Quick answer

Posting someone’s personal information online without consent may be unlawful in the Philippines, but lack of consent alone does not automatically establish a violation. Consent is only one possible legal basis for processing personal data. The result depends on what was posted, how it was obtained, why it was disclosed, who posted it, the audience, and whether an exception or another lawful basis applies.

If your information was posted:

Preserve the post and identifying details before requesting deletion.
Report the content to the platform.
Send the poster or organization a written request for removal, blocking, correction, and preservation of relevant records.
Consider a National Privacy Commission (NPC) complaint if the Data Privacy Act applies.
Contact the PNP Anti-Cybercrime Group or NBI Cybercrime Division promptly if there are threats, hacking, impersonation, intimate images, sexual harassment, identity theft, or defamatory statements.
Obtain legal advice about an injunction, damages, a protection order, or a writ of habeas data when the harm is serious or continuing.

Do not wait for an administrative complaint if someone is in immediate danger.

When an online post may violate the Data Privacy Act

Under the Data Privacy Act of 2012, personal information includes recorded information that identifies a person directly or that, when combined with other information, would identify that person. Posting, sharing, storing, or otherwise using that information may constitute “processing.”

Examples include:

A home address, mobile number, personal email address, or location;
Government identification numbers, signatures, tax information, or account details;
Medical, educational, employment, or financial records;
Information about sexual life, health, religious or political affiliations, or legal proceedings;
Private messages, photographs, recordings, and personal documents; and
Several individually harmless details combined to identify or locate a person.

All processing must comply with transparency, legitimate-purpose, and proportionality requirements. Ordinary personal information may be processed on grounds other than consent, including contractual necessity, legal obligation, vital interests, public authority, and legitimate interests that are not overridden by the data subject’s fundamental rights.

Sensitive personal and privileged information receives stricter protection. Its processing is generally prohibited unless a specific exception in Section 13 applies, such as processing required by law, necessary for medical treatment, needed to protect life and health, or necessary for legal claims or proceedings.

Accordingly, these propositions are both incorrect:

“There was no consent, so the post is automatically illegal.”
“The information is true or came from a public source, so it can always be reposted.”

The entire context must be examined.

Important exceptions and limitations

A privacy claim may be affected by the following:

The Data Privacy Act excludes certain information connected with government positions, official functions, government contracts, and specified public financial benefits.
Processing for journalistic, artistic, literary, or research purposes is outside portions of the Act’s coverage. This is not a blanket license for harassment, voyeurism, defamation, or other unlawful conduct.
Disclosure may be lawful when reasonably necessary to establish, exercise, or defend a legal claim or to provide information to a government authority.
An organization may rely on legitimate interests, but it must still show necessity and balance those interests against the data subject’s rights.
The definition of a personal information controller excludes an individual processing information solely in connection with personal, family, or household affairs. Whether a public or wide online disclosure remains within that exclusion is fact-dependent.
A person who made information publicly accessible may have a weaker expectation of privacy. The Supreme Court has nevertheless recognized that privacy settings can demonstrate an intention to restrict access. The setting used, actual audience, manner of access, and evidence of unauthorized redistribution matter. See Vivares v. St. Theresa’s College.
Data-subject rights are limited for information used only for qualifying scientific or statistical research and for information gathered for investigations involving criminal, administrative, or tax liabilities.

Even where the Data Privacy Act does not apply, the Civil Code or a special criminal law may provide a remedy.

Preserve evidence before seeking removal

Online content can disappear quickly. Preserve evidence without unnecessarily redistributing the harmful material.

Keep:

Full-page screenshots showing the post, account name, date, time, reactions, comments, and surrounding context;
The exact URL, post or message identifier, profile URL, username, and visible account details;
A screen recording showing how the post is reached from the account or page;
Original downloaded files, messages, emails, attachments, and available metadata;
Evidence of the privacy setting or limited audience that originally applied;
Copies of platform reports, confirmation emails, ticket numbers, and responses;
Written takedown demands and proof that the recipient received them;
Names and contact details of people who personally saw the post;
Evidence of resulting harm, such as threats, scam attempts, unauthorized transactions, work consequences, medical consultations, counseling, or expenses; and
A chronological log of when you discovered the post and every step taken afterward.

