I. Introduction

Online apps collect personal data every day. A person may download a shopping app, lending app, e-wallet, delivery app, social media app, dating app, job platform, ride-hailing app, game, health app, school portal, productivity tool, or subscription service and be asked to provide name, mobile number, email address, address, government ID, selfie, birthday, contacts, location, photos, payment information, employment details, and device data.

At first, the data may be collected for account creation, verification, service delivery, payment, security, or customer support. But later, the user may want the app to delete the data because the account is no longer used, the app is suspicious, the user received spam, the service ended, the user withdrew consent, the data is outdated, the app was hacked, or the company is using the data in a way the user did not expect.

In the Philippines, personal data is protected under the Data Privacy Act of 2012, its implementing rules, and issuances of the National Privacy Commission. A user, called a data subject, has rights over personal data. One of the most important rights is the ability to ask that personal data be corrected, blocked, removed, or destroyed in proper cases.

This article explains how a person in the Philippines may request deletion of personal data from an online app, what rights apply, when deletion may be granted, when the app may legally refuse immediate deletion, how to write a request, what evidence to keep, and what remedies are available if the app ignores or denies the request.

II. What Is Personal Data?

Personal data is information that identifies or can identify a person.

Examples include:

Full name;
Address;
Mobile number;
Email address;
Birthday;
Age;
Sex;
Civil status;
Government ID number;
Passport details;
Driver’s license details;
Tax identification number;
SSS, GSIS, PhilHealth, or Pag-IBIG number;
Selfie or facial image;
Photograph;
Signature;
Voice recording;
Video recording;
Location data;
Device ID;
IP address;
Account username;
Payment details;
Bank or e-wallet information;
Employment details;
School records;
Health information;
App usage history;
Contact list;
Chat messages;
Transaction records;
Uploaded files.

Personal data may be ordinary personal information, sensitive personal information, or privileged information. Sensitive personal information receives stronger protection.

III. Sensitive Personal Information

Sensitive personal information includes data that may expose a person to serious risk if misused.

Examples include:

Race or ethnic origin;
Marital status;
Age;
Color;
Religious, philosophical, or political affiliation;
Health information;
Education records;
Genetic or sexual life information;
Court proceedings;
Government-issued identification numbers;
Social security numbers;
Licenses and permits;
Tax returns;
Financial account details where covered by privacy rules.

Many online apps collect sensitive data, especially lending apps, e-wallets, finance apps, job platforms, health apps, insurance apps, and identity verification systems.

A deletion request involving sensitive personal information should be treated seriously because misuse can lead to identity theft, harassment, discrimination, financial loss, or reputational damage.

IV. The Data Subject

The person whose personal data is collected is called the data subject.

A data subject has rights under Philippine privacy law, including the right to:

Be informed;
Object;
Access;
Rectify or correct;
Erase or block in proper cases;
Be indemnified for damages where applicable;
Data portability in proper cases;
File a complaint with the National Privacy Commission.

A user asking an app to delete personal data is exercising privacy rights as a data subject.

V. The Personal Information Controller and Processor

An online app may involve a personal information controller and a personal information processor.

A. Personal Information Controller

The personal information controller determines why and how personal data is processed. In practical terms, this is usually the company operating the app, platform, website, or service.

Examples:

Lending company operating an online loan app;
E-wallet provider operating a payment app;
Delivery platform collecting customer addresses;
Dating app operator collecting profiles and photos;
Marketplace app collecting seller and buyer details;
Health app operator collecting medical information;
School portal operator collecting student records.

B. Personal Information Processor

The personal information processor processes data on behalf of the controller. Examples include cloud hosting providers, customer support vendors, payment processors, verification vendors, analytics providers, marketing vendors, and outsourced collection agencies.

A user usually sends the deletion request to the controller, not merely the processor.

VI. What Does “Delete Personal Data” Mean?

In privacy practice, deletion may mean different things depending on the situation.

It may include:

Deleting the user account;
Removing personal information from active systems;
Blocking further processing;
Destroying stored personal data;
Removing uploaded IDs, selfies, or documents;
Removing profile photos;
Deleting contact list data;
Deleting marketing records;
Deleting location history;
Removing data from public view;
Deleting personal data from backups where technically feasible;
Anonymizing data so the person can no longer be identified;
De-linking data from the account;
Stopping further sharing with third parties;
Notifying processors to delete or stop processing data.

A request should be specific about what the user wants deleted.

VII. Right to Erasure or Blocking

Under Philippine data privacy principles, a data subject may demand the suspension, withdrawal, blocking, removal, or destruction of personal data in proper circumstances.

