Quick answer

If an online lending app threatens, insults, publicly shames, repeatedly contacts uninvolved people, misuses your photo, or improperly accesses or discloses personal data, you may report different parts of the conduct to different authorities:

Report unfair collection by a lending or financing company to the Securities and Exchange Commission (SEC) through its iMessage ticketing system.
Report misuse of contacts, photos, messages, or other personal data to the National Privacy Commission (NPC). Ordinarily, notify the lender or its data protection officer in writing first and allow 15 calendar days for an appropriate response before filing a formal NPC complaint.
Report credible threats, extortion, impersonation, account takeover, identity theft, or other possible crimes promptly to the police or the NBI Cybercrime Division. Call 911 if anyone is in immediate danger.
If the lender is a bank, digital bank, e-wallet provider, or another BSP-supervised institution—not an SEC-regulated lending or financing company—use the institution’s complaint mechanism first, then escalate an unresolved complaint through the BSP Consumer Assistance Mechanism.

Preserve the evidence before blocking numbers, revoking permissions, uninstalling the app, or changing phones. Filing a complaint does not automatically cancel a valid loan. Handle any legitimate balance or dispute separately and pay only through a verified official channel.

What collection practices are prohibited?

A lender may send lawful payment reminders, explain a genuine balance, propose payment arrangements, and pursue remedies allowed by the loan agreement and law. It may not turn collection into intimidation or public humiliation.

Under SEC Memorandum Circular No. 18, Series of 2019, prohibited practices by financing and lending companies include:

Using or threatening violence or other criminal means against a person, reputation, or property.
Threatening an action that cannot legally be taken.
Using obscenities, insults, or profane language that abuses the borrower or amounts to an offense.
Publishing or disclosing a borrower’s name or personal information to shame the borrower, except where disclosure is specifically allowed by law.
Communicating false loan information, including concealing that a debt is disputed when that fact should be disclosed.
Using a false identity, false representation, or deceptive means to collect a debt or obtain information.
Contacting the borrower before 6:00 a.m. or after 10:00 p.m., unless the account has been overdue for more than 15 days or the borrower has expressly agreed—through written, electronic, or recorded means—that those are the only reasonable times for contact. Even when that timing exception applies, threats, insults, deception, and other abusive conduct remain prohibited.
Contacting people in the borrower’s contact list who were not named as guarantors or co-makers. The borrower’s purported consent does not excuse this practice.

The Financial Products and Services Consumer Protection Act separately requires fair and respectful treatment, prohibits abusive collection or debt-recovery practices, protects client data, and requires financial service providers to maintain a free consumer-assistance mechanism.

A character reference is not automatically liable for the loan

A person listed only as a character reference does not become a guarantor or co-maker merely because the lender has the person’s name or telephone number. Liability depends on an actual agreement and the documents signed.

The NPC’s loan-data rules allow an app to provide a limited interface through which a borrower selects a character reference or guarantor. However, processing that leads to harassment or uses contacts for debt collection outside the borrower’s guarantors is prohibited. A friend, relative, employer, or co-worker who receives debt demands concerning someone else should preserve the messages because that recipient may also be an affected data subject.

What may constitute a privacy violation?

The Data Privacy Act of 2012 requires personal-data processing to be transparent, based on a lawful purpose and lawful criterion, and proportionate to that purpose. Agreeing to install an app is not unlimited permission to use every item on the phone for any purpose.

The NPC’s Circular No. 2020-01, as amended by Circular No. 2022-02, specifically addresses loan-related processing. Possible violations include:

Unrestricted or excessive access to a borrower’s contact list.
Using contact data to harass people or collect from anyone other than a guarantor.
Uploading or distributing the borrower’s photo to embarrass the borrower.
Accessing a camera or photo gallery beyond the stage when it is reasonably needed for identity verification, fraud prevention, or payment verification.
Publishing the borrower’s name, face, address, workplace, loan information, identification document, or alleged delinquency in group chats or on social media for shaming.
Sending loan information to employers, co-workers, friends, or relatives who have no lawful role in the loan.
Collecting data without an adequate privacy notice or without explaining, at the relevant time, why a permission is needed.
Refusing to explain what data was collected, its source, the purpose and lawful basis for processing, and the parties that received it.
Keeping, sharing, or using data that is excessive, inaccurate, unlawfully obtained, or no longer needed, subject to legitimate retention duties and the preservation of legal claims.

