Quick answer

If someone posts your personal information online without your consent in the Philippines, you may have several remedies: demand that the information be removed or blocked, object to further processing, report the material to the platform, file a complaint with the National Privacy Commission (NPC), seek damages or preventive relief in court, and—if the statutory elements are present—pursue criminal remedies.

But lack of consent does not automatically make every online post illegal. Under the Data Privacy Act of 2012 (Republic Act No. 10173), consent is only one possible lawful basis for processing ordinary personal information. Other legal bases may apply, and the Act also contains exclusions and exceptions. Sensitive personal information is subject to stricter rules. The legality of a particular post therefore depends on what information was disclosed, who disclosed it, why and how it was disclosed, whether another lawful basis exists, and whether an exemption or another law applies. (National Privacy Commission)

Where the Data Privacy Act applies, processing must still comply with the principles of transparency, legitimate purpose, and proportionality. Personal data should be processed fairly and lawfully, should be relevant to the declared purpose, and should not be excessive in relation to that purpose. (National Privacy Commission)

Posting information online can be “processing” of personal data

The Data Privacy Act defines processing broadly. It includes operations performed on personal information such as collection, recording, organization, storage, alteration, retrieval, consultation, use, consolidation, blocking, erasure, destruction, and disclosure. Posting or disseminating identifiable information online can therefore constitute processing for purposes of the law. (National Privacy Commission)

“Personal information” generally concerns information from which an individual can be identified, either directly or when combined with other information. The Act gives additional protection to sensitive personal information, which includes specified information relating to matters such as a person's health, education, genetic or sexual life, government-issued identifiers, and certain information concerning legal proceedings, as well as specified personal attributes. (National Privacy Commission)

Examples of online disclosures that may raise serious privacy issues include:

posting a person's home address, telephone number, private email address, identification documents, account numbers, or other identifying details;
publishing private medical or employment records;
posting private conversations or screenshots containing personal information;
disclosing information about another person's family, finances, education, or legal affairs;
circulating copies of passports, driver's licenses, government IDs, signatures, or similar documents;
posting information obtained from a hacked, stolen, leaked, or improperly accessed database; and
reposting personal data originally disclosed for a limited purpose into a substantially different context.

The fact that information is available somewhere online does not necessarily mean that anyone may process or redistribute it for every purpose. Context, source, purpose, applicable exemptions, and the rights of the data subject remain important.

No consent does not always mean the post violates the Data Privacy Act

For ordinary personal information, Section 12 of the Data Privacy Act recognizes lawful bases other than consent. Depending on the circumstances, processing may be permitted because it is necessary to perform a contract, comply with a legal obligation, protect vitally important interests, respond to certain emergencies or public-authority functions, or pursue legitimate interests that are not overridden by the person's fundamental rights and freedoms. (National Privacy Commission)

The rules for sensitive personal information and privileged information are more restrictive. Section 13 generally prohibits their processing unless one of the statutory exceptions applies. (National Privacy Commission)

There are also situations in which the Data Privacy Act does not apply in the ordinary manner. Section 4 contains exclusions involving, among other matters, certain information relating to government officers and contractors in connection with their official functions and processing for journalistic, artistic, literary, or research purposes. The precise scope of an exclusion must be examined rather than assumed. (National Privacy Commission)

The Act's definition of a personal information controller also excludes an individual who processes personal information in connection with the individual's personal, family, or household affairs. That does not create an unlimited license to publish other people's information. NPC guidance has emphasized that taking information and sharing it with third parties may, depending on the purpose and circumstances, fall outside a purely personal or household activity. (National Privacy Commission)

Freedom of expression, freedom of the press, public interest, legal obligations, and the legitimate publication of information about public matters may also materially affect the analysis. A privacy claim should therefore not be evaluated solely by asking, “Did I consent?”

What to do immediately after discovering the post

1. Preserve the evidence before asking for deletion

Before the post disappears or is edited, preserve enough information to establish what was published and when.