Do not crop, annotate, alter, or repeatedly compress the only copy. Keep the original device and files when possible. Philippine electronic evidence must still be authenticated and shown to be reliable; a screenshot is useful but is not automatically conclusive. The controlling standards appear in the Rules on Electronic Evidence.

If intimate or child sexual material is involved, do not forward it to friends or collect unnecessary copies. Preserve only what authorities or counsel advise and report it immediately.

Request removal, blocking, and correction in writing

Send a concise written notice to the person or organization responsible. If it is a company, school, employer, association, or government office, address the notice to its data protection officer or privacy contact.

Identify:

The specific post, page, account, or file;
The personal information involved;
When and how you discovered it;
Why you believe the collection or disclosure was unauthorized, excessive, inaccurate, or no longer necessary;
Any privacy setting, confidentiality agreement, or limited purpose under which the information was originally provided;
The present or expected harm;
The relief requested; and
A reasonable method for confirming compliance.

Depending on the facts, request:

Immediate removal or blocking of the post;
Correction of inaccurate information;
Cessation of further sharing;
De-indexing or removal of duplicate posts under applicable platform processes;
Destruction of unlawfully held copies;
Notification to known recipients that the information was inaccurate or withdrawn;
Identification of the source, recipients, purpose, and legal basis for processing; and
Preservation of account and access records for a possible investigation.

Section 16 of the Data Privacy Act allows a data subject, upon discovery and substantial proof of specified grounds, to seek blocking, removal, or destruction of information that is incomplete, outdated, false, unlawfully obtained, used for unauthorized purposes, or no longer necessary. This is a conditional right—not an absolute right to erase every truthful or lawfully published reference.

Report the same content through the platform’s privacy, impersonation, harassment, intimate-image, or personal-information channel. A platform report can produce a faster practical result, but it does not determine legal liability.

Filing a complaint with the National Privacy Commission

Under the 2021 NPC Rules of Procedure, as amended in 2024, an affected data subject may file a complaint for a Data Privacy Act violation.

Complete the required prior notice

Ordinarily, the NPC will not give a complaint due course unless the complainant proves that:

The personal information controller, processor, or concerned entity was informed of the violation in writing; and
It failed to take timely or appropriate action, or did not respond within 15 calendar days after receiving the notice.

The NPC may waive these requirements for properly established good cause or a serious violation, including grave and irreparable harm that only NPC action can prevent or mitigate, the absence of a plain and adequate remedy, or patently illegal conduct. Do not assume that urgency automatically excuses prior notice; explain and document the grounds for waiver.

Prepare the complaint carefully

The complaint should include:

A written, signed, and properly verified complaint or notarized Complaints-Assisted Form;
The complainant’s and respondent’s identifying and contact information, if known;
If the respondent is unknown, facts that may lead to identification;
A clear chronology and description of the alleged violation;
The legal and factual grounds for the complaint;
All relief requested;
Copies of the written notice and the respondent’s action or non-response;
Documentary evidence and relevant witness affidavits;
Any required authority for a representative; and
A sworn certification against forum shopping.

Failure to provide the required verification, certification, prior correspondence, or supporting facts can result in outright dismissal.

The current base filing fee is ₱500, with additional fees when damages are claimed. Government and qualified indigent complainants are exempt, and the NPC may waive the fee for good cause. Check the current NPC schedule of fees before filing.

Complaints may be submitted personally, by registered mail, courier, or authorized electronic mail. The NPC’s current instructions permit submission of a scanned notarized complaint and evidence to complaints@privacy.gov.ph. Verify the latest address, payment process, forms, and document requirements on the NPC’s formal complaint page.

