Quick answer
If someone posts your personal information, photos, private messages, address, identification details, health information, or other identifying data online without your consent, Philippine law may give you several remedies. Depending on the facts, you may demand removal or blocking of the data, file a complaint with the National Privacy Commission (NPC), seek damages and preventive relief in court, and—when the elements of a criminal offense are present—pursue criminal charges.
But lack of consent does not automatically make every online post illegal. Under the Data Privacy Act of 2012 (DPA), consent is only one possible lawful basis for processing ordinary personal information. Processing may also be lawful when necessary for a contract, legal obligation, vital interests, public authority, or a legitimate interest that is not overridden by the data subject's fundamental rights. Sensitive personal information is subject to stricter rules. The DPA also contains special rules or exclusions for matters such as journalistic, artistic, literary, research, public-authority, and certain government-related information. (Lawphil)
At the same time, information does not lose all privacy protection merely because it appears online or because a person was photographed in a public place. The NPC has advised that data-privacy rights do not simply cease in public spaces and that secretly or candidly taking a person's photograph and later posting it online may amount to unauthorized processing, depending on the circumstances. Current NPC guidance also confirms, in the context of data scraping, that publicly available personal data remains protected and that public availability is not by itself consent to processing for purposes beyond those reasonably contemplated.
The safest practical approach is to preserve the evidence first, send a written demand for removal or appropriate action, report the material to the platform, and determine promptly whether an NPC complaint, civil action, or criminal complaint is appropriate.
What counts as personal information?
The DPA defines personal information broadly. It includes information from which a person's identity is apparent, can reasonably and directly be ascertained, or can be determined when the information is combined with other information. Processing is also broadly defined and includes collection, recording, storage, use, consultation, consolidation, blocking, erasure, and destruction. Online publication or disclosure can therefore involve processing of personal data. (Lawphil)
Examples may include a person's full name together with identifying details, home address, telephone number, personal email address, photographs, account information, employment details, private correspondence, location information, or combinations of facts that identify the person.
The DPA gives greater protection to sensitive personal information, including information concerning race or ethnic origin, marital status, age, religious, philosophical or political affiliations, health, education, genetic or sexual life, criminal proceedings, and certain information issued by government agencies that is peculiar to an individual, such as government identification information and tax records. (Lawphil)
The category matters because the legal grounds for processing sensitive personal information are considerably narrower than those for ordinary personal information.
When posting without consent may violate the Data Privacy Act
For ordinary personal information, Section 12 of the DPA requires at least one lawful criterion for processing. Consent is one criterion, but it is not the only one. A person or organization may instead rely, where genuinely applicable, on contractual necessity, legal obligation, protection of vital interests, public-authority functions, or legitimate interests that are not overridden by the constitutional rights and freedoms of the data subject. Processing must also comply with the principles of transparency, legitimate purpose, proportionality, fairness, lawfulness, accuracy, and appropriate retention. (Lawphil)
Sensitive and privileged information is governed by Section 13. As a general rule, its processing is prohibited unless one of the statutory exceptions applies—for example, specific consent, authorization by law, protection of life and health under specified circumstances, medical treatment, or processing necessary for the establishment, exercise, or defense of legal claims or when provided to government or public authority. (Lawphil)
This is why the question is not simply, "Did I consent?" The better questions are: What information was posted? Who obtained it? Why was it obtained? Why was it published? Was publication necessary for that purpose? Was there another lawful basis? Was more information disclosed than reasonably necessary? Was the information sensitive? Was it disclosed to harass, humiliate, threaten, identify, profile, or expose the person to danger?
A truthful post is not automatically immune from privacy law. Privacy and defamation protect different interests. Conversely, information that concerns a matter of legitimate public interest, lawful reporting, a public function, legal proceedings, or another recognized lawful purpose may receive different treatment from information published merely to embarrass or harass someone.
Publicly available information is not automatically free for unlimited reuse
One common mistake is to assume that anything found on Facebook, LinkedIn, a government website, or another public page can be copied, combined, republished, and used for any purpose.
