Quick answer

Yes. Verifying someone’s criminal background in the Philippines can be legal, but there is no general right to secretly obtain, compile, or circulate another person’s criminal history.

Information about an alleged or committed offense—including the proceedings, the court’s disposition, and any sentence—is sensitive personal information under the Data Privacy Act of 2012. A lawful check therefore requires:

A specific, legitimate purpose;
A lawful basis applicable to sensitive personal information;
Fair and transparent collection;
Information limited to what is relevant and necessary;
Reasonable verification of identity, accuracy, and case status; and
Proper security, restricted disclosure, and timely disposal.

For most private employers, landlords, lenders, volunteer organizations, and individuals, the safer course is to tell the person exactly what will be checked, obtain valid written consent, and ask the person to provide a current NBI or police clearance. A pending complaint, arrest, warrant, “hit,” or social-media allegation must not be presented as a conviction.

Why criminal-record information receives special protection

The Data Privacy Act covers the collection, recording, consultation, use, disclosure, storage, and destruction of personal data. It expressly treats information about an offense allegedly or actually committed by a person, the related proceedings, and their outcome as sensitive personal information.

Processing sensitive personal information is generally prohibited unless a ground under Section 13 of the Act applies. Depending on the circumstances, those grounds may include:

The person’s consent, specific to the declared purpose and given before processing;
Processing expressly authorized by a law or regulation that also protects the information;
Protection of life or health when the person cannot legally or physically consent;
Certain medical-treatment purposes;
Protection of lawful rights and interests in court proceedings, or the establishment, exercise, or defense of legal claims; or
Processing necessary for government agencies to perform their lawful public-authority functions.

“Legitimate interest” under Section 12(f) is a possible basis for processing ordinary personal information, but it is not, by itself, a lawful basis for sensitive personal information. The National Privacy Commission (NPC) confirms this distinction in its Guidelines on Legitimate Interest.

A checker should identify the correct legal basis before collecting any criminal-record data. A broad statement such as “for security,” “for verification,” or “for company policy” does not automatically make the processing lawful.

Does consent make every background check legal?

No. Consent is important, but it does not cure an excessive, deceptive, or discriminatory investigation.

Under the Data Privacy Act and NPC Circular No. 2023-04 on Consent, valid consent must be freely given, specific, informed, and evidenced by written, electronic, or recorded means. Before consent is obtained, the person should be told in clear language:

Who will conduct the check;
What records and sources will be examined;
Why the information is needed;
Whether a third-party screening provider will receive the data;
Who will receive the result;
How long the information will be kept;
What happens if consent is withheld or withdrawn; and
How the person can exercise privacy rights or challenge an error.

A blanket clause hidden in a lengthy application form is risky. So is requesting “all records from any source” when only a current clearance or a narrowly defined conviction check is relevant.

Consent in an employment relationship also deserves care because an applicant or employee may feel unable to refuse. The organization remains responsible for showing that its chosen legal basis is appropriate and that the check is necessary and proportionate.

What sources may legally be checked?

A clearance supplied by the person

The cleanest approach is usually to ask the person to obtain and voluntarily submit an authentic, current clearance.

An applicant may apply through the official NBI Clearance portal and guidance. A National Police Clearance may be obtained through the PNP National Police Clearance System. The PNP system also provides an official clearance-verification function.

Use official portals rather than unofficial “lookup” services. Do not ask for the person’s account password, one-time password, or other login credentials.

A clearance is a screening document, not a complete narrative of every police, prosecutorial, and court event in a person’s life. A “hit” may require verification and does not, by itself, prove guilt or a conviction. The subject should be allowed to resolve name matches and submit the final document.

Court records

Rule 135, Section 2 of the Rules of Court generally states that court records are public and available for inspection during proper business hours under the clerk’s supervision. But access is subject to important limits. A court may restrict publicity in a proper case, and special rules protect confidential information and proceedings.

Examples that may involve confidentiality or restricted access include records concerning children, adoption, certain family matters, sexual-offense victims, sealed records, and information protected by a specific statute or court order. The Supreme Court’s Rule on Electronic Evidence and court-record privacy safeguards likewise recognize that only nonconfidential court information may be disclosed through covered systems.