Ask about a temporary ban when continued processing is dangerous

After filing the complaint, a complainant may move for a temporary ban on the respondent’s processing of personal data. It is not automatic. The motion must show facts entitling the complainant to relief and that the ban is necessary to preserve relevant rights or protect data subjects. A bond fixed under the rules is generally required unless the complainant is exempt, and the parties must be heard in a summary hearing.

A final NPC decision may award indemnity, impose a permanent processing ban or administrative fine, compel corrective action, or recommend prosecution to the Department of Justice.

When criminal laws may apply

A privacy complaint is not a substitute for a criminal investigation. Depending on the content and conduct, one or more of the following laws may apply.

Intimate photographs or recordings

The Anti-Photo and Video Voyeurism Act prohibits specified acts involving images of sexual activity or private areas taken under circumstances creating a reasonable expectation of privacy. It also prohibits covered copying, distribution, publication, broadcast, or exhibition. Consent to take the original image does not by itself authorize later sharing; the law specifically addresses dissemination without the required written consent.

Gender-based online sexual harassment

Section 12 of the Safe Spaces Act covers gender-based online conduct such as sexual or sexist threats and remarks, cyberstalking, invasion of privacy, unauthorized recording or sharing of photos, videos, or information, online impersonation, and reputation-harming lies. The gender-based or sexual-harassment context must still be established. The PNP Anti-Cybercrime Group is the law’s primary complaint-receiving and enforcement body for these online offenses.

Hacking, impersonation, identity theft, and cyberlibel

The Cybercrime Prevention Act may apply where information was obtained by illegal access, where identifying information was intentionally acquired or misused without right, or where a defamatory imputation was published through a computer system.

Cyberlibel is not established merely because private information was posted. Its specific elements—including a defamatory imputation, publication, identification, and the legally required form of malice—must be proven.

Act quickly on a possible cyberlibel claim. In April 2026, the Supreme Court sitting en banc affirmed that cyberlibel prescribes in one year from discovery by the offended party, authorities, or their agents. See the Supreme Court’s official summary. Other offenses and civil actions have different prescriptive periods.

Abuse by a spouse or dating partner

If the poster is a woman’s spouse, former spouse, sexual or dating partner, or a person with whom she has a common child, online threats, harassment, public humiliation, or conduct causing mental or emotional anguish may fall under the Anti-Violence Against Women and Their Children Act.

A barangay, temporary, or permanent protection order may be available. Protection orders can prohibit threats, harassment, contact, and other acts covered by the law. Seek assistance from the PNP Women and Children Protection Desk, barangay VAW desk, public attorney, or private counsel.

Sexual material involving a child

The production, distribution, possession, or access of child sexual abuse or exploitation material is governed by the Anti-OSAEC and Anti-CSAEM Act. Report suspected child exploitation immediately to the PNP Women and Children Protection Center or Desk, PNP Anti-Cybercrime Group, NBI, or DSWD. Do not privately circulate the material as “proof.”

For cybercrime investigative assistance, the NBI provides an official computer-crime complaint process and an online complaint page.

Civil remedies and court orders

Articles 19, 20, 21, and 26 of the Civil Code may support a civil action when an online disclosure violates privacy, dignity, peace of mind, or the standards of justice, honesty, and good faith.

Article 26 expressly provides a cause of action for damages, prevention, and other relief for specified and similar invasions of privacy or private life, even when the conduct does not constitute a crime. Depending on the evidence, a court may consider actual, moral, nominal, or exemplary damages and injunctive relief. Each form of relief has separate legal requirements; damages are not presumed simply because a post was upsetting.

A lawyer should assess:

Whether to seek a temporary restraining order or preliminary injunction;
Which person or entity should be sued;
Whether barangay conciliation is a required preliminary step;
The correct court and venue;
The applicable prescriptive period;
How to authenticate the electronic evidence; and
How an NPC case, criminal complaint, or other proceeding must be disclosed to avoid forum-shopping problems.