The NPC's 2026 guidelines on data scraping expressly state that DPA protections continue to apply to publicly available personal data. For entities covered by those scraping guidelines, public availability does not itself constitute consent to processing for purposes beyond those reasonably contemplated when the information was provided. The same advisory identifies malicious public disclosure of scraped personal data intended to harass or intimidate—doxxing—as a harmful use that regulated personal information controllers must avoid. These particular provisions address data scraping and should not be treated as creating a separate, universal "doxxing crime," but they illustrate the continuing importance of purpose, proportionality, and lawful basis even for data found online.
The NPC likewise states that publicly available online personal data may still be the subject of an erasure request. Where appropriate, the personal information controller should communicate with other controllers, including third-party indexes, to request deletion of copies or removal or de-listing of relevant search results and links. (National Privacy Commission)
Your right to demand blocking, removal, or erasure
Section 16 of the DPA gives a data subject the right, upon the required factual basis, to suspend, withdraw, block, remove, or destroy personal information that is incomplete, outdated, false, unlawfully obtained, used for unauthorized purposes, or no longer necessary for the purpose for which it was collected. It also recognizes a right to indemnification for damage caused by inaccurate, incomplete, outdated, false, unlawfully obtained, or unauthorized use of personal information. (Lawphil)
The NPC's current guidance additionally recognizes erasure or blocking where private information is prejudicial to the data subject, subject to qualifications for freedom of speech, expression or the press and other lawful authorization; where the data subject objects and there is no other applicable lawful basis; where the processing is unlawful; or where the controller or processor violated the data subject's rights. (National Privacy Commission)
The right to erasure is not absolute. A request may be denied where continued processing remains necessary for a lawful purpose, legal obligation, legal claim, legitimate business retention, overriding public interest, protected speech or press activity, or another basis provided by law. Whether the person concerned is a public figure and whether further processing could reasonably have been expected are among the considerations identified by the NPC. (National Privacy Commission)
Practical steps to take
Preserve the evidence before asking anyone to delete it. Save screenshots showing the entire post, username or account name, date and time if displayed, caption, comments, reactions, shares, and surrounding context. Record the exact URL or post identifier. Preserve private messages, emails, original photographs, notifications, and evidence showing where the poster obtained the information. If the material is changing rapidly, document later versions as well. Avoid unnecessarily downloading or circulating leaked databases, intimate material, or other sensitive files merely to create more copies.
Identify exactly what information was disclosed and the harm it creates. Distinguish ordinary personal information from sensitive personal information. Note whether the post reveals a home address, government ID, medical condition, sexual information, private conversation, account credentials, real-time location, information about children, or other data capable of creating physical, financial, reputational, or identity-fraud risks.
Send a written demand to the person or organization responsible. Identify the particular post or data, explain the claimed privacy violation, and state the action requested—for example, deletion, blocking, cessation of further disclosure, correction, or confirmation that recipients have been asked to remove copies. Keep proof that the demand was received. This step is especially important because NPC procedure ordinarily requires prior written notice to the respondent.
Use the platform's reporting and privacy mechanisms at the same time. A Facebook, Instagram, TikTok, X, Google, forum, hosting-service, or other platform report is not a substitute for legal remedies, but it can sometimes stop continuing dissemination sooner. Preserve the platform's acknowledgment, ticket number, decision, and any appeal.
Secure exposed accounts and credentials immediately. If the disclosure includes passwords, recovery information, financial information, government identifiers, or data useful for account takeover, change credentials, activate multi-factor authentication, revoke active sessions where appropriate, and notify affected institutions. Treat this as a security incident, not merely a reputational dispute.
Consider an NPC complaint if the matter falls under the DPA. Gather the written demand and proof of receipt, the offending material, witness affidavits where appropriate, evidence of the source and purpose of the disclosure, and proof of injury or continuing risk.
Get urgent legal or law-enforcement assistance where the post creates immediate danger. Do not wait for an ordinary takedown process if the publication involves threats, stalking, extortion, sexual material, a child's sexual content, live location information, hacked accounts, identity fraud, or disclosure that creates a credible risk to personal safety.
The 15-day rule before an NPC complaint
Under the NPC's 2021 Rules of Procedure, as amended, a complaint ordinarily will not be given due course unless the complainant has first informed the personal information controller, processor, or concerned entity in writing of the claimed privacy violation or personal data breach and allowed an opportunity for appropriate action. The requirement is satisfied for escalation when the respondent does not take timely or appropriate action or gives no response within 15 calendar days from receipt of the written notice. Proof of compliance should be attached to the complaint.