Not every use of personal data is unlawful. A lender may retain information necessary to administer a loan, comply with legal and regulatory duties, establish or defend a legal claim, prevent fraud, or make a disclosure specifically authorized by law. The rules also permit proportionate processing of contact-list metadata and limited access that lets the borrower choose a reference or guarantor. The legality of any particular activity depends on what was collected, why it was collected, how it was used, what notices were given, and whether the processing was necessary and proportionate.

Preserve evidence before taking action

Create a separate evidence folder and keep an untouched copy of every relevant item. Preserve:

Full screenshots showing the sender’s number or account, date, time, message, and surrounding conversation.
Original SMS messages, emails, chat exports, voicemails, social-media posts, comments, and notification logs.
Screen recordings showing the app page, permissions requested, privacy notice, lender information, and offending content.
The app’s exact name, icon, package or developer name, store URL, download page, and version, if visible.
The legal name of the lender, SEC registration number, Certificate of Authority number, business address, customer-service details, and collection-agency name shown in the app, loan agreement, disclosure statement, or receipt.
Loan documents, repayment schedules, statements of account, payment receipts, transaction references, and any written dispute about the balance.
Call logs, the numbers used, dates and times, and contemporaneous notes describing what was said.
The phone’s app-permission screen showing access to contacts, camera, photos, location, microphone, SMS, or storage.
Copies of the privacy notice and terms that applied when you applied for the loan.
Messages received by friends, relatives, employers, or co-workers. Ask each recipient to retain the original and write down when and how it was received.
URLs and screenshots of public posts before reporting them to the platform for removal.
Copies of every complaint, acknowledgment, ticket number, reply, and delivery receipt.

Do not secretly record a private telephone conversation without legal advice. The Anti-Wiretapping Act generally prohibits secretly recording a private communication without authorization from all parties. Preserve recordings or voicemails that the collector itself sends, but do not assume that being part of a call automatically permits you to record it.

Secure your phone and accounts

After preserving the evidence:

Review and revoke unnecessary app permissions.
Change passwords for email, social media, banking, and e-wallet accounts if they were reused or may have been exposed.
Enable multi-factor authentication and never disclose an OTP, PIN, password, or recovery code to a collector.
Remove unknown device sessions from important accounts.
Report impersonating or shaming accounts and posts to the relevant platform, while retaining the report confirmation.
Uninstall the lending app if it is no longer needed and doing so will not destroy evidence you still require.
Inform affected contacts briefly that the messages did not come from you and that they should not send money or personal information.
Pay only to an account confirmed through the lender’s official app, contract, or verified customer-service channel. Do not pay a collector’s personal wallet merely to stop harassment.

Send a written complaint to the lender first

Send the complaint through the lender’s official consumer-assistance channel and, for a privacy issue, to its data protection officer if one is listed. Use email or another method that produces proof of delivery.

Include:

Your name and loan or account reference, disclosing only what is necessary.
The app name and the legal name of the lender.
A dated, chronological description of each incident.
The telephone numbers, accounts, collectors, collection agency, and third parties involved.
The contacts, photographs, or other data accessed or disclosed.
A clear statement identifying any balance or charge you dispute.
Copies of representative evidence.
The action you want: stop harassment, stop contacting uninvolved third parties, remove public posts, correct false information, restrict or delete unlawfully processed data, identify recipients, preserve relevant records, investigate the collector, and respond in writing.
A request for the name and authority of any third-party collection agency.
A request that future communications be made through a specified reasonable channel.

For an NPC complaint, retain proof that the lender or other responsible entity received this written notice. Under the NPC Rules of Procedure as amended in 2024, the NPC ordinarily requires proof that the respondent was informed in writing and failed to act appropriately or did not respond within 15 calendar days. The NPC may waive this requirement for properly supported good cause or a serious violation—for example, where urgent NPC action is needed to prevent grave and irreparable harm, no adequate remedy is available from the respondent, or the alleged action is patently illegal.