This right is often called the right to erasure, deletion, blocking, or removal.

A deletion request may be proper when:

The data is incomplete, outdated, false, or unlawfully obtained;
The data is being used for an unauthorized purpose;
The data is no longer necessary for the purpose for which it was collected;
The user withdraws consent and there is no other legal basis for processing;
The app unlawfully disclosed the data;
The data is being used for harassment or profiling beyond the disclosed purpose;
The app violates the user’s privacy rights;
The data subject objects to processing and there is no overriding lawful basis;
The app no longer provides the service to the user;
The retention period has expired;
The account has been closed;
The app’s processing is excessive or disproportionate.

The right to deletion is powerful but not absolute.

VIII. Deletion Is Not Always Immediate or Absolute

An online app may sometimes refuse or delay deletion if it has a lawful basis to retain certain data.

Possible lawful reasons for retention include:

Compliance with law;
Tax, accounting, audit, or regulatory requirements;
Anti-money laundering obligations;
Fraud prevention;
Legal claims or dispute resolution;
Contract enforcement;
Consumer complaint records;
Transaction history needed for warranties or refunds;
Security logs needed to investigate abuse;
Court order or lawful government request;
Records required by a regulator;
Legitimate business records within lawful retention periods.

For example, an e-wallet or finance app may not be able to delete all transaction and identity verification records immediately because financial regulations may require retention. A lending app may retain records of an unpaid loan. A shopping app may retain invoice and tax records for a period. A health app may be subject to health record rules.

However, even when full deletion is not possible, the app should explain what data must be retained, why it must be retained, how long it will be retained, and what data can be deleted or blocked immediately.

IX. Difference Between Account Deletion and Data Deletion

Deleting an app from a phone is not the same as deleting personal data.

Also, deleting an account is not always the same as deleting all data.

A. Deleting the App

If the user uninstalls the app, data may remain in the company’s servers.

B. Deleting the Account

Account deletion may remove login access and public profile, but the company may retain backend records.

C. Deleting Personal Data

Data deletion targets the actual personal information held by the company, subject to lawful retention.

Users should not assume that uninstalling the app deletes their data.

X. When Should a User Request Deletion?

A user may request deletion when:

The user no longer uses the app;
The account was created by mistake;
The app is suspicious;
The user receives spam or unauthorized marketing;
The user wants to withdraw consent;
The app accessed contacts unnecessarily;
The app posted or shared personal information;
The user’s loan, subscription, or transaction has ended;
The user uploaded government IDs and wants them removed;
The user suspects identity theft;
The app has no account deletion option;
The app ignores privacy requests;
The app refuses to remove outdated or wrong information;
The user wants to stop profiling or targeted advertising;
The user wants to prevent future misuse.

The request should be made in writing so there is proof.

XI. Before Sending a Deletion Request

Before requesting deletion, the user should secure evidence and records.

This is important because deletion may remove information needed for complaints, refunds, disputes, warranties, or claims.

Before deletion, save:

Account screenshots;
Profile details;
Uploaded documents list;
Transaction history;
Receipts;
Payment confirmations;
Chat support records;
Privacy policy;
Terms and conditions;
App permissions;
Marketing messages;
Proof of harassment, if any;
Screenshots of data misuse;
Company name and contact details;
Data protection officer contact details;
Ticket numbers or complaint references.

A user should not destroy evidence before filing a privacy complaint if the app has violated privacy rights.

XII. Step 1: Identify the App Operator

The user should identify the company responsible for the app.

Check:

App name;
Developer name in app store;
Company name in terms and conditions;
Company name in privacy policy;
Website;
Customer service email;
Data protection officer email;
Office address;
Business registration details, if available;
In-app help center;
Email confirmation messages;
Payment receipt details;
SMS sender name;
Social media pages.

Many apps use brand names different from registered company names. The request should include both app name and company name if known.

XIII. Step 2: Review the Privacy Policy

The privacy policy should explain:

What personal data is collected;
Purposes of processing;
Legal basis for processing;
Whether data is shared with third parties;
Data retention period;
Data subject rights;
Contact details of the data protection officer;
How to request deletion;
Security measures;
Complaint procedure.

If the privacy policy has no deletion process or data protection officer contact, that fact may be relevant in a complaint.

XIV. Step 3: Use In-App Deletion Tools

Some apps have account deletion features.

Common locations:

Settings;
Account;
Privacy;
Security;
Help center;
Data and privacy;
Manage account;
Delete account;
Close account;
Request data deletion.