There are important exceptions. The NPC may waive the exhaustion requirement for good cause shown or for a serious DPA violation or breach considering the risk of harm, including situations involving grave and irreparable damage that only NPC action can prevent or mitigate, lack of a plain, speedy or adequate remedy from the respondent, or patently illegal action. The waiver is discretionary, so a complainant relying on it should clearly plead and prove the circumstances justifying immediate NPC intervention.
How to file with the National Privacy Commission
The NPC presently instructs complainants to submit either a filled-out and notarized Complaint-Assisted Form or a verified complaint, together with supporting evidence and witness affidavits. Filing may be made personally, by registered mail, by courier, or by electronic mail when authorized by the Commission. The current NPC page states that the Complaints and Investigation Division has 30 calendar days from receipt of the complaint to give it due course or dismiss it without prejudice. (National Privacy Commission)
The amended NPC Rules require the complaint to identify the complainant and respondent, narrate the material facts, state the relief sought, attach relevant correspondence and supporting documentary or testimonial evidence, and include the required certification against forum shopping. Deficiencies in form, contents, or evidence can result in dismissal, so a serious case should be prepared carefully rather than submitted as a bare allegation.
If the unlawful processing is continuing and ordinary adjudication would not adequately protect the data subject, a complainant may apply for a temporary ban on processing personal data when filing the complaint or before the NPC decision becomes final and executory. The rules require, among other things, facts establishing entitlement to the relief, a bond unless exempted, and a summary hearing. The investigating officer must decide the application within 30 calendar days after conclusion of the summary hearing. If granted, the temporary ban generally remains effective until final resolution of the main case or further lawful order.
After adjudication, NPC enforcement orders may include indemnity determined according to Civil Code principles, a permanent ban on processing, an order compelling appropriate action, administrative fines, and—where warranted—a recommendation to the Department of Justice for prosecution under the penal provisions of the DPA.
Civil remedies for invasion of privacy
A privacy dispute does not have to fit a criminal offense before civil relief becomes possible.
Articles 19, 20 and 21 of the Civil Code establish duties to exercise rights with justice, honesty and good faith and recognize liability for damage caused unlawfully or through willful conduct contrary to morals, good customs or public policy. Article 26 expressly requires respect for another person's dignity, personality, privacy and peace of mind and provides a cause of action for damages, prevention, and other relief for specified and similar invasions of private life—even where the conduct does not constitute a crime. (Lawphil)
Depending on the facts, a person suffering continuing online disclosure may therefore consider a civil action for damages and appropriate preventive or injunctive relief. The viability of an injunction or temporary restraining order depends on the applicable procedural requirements, the precise right being protected, the immediacy of the threatened injury, and constitutional considerations such as freedom of expression. Courts do not automatically order prior restraint merely because a publication is offensive or unwanted.
Prescription also matters. The Civil Code generally requires an action based on injury to the plaintiff's rights or quasi-delict to be filed within four years, while an action for defamation has a separate one-year period. The correct prescriptive period depends on the precise cause of action pleaded and other applicable law, so a victim should not assume that every online privacy case has four years to file. (Lawphil)
When criminal liability may arise
The DPA itself contains criminal offenses, including unauthorized processing and processing for unauthorized purposes. For example, Section 25 punishes unauthorized processing of ordinary personal information by imprisonment of one to three years and a fine of ₱500,000 to ₱2 million; unauthorized processing of sensitive personal information carries three to six years and ₱500,000 to ₱4 million. Section 28 separately penalizes processing for unauthorized purposes. Other DPA offenses, including malicious or unauthorized disclosure, have their own elements and may apply particularly to personal information controllers, processors, their officers, employees, or agents. (Lawphil)
These provisions should not be mechanically applied to every social-media dispute. Criminal liability depends on the specific statutory elements, the identity and role of the accused, the nature and source of the information, the purpose of the processing, and whether another lawful authorization existed. NPC Advisory Opinion No. 2021-014 itself describes unauthorized posting of a photograph as something that may constitute unauthorized processing depending on the circumstances rather than treating every non-consensual photograph as an automatic DPA crime.