Useful records may include:

screenshots showing the entire post rather than only the offending sentence;
the account name, username, page name, or profile that published it;
the complete page or post address;
the date and time you discovered the material;
photographs, files, videos, or documents attached to the post;
comments or replies showing further dissemination;
messages from people who received or saw the information;
notifications from the platform;
copies of any private message in which the poster admits obtaining or publishing the information;
correspondence requesting removal;
the platform's acknowledgment or report number; and
evidence of resulting harm, expenses, threats, fraud attempts, harassment, or misuse of the disclosed information.

Screenshots can be valuable evidence, but they are not automatically conclusive merely because they exist. Preserve surrounding context and original electronic material when possible because authenticity, completeness, and attribution may later become disputed.

2. Reduce any immediate security risk

If exposed information includes passwords, authentication codes, recovery information, financial details, government identification documents, or information that could be used for account takeover or impersonation, act on the security problem separately from the legal dispute.

For example, change compromised credentials, secure affected accounts, notify a relevant financial institution when appropriate, and monitor for unauthorized transactions or impersonation. Do not wait for the privacy complaint process to conclude before addressing an immediate security risk.

3. Use the platform's reporting and privacy tools

Report the material through the website or social-media platform's applicable privacy, impersonation, harassment, intimate-image, or personal-information reporting mechanism.

A platform report is not a substitute for an NPC complaint or court remedy, but it may produce a faster practical removal while formal remedies are being considered.

Preserve the report confirmation.

4. Send a written request to the person or organization responsible

Where practicable, send a clear written notice identifying:

the specific information at issue;
where it appears;
why you believe its processing or publication is unauthorized or unlawful;
whether you are objecting to continued processing;
whether you are requesting erasure, blocking, correction, de-indexing, or cessation of further disclosure;
any urgent risk created by continued publication; and
the action you want taken.

Keep proof that the request was sent and received.

This step is particularly important because the current NPC Rules of Procedure ordinarily require a complainant to have first informed the respondent in writing and given the respondent an opportunity to address the matter before a complaint is filed with the Commission.

Your right to object, correct, erase, or block data

Section 16 of the Data Privacy Act gives data subjects several rights, subject to applicable qualifications and exceptions. Among them are rights concerning access and correction and, upon substantial proof of the statutory grounds, the right to seek suspension, withdrawal, blocking, removal, or destruction of personal information. (National Privacy Commission)

The Data Privacy Act's Implementing Rules and Regulations further recognize rights to object to processing and to seek erasure or blocking in circumstances such as when data is incomplete, outdated, false, unlawfully obtained, used for an unauthorized purpose, no longer necessary, or unlawfully processed. Other grounds and exceptions may also apply. (National Privacy Commission)

The NPC explains that the right to erasure or blocking can extend to personal information made public online. Depending on the circumstances, measures may include communicating the erasure request to other controllers or requesting removal or de-listing from search indexes. The right is not absolute: legal claims, legal obligations, overriding public interests, freedom of speech or of the press, and other lawful grounds may justify continued processing. (National Privacy Commission)

How to file a complaint with the National Privacy Commission

Ordinarily, make a written demand first

Under the current NPC Rules of Procedure, a complainant normally must first inform the respondent in writing of the privacy or data-protection concern.

A complaint may generally proceed when the respondent:

has not taken timely or appropriate action on the matter; or
has not responded within 15 calendar days from receipt of the written notice.

The NPC may waive this exhaustion requirement for good cause or when circumstances indicate a serious violation of the Data Privacy Act. The rules expressly recognize situations involving grave and irreparable damage, the absence of another plain, speedy, and adequate remedy, and patently illegal acts as circumstances relevant to a waiver.

Accordingly, a person facing a rapidly spreading disclosure should not automatically assume that nothing can be done for 15 days. Whether the exhaustion requirement can be waived depends on the particular facts.

The complaint must satisfy formal requirements

The current NPC Rules require a complaint to be verified and to contain the required identifying information, material facts, supporting evidence, relief requested, relevant correspondence, and a certification against forum shopping. Witness affidavits and other supporting evidence should be submitted as applicable.