Public availability does not mean unrestricted commercial reuse. A person or organization that copies, organizes, stores, matches, scores, or discloses court information is processing personal data and must still comply with privacy principles and other applicable laws.

Police, prosecutor, and investigative records

A private person ordinarily cannot demand unrestricted access to another individual’s internal police, NBI, prosecutor, or government investigative files. The agency must have authority to disclose the requested information, and confidentiality, due-process, privacy, and investigative restrictions may apply.

A barangay blotter, police report, complaint affidavit, prosecutor’s complaint, warrant, or arrest record also does not establish a final conviction. Anyone relying on such a document should determine what it actually records and whether the matter was dismissed, archived, acquitted, appealed, or finally decided.

Online searches and social media

Viewing publicly visible material is not automatically unlawful. The risk increases when a person systematically collects, profiles, stores, combines, or shares information about an identifiable individual.

Online posts are especially unreliable for criminal-history decisions. Names may be shared by different people, reports may be outdated, cases may later be dismissed, and allegations may be false. Doxxing, impersonation, unlawful system access, deception to obtain protected records, and malicious publication may create liability under privacy, cybercrime, civil, or criminal law.

Criminal checks for employment

An employer may have a genuine need to assess risks connected with a position—for example, work involving money, security, vulnerable persons, regulated activities, or access to highly sensitive systems. That does not justify checking every applicant for every possible offense.

A defensible employment check should be:

Job-related. Define the particular risk connected with the position.
Necessary. Consider whether a narrower document or verification would be enough.
Disclosed in advance. Give a privacy notice and identify the lawful basis.
Consistent. Apply the same relevant criteria to similarly situated applicants.
Accurate. Verify identity and the final status of any case.
Individualized. Consider the nature, seriousness, recency, and job relevance of a verified result, together with any explanation and applicable legal requirements.
Confidential. Limit access to personnel who genuinely need the information.

The mere filing of a criminal case does not by itself establish guilt or automatically justify dismissal. In Philippine Long Distance Telephone Co. v. NLRC, the Supreme Court explained that the mere filing of a criminal case was insufficient to warrant dismissal from employment. The decision remains a useful warning against treating an accusation as proof: G.R. No. 96685, February 15, 1999.

Whether an employer may reject or discipline a person still depends on the job, the verified facts, the employer’s lawful policy, the Labor Code, any applicable sectoral rule, and observance of due process. A conviction may be relevant without automatically deciding every employment question.

First-time jobseekers may qualify for government documents, including NBI and police clearances, without fees under the First Time Jobseekers Assistance Act, subject to the Act’s eligibility and documentary requirements.

Checks by landlords, lenders, associations, and private individuals

Private safety concerns do not create unlimited investigative powers.

A landlord, lender, school, association, household employer, or volunteer organization should first ask:

Is a criminal check actually necessary for this relationship?
What precise offense or risk would be relevant?
Can the purpose be met by asking for a current clearance?
Has the person received a privacy notice and given valid consent?
Will the organization verify adverse information before acting?
Who will see the information, and when will it be deleted?

Curiosity, gossip, romantic suspicion, neighborhood disputes, or a desire to expose someone generally do not justify collecting and circulating sensitive criminal-history information. If the concern is an immediate threat, report the facts to the proper authorities instead of attempting to obtain restricted databases or publishing accusations online.

Using a third-party background-check company

Hiring a screening provider does not transfer away the client’s legal responsibility. The client must have a lawful basis and should conduct due diligence on the provider.

A written contract should define:

The authorized purpose and categories of data;
Permitted sources and verification standards;
Prohibited practices, including pretexting and unauthorized database access;
Confidentiality and security controls;
Rules for subcontractors and overseas transfers;
Retention and secure deletion;
Assistance with access, correction, objection, and complaints;
Security-incident notification; and
Return or deletion of data when the engagement ends.

The NPC has specifically discussed records verification, background investigation, surveillance, and private-detective services in Advisory Opinion No. 2021-010. Its central practical point is that the investigator and client must be able to demonstrate compliance with the Data Privacy Act; labeling the activity a “background check” does not exempt it.