Do not wait for the 15-day period if someone faces an immediate threat. Emergency and criminal reports can be made at once.

How to report unfair collection to the SEC

The SEC generally regulates lending companies, financing companies, their recorded online lending platforms, and their collection agents. Verify the entity named in the loan documents; an app’s marketing name may differ from the lender’s corporate name.

Go to the SEC’s official iMessage system, register or sign in, and open a new ticket.
Choose the service for complaints against financing and lending companies.
Identify both the app and the corporate lender. Include the SEC and Certificate of Authority numbers if available.
Describe each prohibited act with dates, times, sender details, and the people contacted.
Attach the loan documents, screenshots, call logs, app-store link, payment records, prior internal complaint, and the lender’s response or failure to respond.
State whether the conduct is continuing and whether information has been posted publicly.
Keep the electronic ticket number and use the same thread for requested documents and follow-ups.

If the app or lender appears unregistered, say so expressly. Provide the developer name, app-store URL, payment-recipient details, numbers used, website, advertisements, and every corporate name presented to you. The SEC maintains advisories, revocation orders, complaint notices, and online-lending information, but the absence of a familiar app name does not by itself identify who legally made the loan.

An app-store report may help remove a harmful application, but it does not replace a complaint to the SEC, NPC, or law enforcement.

How to file a privacy complaint with the NPC

1. Complete the current complaint form

Use the form and instructions on the NPC’s formal-complaint page. A formal complaint must be written, signed, verified, and notarized. It should identify the complainant and respondent, narrate the material facts, describe the relief sought, and include supporting evidence.

If the responsible company is not fully known, provide the available circumstances that may lead to its identification, such as the app, developer, collector, telephone numbers, payment accounts, privacy policy, and legal names appearing in the contract.

2. Attach the required records

Attach:

The written notice sent to the lender or responsible entity.
Proof of receipt.
Its response, or proof that 15 calendar days passed without a response.
Screenshots and other documentary evidence.
Witness affidavits where needed to identify or explain messages sent to other people.
The required certification against forum shopping, including disclosure of related proceedings before other agencies or courts.
Any authorization or special power of attorney if a representative is filing for you.

If you later learn that the same or a similar claim has been filed elsewhere, the NPC rules require that fact to be reported to the NPC within five calendar days. Do not conceal an SEC, police, prosecutor, or court proceeding; disclose it and explain that the agencies may be addressing different legal issues.

3. Submit the complaint

The NPC rules permit filing personally, by registered mail, by courier, or by authorized electronic mail. The NPC’s current public instructions allow a scanned complaint to be emailed to complaints@privacy.gov.ph. Check the NPC contact page for its current office address and contact numbers before sending physical documents.

The current NPC fee schedule lists:

A ₱500 filing fee.
A legal research fee equal to 1% of the filing fee, but not less than ₱10.
Additional fees when damages or special interim relief are claimed.

Qualifying indigent complainants may seek an exemption by submitting the required proof. Review the official NPC schedule of fees and obtain the NPC’s payment instructions; do not send a filing fee to an unofficial personal account.

When to involve law enforcement

Contact law enforcement promptly when the conduct involves:

A credible threat of physical harm, kidnapping, sexual violence, property damage, or an attack at home or work.
Demands for money accompanied by threats to publish information, fabricated images, or intimate material.
Impersonation, fake legal documents, false police identities, or fabricated warrants.
Unauthorized use of your identity, identification documents, bank account, e-wallet, or social-media account.
Hacking, malware, account takeover, or unauthorized access to a device.
Persistent stalking or disclosure of a home address that creates a safety risk.
Sexualized, manipulated, or degrading images, particularly where a child is involved.

Call the nationwide Unified 911 hotline for an immediate emergency. Otherwise, report to the nearest police station or cybercrime unit, or use the NBI’s online complaint page. The NBI Cybercrime Division also handles computer-related offenses.