The NPC's complaint guidance states that a complainant may use the Commission's Complaint-Assisted Form or a verified complaint and submit supporting documents. Filing may be made through the authorized modes identified by the Commission, including personal filing, registered mail, courier, and authorized electronic filing. Requirements applicable to electronic documents must also be observed. (National Privacy Commission)

Filing fees apply under the NPC's rules, subject to exemptions and possible waiver in specified circumstances, including rules for indigent parties. Before filing, check the NPC's current fee schedule and submission instructions rather than relying on an old copy of the procedure.

Under the present rules, the investigating officer generally has 30 calendar days from receipt of the complaint to determine whether to give it due course or dismiss it without prejudice, subject to the rules governing the proceedings. This is not a promise that the entire case will be completed within 30 days.

What the NPC can order

After proceedings and a finding that relief is warranted, the Commission's remedies may include:

awarding indemnity in accordance with the Civil Code;
imposing a permanent ban on the processing of personal data;
imposing applicable administrative fines;
issuing compliance orders;
taking or directing other actions within its authority; and
recommending prosecution to the Department of Justice when the circumstances warrant it.

A Commission decision generally becomes final and executory after 15 calendar days from notice, unless a timely remedy authorized by the rules affects that period. The rules permit one motion for reconsideration and recognize appeal to the proper courts.

Can the NPC order urgent temporary relief?

The NPC Rules provide for an application for a temporary ban on processing personal data. It may be sought when filing the complaint or at the permitted stage before the Commission's decision becomes final.

This remedy is not an automatic emergency takedown simply because a motion is filed. The applicant must establish the grounds required by the rules. A summary hearing is contemplated, and a bond may be required unless an applicable exemption exists. The investigating officer is to resolve the application within the period specified in the rules after conclusion of the summary hearing.

A temporary ban can be particularly important when continued processing itself may cause substantial harm, but the suitability of the remedy depends on the case.

Civil remedies for invasion of privacy

The Data Privacy Act is not the only possible legal basis for relief.

The Civil Code requires every person, in the exercise of rights and performance of duties, to act with justice, give everyone his or her due, and observe honesty and good faith. Articles 20 and 21 provide bases for liability when a person causes damage contrary to law or willfully causes loss or injury in a manner contrary to morals, good customs, or public policy. (Judiciary eLibrary)

Article 26 separately provides that every person shall respect the dignity, personality, privacy, and peace of mind of others. The acts covered by Article 26 and similar intrusions can give rise to a cause of action for damages, prevention, and other relief. (Judiciary eLibrary)

Accordingly, a serious online privacy violation may potentially support a civil action even where the dispute cannot be reduced to a simple “no consent” theory under the Data Privacy Act.

Whether damages, injunctive relief, or another court remedy is actually available depends on the legal cause of action, the evidence, the identities of the defendants, the harm suffered, jurisdiction, procedural requirements, and possible constitutional or statutory defenses.

The writ of habeas data is available only in qualifying cases

The writ of habeas data is a special judicial remedy for particular violations or threats to the right to privacy.

Under the Supreme Court's Rule on the Writ of Habeas Data, the remedy is available when a person's right to privacy in life, liberty, or security is violated or threatened by an unlawful act or omission of a public official or employee, or of a private individual or entity engaged in gathering, collecting, or storing data or information regarding the person, family, home, and correspondence of the aggrieved party. (Judiciary eLibrary)

The Supreme Court has stressed that habeas data is not a general remedy for every privacy dispute. A petitioner must sufficiently establish the required connection between the alleged privacy violation and the protected rights to life, liberty, or security. (Judiciary eLibrary)

A routine embarrassing Facebook post, therefore, should not automatically be characterized as a habeas data case. The remedy becomes relevant only when its specific requirements are met.

Can posting personal information be a crime?

Possibly—but criminal liability should never be assumed merely from the absence of consent.

Unauthorized processing under the Data Privacy Act

Section 25 of the Data Privacy Act penalizes unauthorized processing when its elements are established. For ordinary personal information, the statutory penalty is imprisonment of one year to three years and a fine of ₱500,000 to ₱2,000,000. For sensitive personal information, the prescribed penalty is imprisonment of three years to six years and a fine of ₱500,000 to ₱4,000,000. (National Privacy Commission)

Whether conduct is actually “unauthorized processing” depends on the statutory requirements, applicable lawful bases, exclusions, and facts.