A practical compliance checklist

Before conducting a check:

Write down the precise purpose and decision the information will support.
Identify whether the requested information is ordinary personal information, sensitive personal information, or confidential by law or court order.
Identify and document the applicable lawful basis.
Limit the check by position, risk, source, geographic scope, and relevant time period.
Give a plain-language privacy notice.
Obtain specific consent when consent is the appropriate basis.
Use official or directly verifiable sources.
Instruct investigators not to use deception, unauthorized access, purchased leaks, or undisclosed surveillance.

When a possible record appears:

Confirm that the record concerns the correct person. Match more than a name.
Obtain the case number, court or agency, charge, relevant dates, and latest official disposition where lawfully available.
Separate allegations, arrests, pending cases, convictions under appeal, final convictions, dismissals, and acquittals.
Give the person a meaningful opportunity to explain and provide corrected or updated documents.
Do not make or circulate a final adverse conclusion while a material identity or accuracy dispute remains unresolved.

After the decision:

Record only what is necessary to support the lawful decision.
Restrict access through role-based controls.
Do not place clearance copies in general-access folders or group chats.
Retain the information only for a justified period.
Securely delete or destroy it when no longer needed.
Keep an audit trail of access, correction, disclosure, and disposal.

Evidence to preserve if you were checked

If you believe a background check was inaccurate or unlawful, preserve:

The application form and consent language;
The privacy notice and relevant company policy;
Emails, messages, screenshots, and interview notes;
The adverse decision and the reason given;
A copy of the report or clearance relied upon;
Court orders, certifications, dismissal resolutions, acquittals, or entries of judgment;
Proof that another person has the same or a similar name;
Your written correction request and proof of delivery;
The organization’s response; and
Evidence of any disclosure to coworkers, clients, relatives, social media, or other third parties.

Keep original electronic files where possible. Screenshots are useful, but preserve the message link, sender, date, time, and surrounding conversation as well.

Your rights if the information is wrong or misused

Under the Data Privacy Act and its Implementing Rules and Regulations, a data subject may have rights to:

Be informed about the processing;
Access personal data being processed and obtain relevant information about its source, use, and recipients;
Object in situations recognized by law;
Dispute inaccuracies and have errors corrected within a reasonable period;
Seek blocking, removal, or destruction when the statutory grounds apply;
Claim indemnity for damage caused by inaccurate, incomplete, outdated, unlawfully obtained, or unauthorized use of personal data; and
File a complaint with the NPC.

These rights have exceptions. For example, access or deletion may be limited where retention or processing is required by law, necessary for a legal claim, or otherwise authorized.

How to challenge an improper check

Start with a written request to the organization or its data protection officer. Identify the disputed information and ask for:

Confirmation that your data was processed;
The source and recipients of the information;
A copy or intelligible description of the data relied upon;
The purpose and lawful basis for processing;
Correction of inaccurate or outdated information;
Temporary restriction of adverse use while accuracy is investigated; and
Deletion or blocking if there is no lawful reason to keep the data.

Attach supporting records, but redact unrelated identifiers when possible. Set out the specific correction requested rather than merely stating that the report is “wrong.”

If the matter is not properly addressed, consult the NPC’s data-subject rights and complaint guidance. Under the NPC’s 2021 Rules of Procedure, as amended, a complainant generally must first inform the respondent in writing and allow an opportunity for appropriate action. The rules contain exceptions for circumstances such as grave and irreparable harm, the absence of an adequate remedy, or patently illegal action. Follow the current form, verification, attachment, and filing requirements shown by the NPC.

An unlawful check can expose responsible persons to administrative remedies, civil liability, and—where the elements are proved—criminal penalties under the Data Privacy Act. Possible offenses include unauthorized processing, unauthorized access, malicious disclosure, and unauthorized disclosure. The correct offense and penalty depend on the conduct, type of data, intent, responsible person, and other facts; a privacy violation should not be classified solely from a short description.