Harassing conduct may, depending on the evidence, implicate the Revised Penal Code, the Data Privacy Act, or the Cybercrime Prevention Act. The proper charge cannot be determined from an abusive message alone; investigators and prosecutors must assess the precise words, surrounding circumstances, identity of the sender, method used, and evidence of intent.

Bring the original device if requested, but keep a backup and an inventory of what you surrender. Ask for the complaint or blotter reference number. Prompt reporting matters because accounts, logs, and platform content can be deleted or become harder to preserve.

The loan and the harassment are separate issues

Unlawful collection does not automatically erase principal, interest, or other lawful charges. Likewise, owing money does not authorize harassment.

Request a written statement showing:

The original principal.
Amount actually released.
Interest rate and computation.
Fees, penalties, and dates imposed.
Payments and credits already applied.
Current balance and due date.
The legal entity entitled to receive payment.

Dispute errors in writing. If you can pay, use only a verified channel and retain the receipt. If you need restructuring, propose an amount and schedule you can realistically maintain, but do not sign a new agreement without checking its charges and effect.

The Constitution provides that no person may be imprisoned merely for debt or nonpayment of a poll tax. That protection does not prevent prosecution for a separate alleged offense supported by evidence, such as fraud or the unlawful issuance of a check. A collector cannot lawfully invent a criminal case or claim that immediate arrest is automatic because an ordinary loan is overdue. See Article III, Section 20 of the 1987 Constitution.

If you receive an authentic subpoena, summons, prosecutor’s notice, or court document, do not ignore it. Verify it directly with the issuing office and seek legal advice promptly.

Common mistakes to avoid

Deleting messages or uninstalling the app before preserving evidence.
Submitting cropped screenshots that omit the sender, date, time, or conversation context.
Naming only the app and not the corporate lender or collection agency.
Filing an NPC complaint without proof of prior written notice, when no urgent exception applies.
Assuming that every call from a lender, every app permission, or every lawful credit disclosure is automatically illegal.
Assuming that an SEC or NPC complaint cancels the debt.
Paying an unfamiliar personal account, sharing an OTP, or providing another ID merely because a collector demands it.
Secretly recording private calls without checking the Anti-Wiretapping Act.
Counter-shaming collectors by publicly posting their private information. Preserve and submit evidence to the proper authorities instead.
Omitting related cases from the NPC certification against forum shopping.
Paying an unofficial “fixer” who promises to erase the loan, remove a credit record, or guarantee an agency ruling.

When legal help is urgent

Seek a lawyer promptly if:

You or your family face a credible threat or continuing publication of sensitive material.
The lender has disclosed identification documents, intimate images, medical information, financial credentials, or a home address.
Your identity or financial account has been used without permission.
You are asked to sign a settlement, acknowledgment, waiver, or restructuring agreement you do not understand.
You receive a subpoena, summons, prosecutor’s notice, or court order.
You want damages, an urgent cease-and-desist order, or temporary restrictions on data processing.
Several affected borrowers or contacts are considering a coordinated complaint.
The lender’s identity, jurisdiction, or legal authority is unclear.

Qualified indigent applicants may inquire with the Public Attorney’s Office. The Integrated Bar of the Philippines National Center for Legal Aid may also provide assistance or direct you to an appropriate chapter.

Frequently asked questions

Can a lending app message everyone in my contacts because I granted contact permission?

No. Permission is not blanket authority to use the entire contact list for collection or harassment. Access and processing must remain necessary and proportionate. Debt collection from people outside the borrower’s guarantors is prohibited under the NPC loan-data rules, and SEC rules prohibit contacting contact-list members who were not named as guarantors or co-makers.

May a collector call my employer?

A lender cannot disclose or threaten to disclose your loan merely to embarrass or pressure you. Whether a limited communication is lawful depends on its purpose, what was revealed, and whether the employer has a genuine role in the transaction. Preserve the message and ask the employer to do the same.

Can the lender post my name or photo because the debt is unpaid?

It cannot use your name, photograph, or loan information for public shaming. The NPC rules expressly prohibit using a borrower’s photo to harass or embarrass the borrower. Specific disclosures required or permitted by law—such as properly authorized regulatory, judicial, or credit-reporting disclosures—are different from publication intended to humiliate.