Unauthorized disclosure

Section 32 contains a separate offense concerning unauthorized disclosure by a personal information controller or processor, or its officials, employees, or agents, to a third party without the required consent.

For personal information, the statutory penalty is imprisonment of one year to three years and a fine of ₱500,000 to ₱1,000,000. For sensitive personal information, it is imprisonment of three years to five years and a fine of ₱500,000 to ₱2,000,000. (National Privacy Commission)

Section 31 also separately penalizes malicious disclosure in the circumstances specified by the Act. These are distinct offenses with their own elements; they should not be treated as interchangeable labels for every unwanted online disclosure. (National Privacy Commission)

Special rule for intimate photos and videos

If the material is an intimate recording, Republic Act No. 9995, or the Anti-Photo and Video Voyeurism Act of 2009, may be far more directly relevant than an ordinary privacy complaint.

The Act prohibits specified acts involving the recording of a person engaged in a sexual act or similar activity, or the capturing of private areas under circumstances in which the person has a reasonable expectation of privacy, when the statutory requirements are present. It separately prohibits copying, reproducing, selling, distributing, publishing, or broadcasting covered recordings, including through the internet. (Judiciary eLibrary)

Importantly, consent to the recording does not necessarily mean consent to its later publication or distribution. The statute expressly addresses subsequent prohibited distribution even where the person consented to the recording in the first place. (Judiciary eLibrary)

Because continued dissemination of intimate material can cause rapidly escalating harm, legal assistance should be sought promptly.

Other laws may apply to what is done with the information

An online disclosure can create several legally distinct issues at the same time.

For example:

using another person's identifying information to impersonate that person or for fraudulent purposes may raise computer-related identity-theft issues under the Cybercrime Prevention Act;
a defamatory online publication may raise libel or cyberlibel issues if all elements of the applicable offense are present;
threats, extortion, stalking, fraud, or unauthorized account access may implicate other criminal statutes; and
leaked information obtained from a business, employer, government agency, professional, or other organization may raise duties that are different from those applicable to an ordinary social-media user.

The Cybercrime Prevention Act specifically defines computer-related identity theft and cyberlibel as distinct cybercrime offenses. A privacy violation should therefore not automatically be described as cyberlibel, identity theft, or hacking unless the facts satisfy the separate legal requirements. (Judiciary eLibrary)

Evidence worth preserving

For a serious case, preserve evidence systematically rather than relying on memory.

Consider retaining:

the original screenshot and an uncropped copy showing context;
the exact date and approximate time of discovery;
the full page address and account identity;
the original file, photograph, or video if available;
copies of comments, shares, reposts, and messages referring to the disclosure;
correspondence with the person who posted it;
your written request for removal and proof of delivery;
the respondent's reply or proof that no reply was received;
platform reports and resulting action;
evidence showing where the information originally came from;
records of unauthorized transactions or impersonation;
messages containing threats, blackmail, or demands;
receipts or records of expenses caused by the incident; and
witnesses who personally saw the material while it was accessible.

Avoid altering original files merely to make them look clearer. If you create annotated copies, retain the originals as well.

Common mistakes that can weaken a privacy complaint

Deleting or losing the evidence

A takedown is often the immediate goal, but first preserve enough evidence to prove what happened. Once a post and account disappear, proving their contents and source can become harder.

Reposting the personal information to “expose” the offender

Do not unnecessarily redistribute the same private material in an attempt to shame the original poster. That may increase the harm and create separate legal issues.

Assuming all public information is free to republish

The fact that information was once publicly visible does not by itself resolve whether a later use is lawful, proportionate, or compatible with the purpose for which it became available.

Assuming every post without consent is criminal

Consent is not the only lawful basis for processing, and statutory exclusions or competing rights may apply. Criminal offenses also require proof of their particular elements.

Filing an NPC complaint without the required prior notice

Unless there is a valid basis for the NPC to waive the requirement, a complainant normally must first give the respondent written notice and allow the current 15-calendar-day response period contemplated by the rules.