If an in-app deletion request is available, take screenshots before and after submitting. Save confirmation messages or ticket numbers.

If the in-app tool is incomplete or unclear, send a written request by email as well.

XV. Step 4: Send a Written Data Deletion Request

A written request should be sent to the company, customer support, and data protection officer if available.

The request should clearly state:

Full name;
Registered email or mobile number;
App account username or ID;
Request to delete, block, or remove personal data;
Specific data to be deleted;
Withdrawal of consent, where applicable;
Objection to further processing, where applicable;
Request to stop sharing with third parties;
Request for confirmation;
Request for explanation if deletion is refused;
Deadline for response;
Attachments proving identity, if necessary.

Do not send more sensitive documents than necessary. If identity verification is required, provide the minimum needed.

XVI. Sample Basic Data Deletion Request

Subject: Request for Deletion of Personal Data Under the Data Privacy Act

Date: [Insert Date]

To: The Data Protection Officer / Privacy Team [Company or App Name]

Dear Sir/Madam:

I am a user of [app name] with registered mobile number/email [insert] and account name/user ID [insert, if any].

I am requesting the deletion, blocking, removal, or destruction of my personal data processed in connection with my account, subject to any lawful retention requirements.

This request covers, where applicable:

My account profile;
Name, mobile number, email address, and address;
Uploaded government IDs, selfies, photos, and documents;
Contact list data, if collected;
Location data;
Device data;
Marketing and profiling data;
Any personal data shared with third-party processors, collectors, advertisers, or service providers.

I withdraw my consent to further processing where consent is the basis for processing, and I object to any further use of my personal data for marketing, profiling, harassment, or purposes unrelated to the service.

Please confirm in writing:

What data has been deleted or blocked;
What data, if any, must be retained;
The legal basis and retention period for any retained data;
The third parties to whom my data was disclosed;
The steps taken to notify processors or third parties to delete or stop processing my data.

Please treat this as a formal exercise of my rights as a data subject.

Sincerely, [Name] [Contact Details]

XVII. Sample Request for Online Lending App Data Deletion

Subject: Request to Delete Personal Data and Stop Third-Party Contact

Date: [Insert Date]

To: The Data Protection Officer / Privacy Team [Online Lending App / Company Name]

Dear Sir/Madam:

I am a user/borrower of [app name] with registered mobile number [insert] and account ID [insert, if any].

I request the deletion, blocking, or removal of my personal data that is no longer necessary or lawfully retained, including any excessive data collected through the app.

This request includes:

Phone contacts collected from my device;
Photos, selfies, IDs, and uploaded documents;
Employer, workplace, and reference information;
Device, location, and app permission data;
Marketing and profiling data;
Any personal data disclosed to third-party collectors or service providers.

I specifically object to the use of my personal data and phone contacts for collection harassment, public shaming, third-party disclosure, or any purpose not lawfully disclosed and justified.

Please confirm:

Whether my phone contacts were accessed or stored;
Whether my data was shared with any collection agency or third party;
What data has been deleted or blocked;
What data you claim must be retained, the legal basis for retention, and the retention period;
What steps you have taken to stop collectors or third parties from processing my personal data unlawfully.

This request is without prejudice to my right to file a complaint with the National Privacy Commission and other proper agencies.

Sincerely, [Name] [Contact Details]

XVIII. Sample Account Closure and Deletion Request

Subject: Account Closure and Personal Data Deletion Request

Dear [Company/App Name]:

Please close my account under registered email/mobile number [insert] and delete or block my personal data, subject only to lawful retention requirements.

I no longer use the app and withdraw consent for further processing where consent is the basis for processing.

Please confirm when the account has been closed and identify any personal data retained, the reason for retention, and the retention period.

Thank you.

[Name]

XIX. Step 5: Ask What Data Cannot Be Deleted Yet

If the company says it cannot delete all data, ask for a written explanation.

A proper response should identify:

Specific data retained;
Legal basis for retention;
Purpose of retention;
Retention period;
Who can access the retained data;
Whether the data will be blocked from further use;
Whether it will be deleted after the retention period;
Whether third-party processors were instructed to delete or block data.

A vague response such as “we retain data for business purposes” may be insufficient if it does not explain lawful basis and necessity.

XX. Step 6: Request Blocking Instead of Full Deletion

If full deletion cannot be done immediately, the user may request blocking or restriction.

Blocking means the company stops actively using the data except for lawful retention purposes.