Can I withdraw consent and require deletion of everything?

You may object to processing and request blocking, erasure, or deletion where the legal requirements are met. Withdrawal of consent does not necessarily require deletion of records the lender must retain to administer an existing loan, comply with law

Quick answer

If an online lending app, lender, or collection agent is threatening you, insulting you, publicly shaming you, contacting people who are not your guarantors or co-makers, or misusing your contacts, photos, or other personal data:

Preserve the evidence before blocking, uninstalling, or changing settings.
Send a written complaint to the lender’s official customer-service channel or data protection officer.
Report unfair collection practices to the Securities and Exchange Commission (SEC).
Report misuse of personal data to the National Privacy Commission (NPC).
Report threats, extortion, account takeover, identity theft, or other possible crimes to the police or NBI without waiting for the lender to respond.

These remedies can be used in parallel because they address different violations. Reporting harassment does not automatically erase a valid loan, but owing money does not give anyone the right to threaten, deceive, humiliate, or unlawfully expose you.

What collectors are not allowed to do

SEC Memorandum Circular No. 18, Series of 2019 prohibits financing and lending companies—and the collection agencies, agents, representatives, and third parties acting for them—from using unfair debt-collection practices. Prohibited conduct includes:

Threatening violence or other criminal harm to a person, reputation, or property.
Threatening an action that cannot legally be taken.
Using obscenities, insults, or profane language that abuses the borrower or amounts to an offense.
Disclosing or publishing a borrower’s name or other personal information, subject to limited lawful exceptions.
Communicating false loan information, including failing to say that a debt is disputed when that fact should be disclosed.
Using false representations or deceptive methods to collect a debt or obtain information about the borrower.
Contacting the borrower before 6:00 a.m. or after 10:00 p.m., unless the account has been past due for more than 15 days or the borrower expressly agreed—through written, electronic, or recorded means—that those are the only reasonable times for contact.
Contacting people in the borrower’s phone contact list who were not named as guarantors or co-makers, even if the borrower previously gave broad access to the contact list.

The exception for accounts past due by more than 15 days does not authorize threats, insults, deception, public shaming, or other abusive conduct. See the SEC rule on unfair debt collection.

The Financial Products and Services Consumer Protection Act also prohibits financial service providers from employing abusive collection or debt-recovery practices. It requires fair treatment, protection of client data, and a free consumer-assistance mechanism. These duties generally extend to agents and third-party service providers acting for the lender. See Republic Act No. 11765.

When the conduct is also a privacy violation

The Data Privacy Act requires personal-data processing to be transparent, for a legitimate purpose, and proportionate to that purpose. Consent must be freely given, specific, and informed; tapping “Allow” or accepting a lengthy privacy policy does not give a lender unlimited authority to use personal data for any purpose.

Under the NPC’s rules for loan-related transactions:

An app may request access only when the data is suitable, necessary, and not excessive for a legitimate loan-processing or collection purpose.
Access should begin only when the information is actually needed.
Once the purpose has been completed and no other lawful basis remains, the app should turn off the permission by default or tell the borrower that access may be revoked.
Camera or gallery access may be used for legitimate purposes such as identity verification or payment verification at the relevant stage—but a borrower’s photo must never be used to harass or embarrass the borrower.
Unconstrained, excessive, or disproportionate processing of a contact list is prohibited, including processing that leads to harassment or unfair collection.
Debt collection through contacts outside the guarantors provided by the borrower is prohibited.
An app may provide a limited interface for the borrower to select a character reference or guarantor. A character reference is not automatically a guarantor and does not become liable for the loan merely by being named as a reference.
Limited and proportionate contact-list metadata may be processed where legally justified. This does not authorize copying the entire list and messaging everyone in it.

These requirements appear in NPC Circular No. 2020-01, as amended by NPC Circular No. 2022-02. The broader rights and duties are in the Data Privacy Act of 2012.

A contacted friend, relative, co-worker, or employer may have a separate privacy complaint if their own information was improperly obtained or used. They should preserve the messages they personally received.