Treating a platform report, NPC complaint, civil lawsuit, and criminal complaint as the same remedy

They perform different functions. A platform may remove content under its own rules; the NPC enforces data-protection law and can impose administrative remedies; a civil court may award judicial relief where a cause of action exists; and criminal prosecution requires proof of a statutory offense beyond the mere existence of an unwanted post.

When legal help is urgent

Prompt legal assistance is especially important when the disclosure involves:

intimate sexual images or videos;
information identifying or endangering a child;
a home address, real-time location, or family details published together with threats;
passports, government IDs, signatures, bank information, or credentials that can facilitate fraud;
leaked medical, employment, financial, or similarly sensitive records;
impersonation or fraudulent accounts;
blackmail or demands for money in exchange for deleting information;
stalking or credible threats of physical harm;
repeated republication after written demands to stop;
a large-scale leak affecting many people; or
circumstances in which continued processing may justify an application for urgent NPC or judicial relief.

The NPC itself has warned that unauthorized access, use, disclosure, sharing, or further dissemination of personal data can potentially result in civil, administrative, or criminal liability depending on the circumstances. (National Privacy Commission)

Frequently asked questions

Can I demand that a Facebook post or other social-media post be deleted?

You can request deletion or blocking and use the platform's privacy-reporting mechanisms. If the Data Privacy Act applies and the statutory grounds for erasure or blocking exist, you may also invoke your rights against the relevant personal information controller. But removal is not automatic: another legal basis, public-interest consideration, freedom of expression, or statutory exception may affect the request. (National Privacy Commission)

Can I immediately file with the NPC?

Generally, the current rules require written notice to the respondent first and permit a complaint when the respondent fails to take timely and appropriate action or does not respond within 15 calendar days. The NPC may waive that requirement in qualifying circumstances, including certain serious or irreparable situations.

What if the information was already publicly available?

That fact is relevant but does not necessarily end the inquiry. The lawfulness of further processing can depend on the source, purpose, context, applicable exemption, proportionality of the disclosure, and competing legal rights.

Can I complain against an individual rather than a company?

Potentially, but the Data Privacy Act analysis can be different for an individual acting solely in connection with personal, family, or household affairs. The circumstances surrounding wider dissemination and the purpose of the disclosure matter. Even when a Data Privacy Act theory is uncertain, Civil Code or other statutory remedies may still need to be considered. (National Privacy Commission)

Does sending someone a private photograph mean I consented to its public posting?

Not necessarily. Consent, where relied upon as the legal basis, is tied to the relevant processing and purpose. Permission to receive or possess information should not simply be assumed to authorize unlimited public dissemination. For recordings covered by the Anti-Photo and Video Voyeurism Act, the law specifically prohibits certain forms of subsequent copying, distribution, publication, or broadcasting even if consent to the original recording existed. (Judiciary eLibrary)

Can I claim damages?

Possibly. The Data Privacy Act recognizes a right to indemnification for damages sustained because of specified violations, while the NPC's current rules allow indemnity to be awarded in accordance with the Civil Code. Articles 20, 21, and 26 of the Civil Code may also support civil relief in appropriate circumstances. Liability and the amount of recoverable damages depend on the legal basis and proof presented. (National Privacy Commission)

Is a screenshot enough to win the case?

A screenshot can be important evidence, but no single screenshot automatically proves every issue. The identity of the poster, authenticity, context, timing, source of the information, extent of publication, and applicable legal basis may all be disputed. Preserve as much original electronic and contextual evidence as reasonably possible.

Will the NPC prosecute the poster criminally?

An NPC proceeding and a criminal prosecution are different processes. Under its current rules, the Commission may recommend prosecution to the Department of Justice when warranted. Criminal liability still requires proceedings under the applicable law and proof of the elements of the alleged offense.

Official sources

General-information disclaimer

This article provides general Philippine legal information and is not a substitute for legal advice concerning a specific incident. Privacy disputes are highly fact-dependent, particularly where freedom of expression, public interest, lawful processing grounds, statutory exclusions, intimate material, threats, or criminal liability are involved. Procedures and administrative issuances can also change. Primary and official sources were checked as of August 23, 2026.