Common mistakes

Treating an NBI or police “hit” as proof of a criminal conviction;
Confusing a complaint, arrest, charge, or pending case with guilt;
Checking only a name without enough identifiers to avoid a false match;
Relying on an old news story without checking the final case outcome;
Assuming that “public record” means “free to collect and publish for any purpose”;
Using ordinary legitimate interest as the sole basis for processing criminal-history information;
Obtaining vague, bundled, or undisclosed consent;
Collecting records unrelated to the position or transaction;
Giving a screening provider unrestricted authority;
Sharing reports through personal email, messaging groups, or unsecured drives;
Keeping rejected applicants’ reports indefinitely; and
Refusing to hear a documented correction or mistaken-identity claim.

When legal help is urgent

Seek prompt assistance from a Philippine lawyer or the appropriate authority when:

A false criminal record is causing imminent loss of employment, housing, a license, travel, or another important opportunity;
Confidential records involving a child, protected victim, sealed matter, or family proceeding were disclosed;
Someone obtained data through hacking, impersonation, bribery, leaked databases, or stolen credentials;
Criminal allegations are being maliciously published or sent to customers, coworkers, or relatives;
You received a demand letter, subpoena, court order, or government investigation notice;
An employer is threatening immediate dismissal without identifying the verified facts or giving an opportunity to respond;
A background-check database repeatedly confuses you with another person; or
Disclosure creates a credible risk of violence, stalking, extortion, or identity theft.

For immediate danger or an active crime, contact law enforcement or emergency services. A privacy complaint is not a substitute for urgent safety intervention.

Frequently asked questions

Can I check whether a prospective employee has a criminal record?

Potentially, yes—but the check must be necessary, job-related, transparent, supported by a lawful basis for sensitive personal information, and handled securely. Asking the applicant to submit a current official clearance is generally safer than conducting a broad, undisclosed investigation.

Can I check a boyfriend, girlfriend, tenant, caregiver, or business partner?

You may request a clearance or conduct a properly disclosed and consented verification for a legitimate and proportionate purpose. You do not gain access to restricted government files merely because you have a personal or commercial concern.

Are criminal cases public records?

Court records are generally open to inspection during proper business hours under Rule 135, Section 2, unless access is restricted by the court or another rule or law. Not every police, prosecutor, NBI, juvenile, family, victim-related, or investigative record is public. Even lawfully obtained public information remains subject to rules governing its later processing and disclosure.

Is a pending criminal case the same as a criminal record?

It may form part of a person’s case history, but it is not a conviction. The person remains presumed innocent unless guilt is proven beyond reasonable doubt, and the current procedural status must be stated accurately.

Does an NBI “hit” mean the applicant committed a crime?

No. A hit signals that further verification is required. It may involve a namesake or a record that needs review. Wait for the NBI’s resolution and the final clearance or official documentation.

Can an employer automatically reject anyone with a conviction?

Not necessarily. The answer depends on the position, the verified offense and disposition, the connection to legitimate job requirements, applicable laws or regulations, and the employer’s lawful and consistently applied policy. Some regulated positions may have specific statutory qualification or disqualification rules.

May the checker keep a copy forever?

No general rule permits indefinite retention. The organization should establish a justified retention period based on its purpose, legal obligations, and legitimate claims, then securely dispose of the record when those grounds end.

Can the subject ask who supplied the information?

The Data Privacy Act’s right of access generally includes information about the source of personal data and the recipients to whom it has been disclosed, subject to lawful exceptions.

What should I do if the record belongs to my namesake?

Notify the checker in writing immediately. Request suspension of the adverse decision, identify the mismatch, and provide narrowly tailored proof such as the correct case record, clearance, birth details, or other official documentation. Avoid sending more sensitive information than necessary.

Is posting someone’s case online legal because the court record is public?

Not automatically. Context, purpose, accuracy, necessity, manner of disclosure, audience, and applicable confidentiality rules all matter. Republishing an accusation as established guilt or exposing protected information can create substantial legal risk.

Official references

This article provides general legal information, not legal advice or a definitive assessment of any particular background check. Outcomes depend on the purpose, records, consent language, position involved, applicable sectoral rules, and other facts. Laws, procedures, and official guidance were checked against primary Philippine sources as of July 27, 2026.