthorized post. Under the Supreme Court’s Rule on the Writ of Habeas Data, the unlawful gathering, collection or storage of information must violate or threaten privacy in relation to life, liberty or security.

When that threshold is met, the petition may seek updating, rectification, suppression or destruction of the relevant data or files. It may generally be filed in the proper Regional Trial Court, with higher courts available in specified cases involving government public-data files.

If a criminal action has already commenced, a separate habeas data petition may no longer be filed; the relief must be requested by motion in the criminal case. Because the remedy is technical and evidence-intensive, obtain counsel urgently.

Common mistakes to avoid

Assuming that “without consent” automatically proves a Data Privacy Act violation
Reporting the post before saving its full URL, context and account details
Sending only cropped screenshots that cannot be authenticated
Publicly reposting intimate, identifying or child-related material
Filing with the NPC without first giving written notice, when no waiver is justified
Naming only the platform while ignoring the person or organization that decided to publish the data
Treating an NPC administrative complaint as a substitute for an urgent police report
Calling every false or offensive statement cyberlibel without checking its legal elements
Waiting for online content to “go viral” before acting
Confronting a stalker, extortionist or violent partner when doing so may increase danger
Assuming deletion ends the case without preserving proof of earlier publication and harm

When help is urgent

Contact law enforcement immediately if the publication includes:

A credible threat of violence
Your live location, home address or children’s location
Stalking or coordinated harassment
Intimate images or threats to release them
Extortion or demands for money, sex or another benefit
Hacked accounts or exposed banking credentials
Government IDs that can be used for identity fraud
Sexual content involving a child
Conduct by a violent spouse, partner or former partner
A serious threat to life, liberty or security

If safe, bring your device, printed screenshots, URLs, identification and a chronological account. Preserve threatening messages and do not negotiate with an extortionist without law-enforcement or legal guidance.

Those who cannot afford private counsel may inquire with the Public Attorney’s Office, subject to its eligibility and merit requirements, or with an Integrated Bar of the Philippines legal-aid office.

Frequently asked questions

Can I demand deletion simply because the post is about me?

You may demand deletion, but enforceability depends on the facts. Under the Data Privacy Act, blocking or removal generally requires substantial proof of circumstances such as unlawful acquisition, unauthorized use, falsity, obsolescence or lack of continuing necessity. Freedom of expression, legal duties and other lawful bases may affect the result.

What if I originally posted the information myself?

Public posting does not give everyone blanket consent to reuse the information for any purpose. However, your privacy settings, audience choice and prior conduct can affect your reasonable expectation of privacy and the balancing of rights.

What if the information is true?

Truth does not automatically make every privacy-invasive disclosure lawful. The Data Privacy Act still requires a lawful basis and proportional processing where it applies. Truth is highly relevant to defamation, but a true post may still create liability under privacy, harassment, intimate-image or other laws.

What if I consented to taking the photo but not to posting it?

That distinction can be decisive. Consent must be specific to the processing purpose. For sexual or private-area recordings covered by Republic Act No. 9995, consent to record does not by itself authorize copying, distribution or online publication; the law requires written consent for those acts.

Can I complain about an anonymous account?

Yes, but identification and service may be difficult. Preserve the account URL, username, unique identifiers, messages and linked accounts. Platforms ordinarily disclose subscriber or access information only through a lawful process. The NPC may dismiss a formal complaint if the parties cannot be identified or traced despite diligent effort, although the Commission may initiate its own investigation in appropriate cases.

Must I wait 15 days before going to the police?

No. The 15-calendar-day requirement concerns exhaustion before an ordinary NPC complaint. It does not prevent immediate police, NBI, platform or emergency reporting. The NPC may also waive exhaustion when properly justified by serious and urgent circumstances.

Does removing the post erase liability?

Not necessarily. Removal may reduce ongoing harm and can be considered as mitigation, but it does not erase the original act, circulation or proven damage. Keep your evidence even after takedown.

Can one incident produce several cases?

Possibly. One disclosure may support an NPC complaint, a civil action and a criminal complaint under different laws. That does not mean every remedy will succeed; each has separate elements, procedures, evidence and deadlines.

Official sources

This article provides general legal information, not advice for a specific case. Legal outcomes depend on the exact post, source of the information, parties, evidence, purpose, privacy settings and applicable deadlines. Consult a Philippine lawyer for advice on particular facts. Sources checked as of 3 August 2026.