Several other statutes can become more important than the general DPA depending on what was posted.
| Situation | Possible law | Important qualification |
|---|---|---|
| Sexual activity or images of private areas are recorded, copied, distributed, published, or broadcast | RA 9995, Anti-Photo and Video Voyeurism Act | The statute covers specified sexual or intimate images under its statutory conditions. Its prohibitions on copying, distribution and publication can apply even when the person originally consented to the taking or recording. A violation carries three to seven years' imprisonment and a ₱100,000 to ₱500,000 fine, or both. (Lawphil) |
| Unauthorized online sharing forms part of gender-based online sexual harassment | RA 11313, Safe Spaces Act | Section 12 includes, in the context of gender-based online sexual harassment, unauthorized sharing of sexual media and unauthorized recording or sharing of a victim's photos, videos or information online, among other conduct. The PNP Anti-Cybercrime Group is designated to receive such complaints. (Lawphil) |
| Identifying data is acquired, used, misused, transferred, possessed, altered, or deleted without right for identity misuse | RA 10175, Cybercrime Prevention Act | Computer-related identity theft requires more than simply mentioning another person online; the statutory elements involving identifying information and absence of right must be established. (Lawphil) |
| The publication contains defamatory imputations online | Cyber libel under RA 10175 in relation to the Revised Penal Code | Privacy and defamation are distinct. A truthful but unlawfully exposed private fact raises different issues from a false and defamatory accusation. Cyber libel requires its own elements and defenses. (Lawphil) |
Where sexual content involving a child is involved, special child-protection and online sexual-abuse laws may impose substantially different duties and criminal consequences. Avoid forwarding or publicly reposting the material as "proof." Preserve evidence in a manner directed by counsel or law enforcement and seek assistance immediately.
What if the person photographed you in public?
Being in a public place does not automatically eliminate all data-privacy interests. In its 2021 advisory concerning a photograph taken in a restaurant and subsequently posted on social media, the NPC stated that a person's data-privacy rights do not cease merely because the person is in a public space. It further explained that candid or secret photography followed by online posting may amount to unauthorized processing depending on the circumstances.
That does not mean every street photograph, news photograph, event photograph, or incidental background appearance is unlawful. The purpose of the photograph, context, reasonable expectations, nature of the information, applicable lawful basis, journalistic or artistic considerations, public interest, proportionality, and manner of publication can materially change the result.
What if the information concerns a public official or public figure?
Privacy rights do not disappear merely because a person is prominent, but the balance can change. The DPA itself contains special provisions concerning information connected with government officers and employees in their official functions and information processed for journalistic purposes, among other matters. NPC guidance on erasure also recognizes overriding public interest, freedom of speech, expression and the press, and public-figure status as relevant considerations in determining whether removal may properly be refused. (Lawphil)
A demand to erase evidence of official conduct, a matter properly forming part of public records, or legitimate reporting on an issue of public concern is therefore very different from publishing a public official's private medical record, unrelated family information, account credentials, or home-security details merely to expose or endanger the person. Context and proportionality remain critical.
Evidence worth preserving
For a serious complaint, preserve enough evidence to establish what was posted, who apparently posted it, when and where it appeared, how widely it spread, why you say the processing was unauthorized, and what harm or risk resulted. Original digital files are preferable to repeatedly edited screenshots. Keep URLs, usernames, timestamps, correspondence with the respondent and platform, proof of delivery of your written demand, witness information, and records demonstrating consequences such as fraudulent transactions, threats, employment consequences, medical treatment, security expenses, or other provable damage.
Do not publicly repost the offending material simply to complain about it. Doing so may increase the harm, expose other people's data, complicate a takedown request, or create an argument that you yourself contributed to further dissemination.
Common mistakes to avoid
Do not assume that "I did not consent" ends the legal analysis; first determine whether another lawful ground or statutory exception applies. Do not delete your only evidence before documenting the post. Do not wait until the account disappears before recording URLs, usernames and identifying details. Do not rely solely on a platform report when formal legal remedies may be necessary. Do not file an NPC complaint without preserving proof of the required written notice unless you have a properly supported basis to seek waiver of exhaustion. And do not label every privacy dispute "cyber libel": privacy, unauthorized processing, identity theft, voyeurism, harassment and defamation have different elements.