For example:

The company may retain transaction records for legal compliance;
But it should stop marketing to the user;
It should stop sharing data with advertisers;
It should stop collection harassment;
It should stop public disclosure;
It should restrict access internally;
It should delete unnecessary copies;
It should mark the account as closed.

Blocking is useful when the company claims it must retain some records but has no reason to keep using them actively.

XXI. Step 7: Request Deletion From Third Parties

Apps often share data with third parties. The deletion request should include processors and partners.

Third parties may include:

Cloud service providers;
Identity verification vendors;
Payment processors;
Analytics providers;
Marketing platforms;
Customer support vendors;
Collection agencies;
Delivery partners;
Advertising networks;
Fraud detection vendors;
Affiliates;
Data brokers, where involved.

The controller should take steps to ensure processors stop processing data or delete data where required.

XXII. Step 8: Keep Proof of the Request

Keep:

Sent email;
Delivery receipt;
Ticket number;
Chat support transcript;
Screenshots of in-app request;
Company response;
Date and time sent;
Follow-up messages;
Proof of identity submitted;
Any refusal or explanation.

If the company ignores the request, these records will support a complaint.

XXIII. What If the App Ignores the Request?

If the app does not respond, the user may send a follow-up.

A follow-up may say:

Subject: Follow-Up on Data Deletion Request

Dear [Company/App Name]:

I sent a request for deletion/blocking of my personal data on [date]. I have not received a proper response.

Please act on my request and confirm what data has been deleted, blocked, retained, or shared with third parties.

If I do not receive a proper response, I reserve the right to file a complaint with the National Privacy Commission and other appropriate agencies.

Sincerely, [Name]

If the company continues to ignore the request, the user may escalate.

XXIV. Filing a Complaint With the National Privacy Commission

If an app refuses, ignores, or mishandles a deletion request, the user may file a complaint with the National Privacy Commission.

A complaint may be appropriate when:

The app refuses deletion without lawful basis;
The app ignores data subject requests;
The app collected excessive data;
The app accessed contacts without proper basis;
The app disclosed data to third parties;
The app posted personal data;
The app used data for harassment;
The app has no proper privacy contact;
The app continues processing after consent was withdrawn;
The app fails to explain retention;
The app refuses to correct false data;
The app suffered a breach and failed to respond properly.

XXV. What to Include in an NPC Complaint

Prepare:

Full name and contact details;
Name of app and company;
Account details;
Privacy policy screenshots;
Data collected;
Data deletion request;
Proof request was sent;
Company response or lack of response;
Evidence of misuse or unlawful processing;
Screenshots of third-party disclosures;
Evidence of harassment, if any;
Harm suffered;
Relief requested.

The complaint should be clear and chronological.

XXVI. Possible Relief From a Privacy Complaint

The user may ask for:

Deletion of unlawfully processed personal data;
Blocking of personal data;
Cessation of processing;
Removal of public posts;
Correction of inaccurate data;
Disclosure of third-party recipients;
Action against the company for privacy violations;
Direction to improve privacy practices;
Indemnification where damages are proven and legally available;
Other appropriate relief.

The requested relief should match the violation.

XXVII. Sample NPC Complaint Narrative

“I created an account with [app name] using mobile number [number] and email [email]. The app collected my name, phone number, government ID, selfie, address, and contact list. On [date], I requested deletion of my personal data and withdrawal of consent. I sent the request to [email/address]. The company did not respond / refused without explanation / continued using my data. On [date], the app or its representatives contacted my phone contacts and disclosed my personal information. Screenshots are attached. I request investigation, deletion or blocking of unlawfully processed data, cessation of third-party disclosure, and other appropriate relief.”

XXVIII. Apps With No Deletion Button

Some apps do not have a deletion button. That does not mean the user has no rights.

The user may still send a written request through:

Customer support email;
Data protection officer email;
Website contact form;
In-app support chat;
Registered business email;
Official social media page;
Physical office address;
App store developer contact;
Privacy policy contact details.

If there is no available privacy contact, document that fact. It may support a complaint.

XXIX. Apps That Are Already Deleted From the App Store

An app may disappear from the app store, but the company may still hold personal data.

The user should try to identify:

Developer name;
Company name from old emails;
Loan agreement or receipts;
SMS sender names;
Payment account names;
Customer service email;
Website;
Privacy policy saved online;
Screenshots from the app;
Social media pages.

If the operator cannot be located and the data is being misused, the user may file a complaint using all available identifying details.

XXX. Deleting Data From Social Media Apps

Social media apps may retain personal data, posts, messages, photos, comments, ad profile data, and login records.