Lawful collection is still possible

Not every collection message or use of loan information is unlawful. A lender may generally:

Contact the borrower through legitimate channels.
Demand payment and explain lawful consequences of default.
Assign collection work to an authorized agent while remaining responsible for that agent’s conduct.
Keep information necessary for the loan, legal claims, regulatory duties, fraud prevention, or other lawful purposes.
Make disclosures required or authorized by law, a court, a regulator, or an applicable credit-reporting system.
Contact an actual guarantor or co-maker about an obligation they legally undertook.

The legality of a particular disclosure depends on the loan documents, the recipient’s role, the data disclosed, the stated purpose, and the lender’s lawful basis. A privacy complaint therefore should identify exactly what information was used, who received it, and why the use was unnecessary or abusive.

Preserve evidence first

Create a separate evidence folder and keep backup copies. Preserve:

Screenshots showing the full message, sender or account, date, time, and surrounding conversation.
Original SMS, email, chat, social-media messages, voicemails, and app notifications.
Call logs showing the numbers, dates, times, frequency, and duration of calls.
The app’s name, icon, developer, app-store URL, package name if visible, and version.
The lender’s corporate name, SEC registration number, Certificate of Authority number, office address, and customer-service details shown in the app, advertisement, privacy notice, disclosure statement, or loan agreement.
The names or aliases used by collectors and every phone number, email address, social-media account, e-wallet, or bank account they supplied.
The loan agreement, disclosure statement, repayment schedule, account number, statements of account, receipts, and proof of payments.
The privacy notice and the phone-permission screen showing what the app could access.
A list of every third party contacted, what each person received, and when.
Screenshots or copies supplied directly by those third parties.
Copies of complaints sent to the lender and the delivery receipt, automated acknowledgment, or ticket number.
Links and screenshots of any public post before it is deleted.

Keep a chronological incident log. Record facts rather than conclusions: for example, “At 8:14 a.m. on 2 August, my supervisor received this message disclosing the loan amount,” rather than simply writing “They harassed everyone.”

Do not secretly record a private telephone conversation without legal advice. The Anti-Wiretapping Act generally requires authorization from all parties, even when the recorder is part of the conversation. Preserve recordings or voicemails that the collector voluntarily sent, but review Republic Act No. 4200 before making your own recording.

Secure your phone and accounts

After preserving the evidence:

Revoke the app’s access to contacts, camera, photos, storage, microphone, location, call logs, and SMS where those permissions are no longer needed.
Change any password reused on another service and enable multi-factor authentication.
Remove unknown device sessions from your email, social-media, bank, and e-wallet accounts.
Never give a collector your OTP, PIN, password, or screen-sharing access.
Verify payment instructions through the lender’s official channel. Do not send money to an unfamiliar personal account merely because a caller demands it.
Report the app to its app store, but do not treat an app-store report as a substitute for an SEC, NPC, or criminal complaint.
Uninstall the app only after preserving the agreement, account records, privacy notice, permissions, and messages you may need.

Send the lender a written complaint

Use the lender’s official consumer-assistance or customer-service channel and, for privacy issues, its data protection officer. The app or privacy notice should provide these details.

Your complaint should state:

Your name and account reference, without sending unnecessary identity documents.
The app and legal company involved.
The collector’s number, account, or name.
Each incident, with dates and evidence.
The people contacted and the information disclosed.
Whether you dispute the debt, amount, interest, fees, payment posting, or only the collection method.
The action you want: stop unlawful third-party contact, remove a public post, correct false information, restrict communication to an official written channel, investigate the collector, and preserve relevant records.
For privacy concerns, a request to identify the source, purpose, lawful basis, recipients, and retention period of the data; provide access to relevant personal data; correct inaccuracies; and block or erase unlawfully processed data where legally appropriate.

Ask for a ticket number and a written final response. Do not agree that the complaint is resolved merely because a collector apologizes by phone.

This written notice is especially important for an NPC complaint. Under the current NPC Rules of Procedure, a complainant normally must first inform the entity in writing and give it an opportunity to act.