Another serious mistake is responding by publishing the alleged offender's address, telephone number, identification documents, family details, or private communications. A victim can create a second privacy dispute by retaliating in the same manner.
When legal help is urgent
Immediate professional or law-enforcement assistance is particularly important where publication reveals a home address or real-time location while threats or stalking are occurring; exposes passwords, financial information or identification documents capable of enabling fraud; involves intimate or sexual material; concerns sexual material involving a minor; follows hacking or unauthorized access; accompanies extortion or blackmail; or is spreading rapidly in circumstances where continuing dissemination could cause grave and irreparable injury.
In an appropriate DPA case, urgency can also be legally relevant because the NPC's amended rules allow waiver of the usual exhaustion requirement in serious cases and permit an application for a temporary ban on processing.
FAQ
Is it automatically illegal to post someone's photo without permission?
No. The legal result depends on the circumstances. Consent may be necessary in some situations, but the DPA recognizes other lawful bases for processing, and statutory exceptions or constitutional interests may apply. On the other hand, the NPC has expressly recognized that candid or secret photography followed by online posting may amount to unauthorized processing depending on the facts. (Lawphil)
What if I originally posted the information publicly myself?
That does not necessarily authorize every later use. Current NPC guidance for data scraping states that publicly available personal information remains protected and that public availability does not itself constitute consent to processing beyond purposes reasonably contemplated when the information was made available. Separately, the NPC confirms that publicly available online information may be the subject of an erasure request, subject to applicable lawful grounds for continued processing.
Can I demand that the post be deleted immediately?
You can make the demand immediately. Whether you have an enforceable right to deletion depends on the legal basis for processing and the surrounding facts. The DPA and NPC guidance recognize erasure or blocking in specified circumstances but also recognize lawful reasons for continued retention or publication. (National Privacy Commission)
Do I always have to wait 15 days before filing with the NPC?
Ordinarily, you must first give written notice to the respondent and show that no timely or appropriate action was taken or that there was no response within 15 calendar days from receipt. The NPC may waive this requirement for good cause or specified serious situations, including grave and irreparable harm.
Can the NPC award damages?
The DPA recognizes a data subject's right to indemnification, and the amended NPC Rules permit a Commission decision to include an award of indemnity, with the amount determined according to Civil Code principles. (Lawphil)
Can I sue separately in court?
Potentially, yes. Article 26 of the Civil Code expressly recognizes a cause of action for damages, prevention and other relief for certain and similar invasions of dignity, personality, privacy and peace of mind. Articles 19 to 21 may also be relevant depending on the wrongful conduct and resulting damage. (Lawphil)
What if an intimate photograph was taken with my consent but later posted without permission?
Consent to taking an intimate photograph does not necessarily mean consent to publishing it. Where the material falls within RA 9995, the statutory prohibitions on copying, distribution and publication apply notwithstanding that consent to take or record the image was originally given. (Lawphil)
What if the post is false as well as private?
Additional remedies may arise. False defamatory statements published through a computer system may implicate cyber libel if all statutory elements are established, while false personal data may independently support correction, erasure, blocking or other privacy remedies. The appropriate causes of action should be assessed separately rather than assuming that one automatically proves the other. (Lawphil)
Official sources
Data Privacy Act of 2012 (RA 10173) — Lawphil
NPC — Right to Erasure or Blocking
2021 NPC Rules of Procedure, as amended
NPC Advisory Opinion No. 2021-014 — Posting of Photo in a Social Media Platform Without Consent
NPC Advisory No. 2026-01 — Guidelines on Data Scraping of Publicly Available Personal Data
Civil Code of the Philippines (RA 386) — Lawphil
Anti-Photo and Video Voyeurism Act of 2009 (RA 9995) — Lawphil
Safe Spaces Act (RA 11313) — Lawphil
Cybercrime Prevention Act of 2012 (RA 10175) — Lawphil
General-information disclaimer
This article provides general Philippine legal information, not legal advice for a particular dispute. Liability and the proper remedy depend on the exact information disclosed, how it was obtained, the identity and role of the person or organization processing it, the purpose and audience of the publication, applicable lawful bases or exceptions, available evidence, and any subsequent legal developments. Law and official procedures checked as of August 23, 2026.