Writ of habeas data

A writ of habeas data is an extraordinary judicial remedy for an unlawful act or omission that violates or threatens the right to privacy in life, liberty, or security, committed by a public official or by a private person or entity engaged in gathering, collecting, or storing information about the aggrieved person, family, home, or correspondence.

A verified petition may seek disclosure, updating, correction, suppression, or destruction of the information, or an order stopping a threatened act. It may generally be filed in the Regional Trial Court where the petitioner or respondent resides or where the information was gathered, collected, or stored. Different filing options apply to public data files of government offices.

The writ is not an ordinary shortcut for every embarrassing or unwanted post. The petition must specifically explain the unlawful conduct and its effect on life, liberty, or security. The Supreme Court has held that it can protect informational privacy outside cases of killings or enforced disappearances, but unsupported or purely speculative allegations are insufficient.

Common mistakes to avoid

Confronting a dangerous poster before securing personal safety;
Reporting the content without first preserving its URL, context, and account details;
Reposting the information publicly to “expose” the offender;
Assuming that every unwanted disclosure is automatically a Data Privacy Act crime;
Waiting for the NPC’s 15-day prior-notice period despite immediate threats or ongoing exploitation;
Filing an unverified NPC complaint without a certification against forum shopping;
Omitting another pending case or platform proceeding from sworn submissions;
Editing the only screenshots or deleting the original messages and files;
Paying an unknown account to remove content without police or legal advice;
Publicly accusing a suspected person without adequate proof; and
Delaying a cyberlibel consultation beyond the one-year prescriptive period.

When legal help is urgent

Seek immediate police and legal assistance when:

A home address, real-time location, workplace, or child’s school is posted together with threats;
The poster is stalking, blackmailing, extorting, or encouraging others to attack the person;
An account or device was hacked;
Government IDs, banking credentials, signatures, or authentication information were exposed;
Intimate images or recordings are being threatened or circulated;
Sexual material involves a child;
An abusive partner is using posts to threaten, control, or publicly humiliate a woman or her child;
The information has already caused account takeovers, fraudulent transactions, job loss, or serious medical or psychological harm; or
A legal deadline may expire soon.

If direct contact may increase the danger, let law enforcement or counsel handle the preservation and takedown demands.

Frequently asked questions

Is an online post illegal simply because I did not consent?

No. Consent is not the only lawful basis for processing ordinary personal information. However, the poster must still satisfy the applicable law, including necessity, legitimate purpose, proportionality, and any stricter rule for sensitive information.

Can I force someone to delete truthful information?

Possibly, but not automatically. Truth does not resolve every privacy issue. Removal may be available when information was unlawfully obtained, used for an unauthorized purpose, is excessive or no longer necessary, or its disclosure violates the Civil Code or a special law. Public interest, journalism, legal claims, and other defenses must also be considered.

Is there a general Philippine “right to be forgotten”?

There is no unlimited right to erase every online reference. Section 16 of the Data Privacy Act provides conditional rights to blocking, removal, or destruction when specified grounds are supported by substantial proof.

What if the account is anonymous?

Preserve the account URL, username, profile identifier, posts, messages, and transaction details. The NPC rules permit a complainant who does not know the respondent’s identity to state facts that may lead to identification. Police or NBI investigators may seek subscriber or computer data through the legal processes applicable to service providers.

Are screenshots enough?

They are important preliminary evidence, but their authenticity, completeness, and reliability may still need to be established. Preserve the original files, device, URLs, metadata, screen recordings, and testimony of people with personal knowledge.

Can I pursue several remedies at once?

Potentially. Platform reporting, an NPC complaint, a criminal case, and a civil action serve different purposes. Their overlap must be disclosed accurately, particularly in the NPC certification against forum shopping. Coordinate the filings with counsel to avoid inconsistent statements or procedural dismissal.

This article provides general Philippine legal information, not legal advice for a particular case. Outcomes depend on the exact post, source, audience, parties, evidence, and relief requested. Official sources and procedures were checked as of 3 August 2026 and may change.