Report the lender to the SEC

The SEC is the primary regulator for lending companies, financing companies, their online lending platforms, and their collection agents.

File through the SEC’s official iMessage ticketing system. After registering or signing in, select the service for complaints against financing and lending companies. The current SEC user guide describes iMessage as the centralized platform for public complaints and says it generates a unique electronic ticket.

Attach:

Your incident summary and requested action.
The legal lender’s name and identifying numbers, if available.
The app-store link and screenshots of the app.
The loan and payment records relevant to the complaint.
Complete copies of abusive messages or public posts.
Evidence of third-party contacts.
Your complaint to the company and its response or ticket number.

If the app does not disclose a legal lender, say so and provide every available identifier. An app’s brand name may be different from the corporation that issued the loan.

Before borrowing or when identifying the respondent, review the SEC’s lending and financing company advisories and recorded-platform information. Corporate registration by itself is not enough: a lending or financing company must also have the appropriate authority, and the particular online platform should be properly reported or recorded.

If the provider is a bank, digital bank, e-money issuer, or another BSP-supervised institution rather than an SEC-regulated lending or financing company, complain first through its financial consumer assistance mechanism. If unresolved, escalate through the BSP Consumer Assistance Mechanism and BSP Online Buddy.

File a privacy complaint with the NPC

1. Complete the prior written-notice requirement

Normally, you must show that:

You informed the lender, its data protection officer, processor, or other concerned entity of the violation in writing; and
It failed to take timely or appropriate action, or did not respond within 15 calendar days after receiving your notice.

The NPC may waive these requirements for proven good cause or a serious violation—for example, where immediate NPC action is needed to prevent grave and irreparable harm, the respondent cannot provide an adequate remedy, or the conduct is patently illegal. Explain and document why a waiver is necessary; do not simply omit the prior-notice step.

2. Prepare the formal complaint

Use the NPC’s current complaint form and filing instructions. The complaint must generally be written, signed, verified, and notarized. It should include:

The identities and contact details of the complainant and respondent, as far as known.
A chronological narration of the material facts.
The privacy violation and the acts or omissions complained of.
The relief requested.
Copies of all supporting documents and relevant correspondence.
Witness affidavits where needed to identify or substantiate evidence.
A certification against forum shopping disclosing any other proceeding involving the same issues.

If the company’s legal identity is unknown, state the facts that may enable the NPC to identify it. Disclose related SEC, police, prosecutor, court, or other proceedings rather than concealing them.

3. Submit and pay the applicable fee

The NPC’s rules allow filing personally, by registered mail, courier, or authorized electronic mail. The NPC currently directs emailed complaints to complaints@privacy.gov.ph. Check its current contact page before an in-person or courier filing because the office address may change.

The current fee schedule lists:

A ₱500 filing fee for a complaint.
A legal research fee of 1% of the filing fee, but not less than ₱10.
Additional fees when damages or special interim relief are claimed.

Qualifying indigent complainants may apply for exemption subject to documentary requirements. Confirm the assessment and approved payment method with the NPC; do not send payment to a personal account. See NPC Circular No. 2023-01.

The complete procedural requirements are in the 2021 NPC Rules of Procedure, as amended in 2024.

Report threats or possible crimes immediately

Do not wait 15 days if there is an immediate threat, extortion demand, stalking, unauthorized account access, identity theft, publication of sexualized or fabricated images, or a credible threat to visit or harm you, your family, or your workplace.

For an emergency or imminent danger, call Unified 911 or go to the nearest police station.
For computer-related offenses, approach the PNP cybercrime unit or file with the NBI’s online complaint facility or an NBI regional office.
The NBI lists its Cybercrime Division at ccd@nbi.gov.ph on its official divisions directory.
The Department of Justice also publishes cybercrime reporting guidance.

Depending on the evidence, conduct may potentially involve offenses such as threats, coercion, extortion, unjust vexation, identity theft, cyberlibel, unauthorized data processing, or another crime. The proper charge depends on the exact words, acts, intent, means used, and identity of the offender; law-enforcement officers and prosecutors must evaluate those facts.

Bring your phone, backups, identification, incident chronology, and original electronic evidence. Do not alter the files. Prompt reporting may be important when law enforcement needs to seek preservation of platform or telecommunications records.

Common mistakes to avoid

Uninstalling the app or deleting chats before preserving evidence.
Filing only against the app’s nickname without identifying the legal lender or collection agency.
Submitting cropped screenshots that omit the sender, date, time, URL, or context.
Filing an NPC complaint without first sending the required written notice—or without explaining and proving why the requirement should be waived.
Treating a character reference as if that person automatically guaranteed the debt.
Assuming that all data processing is illegal merely because the borrower withdrew consent. Some records may still be retained under another lawful basis or for legal and regulatory obligations.
Assuming that an SEC or NPC complaint cancels the loan.
Paying an unverified collector or personal e-wallet to make the harassment stop.
Secretly recording a private call without considering the Anti-Wiretapping Act.
Publicly posting a collector’s private data in retaliation. Preserve and report the evidence through proper channels instead.
Ignoring a genuine court summons, subpoena, or prosecutor’s notice because earlier collection threats were fake. Verify the document directly with the issuing office and obtain legal help promptly.

When legal help is urgent

Consult a lawyer promptly if:

Intimate, sexualized, or fabricated images have been published or threatened.
The collector threatens physical harm, arrest, deportation, job loss, or harm to a child.
Someone has taken over an account, used your identity, or opened a loan in your name.
The harassment has reached your home, school, or workplace.
A large amount, several lenders, or disputed payments are involved.
You receive an authentic summons, subpoena, complaint, or demand requiring a response by a stated deadline.
You need an urgent NPC cease-and-desist order, temporary ban on processing, damages, or criminal prosecution.

Qualified indigent applicants may seek assistance from the Public Attorney’s Office. The Integrated Bar of the Philippines National Center for Legal Aid is another possible source of legal assistance.

Frequently asked questions

Can a lending app call everyone in my contacts?

No. Broad contact-list access does not authorize collection from everyone in the list. SEC rules prohibit contacting people in the borrower’s contacts other than named guarantors or co-makers. NPC rules likewise prohibit unbridled contact-list processing and debt collection outside the guarantors provided by the borrower.

Can they contact my character reference?

Limited processing may be allowed when you personally selected the person as a character reference. But a reference is not automatically a guarantor, is not responsible for your debt, and should not be subjected to debt collection, harassment, or unnecessary disclosure.

Can they post my name, photo, ID, or loan details online?

Using or publishing those materials to shame or embarrass you is generally prohibited. A different result may apply to a disclosure specifically required or authorized by law, a court, or a regulator, but that is not a license for public humiliation.

I allowed access to my contacts and photos. Did I waive my rights?

No. Permission and consent must still be informed, specific, necessary, and proportionate. Data cannot lawfully be repurposed for harassment or public shaming merely because you tapped “Allow.”

Can I be arrested simply because I missed a loan payment?

The Constitution states that no person may be imprisoned for debt. Ordinary nonpayment is not, by itself, a basis for imprisonment. Separate conduct—such as alleged fraud or the issuance of a bouncing check—may raise different legal questions and requires its own elements and due process. See Article III, Section 20 of the 1987 Constitution.

Does reporting harassment mean I can stop paying?

Not automatically. Keep the harassment complaint separate from the accounting of the loan. Ask for a verified statement of account, dispute unauthorized charges in writing, and pay only through an official, traceable channel if payment is due.

Can I complain if the app or lender is unregistered?

Yes. Tell the SEC that the legal operator is unknown or appears unauthorized, then provide the app link, developer name, payment accounts, phone numbers, advertisements, loan documents, and all other identifying information.

Can my relative or employer file their own complaint?

Potentially, yes. If their own personal data was collected or used, or they personally received unlawful disclosures or harassment, they may be affected data subjects or direct witnesses. They should retain the original messages and obtain advice on filing separately or joining a complaint.

Official legal sources

This article provides general Philippine legal information, not legal advice or a prediction of any case’s outcome. Rights, procedures, and the proper respondent depend on the loan documents and evidence. Official sources and filing channels were checked as of 4 August 2026.