A deletion request may include:

Account deletion;
Removal of photos;
Deletion of posts;
Removal of phone number and email;
Deletion of search history;
Deletion of ad preferences;
Deletion of uploaded contacts;
Removal from public search;
Deactivation of tracking or profiling;
Download of data before deletion.

Users should distinguish between deactivation and permanent deletion. Deactivation may only hide the account temporarily.

XXXI. Deleting Data From E-Wallets and Finance Apps

E-wallets and finance apps often have legal obligations to verify identity and retain transaction records. Full deletion may not be immediate.

However, users may request:

Account closure;
Deactivation of marketing;
Deletion of unnecessary data;
Blocking of data not required for compliance;
Removal of saved cards;
Deletion of device access records where no longer needed;
Restriction of data sharing;
Explanation of retention period.

The company may retain certain records for anti-fraud, regulatory, tax, audit, or legal compliance.

XXXII. Deleting Data From Lending Apps

Lending apps may retain data if there is an outstanding loan, dispute, regulatory requirement, or lawful claim.

But they should not retain or use excessive data for harassment.

Users may request:

Deletion of contact list data;
Deletion of unnecessary photos or files;
Removal of data shared with collectors;
Blocking of marketing;
Correction of inaccurate loan records;
Deletion after full payment and required retention period;
Confirmation that no third-party contact will occur;
Statement of account;
Identification of third-party collectors.

If the app contacts unrelated persons, the user may file privacy and regulatory complaints.

XXXIII. Deleting Data From Shopping and Delivery Apps

Shopping and delivery apps may retain order history, receipts, and delivery records for legitimate purposes. But users may request deletion or restriction of:

Saved addresses;
Saved payment methods;
Profile photos;
Marketing preferences;
Search history;
Wishlist data;
Chat records no longer needed;
Location permissions;
Device identifiers;
Inactive account data.

The user should remove saved cards and addresses through the app, then send a deletion request for backend data.

XXXIV. Deleting Data From Dating Apps

Dating apps often collect sensitive profile data, photos, location, sexual preferences, messages, and identity verification data.

Users may request:

Permanent deletion of profile;
Removal of photos;
Deletion of messages where possible;
Deletion of location data;
Removal from matching systems;
Deletion of identity verification data where no longer needed;
Blocking of marketing;
Deletion of behavioral profiling data.

Simply deleting the app from the phone may not delete the dating profile.

XXXV. Deleting Data From Health Apps

Health apps may collect sensitive health data. Deletion may be limited by medical record or legal retention requirements.

Users may request:

Account closure;
Deletion of wellness data;
Deletion of uploaded documents;
Restriction of data sharing;
Correction of inaccurate health data;
Copy of data before deletion;
Explanation of required retention.

Because health data is sensitive, privacy and security obligations are stricter.

XXXVI. Deleting Children’s Data

Children’s personal data requires special care. Parents or legal guardians may request deletion when an app collected a child’s data without proper authority or continues processing unnecessary data.

Requests may involve:

Child’s name;
Photos;
School data;
Location;
Game account data;
Chat data;
Learning app records;
Health data;
Parent contact details.

The requester should state their authority as parent or guardian and provide minimal proof where necessary.

XXXVII. Withdrawing Consent

A user may withdraw consent when consent is the basis for processing.

Withdrawal of consent may affect:

Marketing messages;
Promotional emails;
Profiling;
Sharing with advertisers;
Access to contacts;
Optional data collection;
Location tracking;
Personalized recommendations;
Public visibility settings.

However, withdrawal of consent does not automatically erase data if the app has another lawful basis to retain it, such as legal compliance or contract obligations.

XXXVIII. Objecting to Processing

A user may object to processing in proper cases, especially when data is used for direct marketing, profiling, excessive tracking, harassment, or purposes beyond what was disclosed.

The objection should state:

What processing is objected to;
Why it is unlawful, excessive, or no longer necessary;
What action is requested;
Whether deletion, blocking, or correction is requested.

XXXIX. Correcting Data Before Deletion

Sometimes deletion is not the best first remedy. If the app holds wrong information, the user may request correction.

Examples:

Wrong name;
Wrong birthday;
Wrong loan status;
Wrong payment record;
Wrong employer;
Wrong address;
Wrong account linked to user;
False fraud tag;
Incorrect blacklist entry;
Wrong ID document.

Correction matters because wrong data may affect credit, access to services, employment, or reputation.

XL. Downloading Data Before Deletion

Before deleting an account, the user may request a copy of their data.

This is useful for:

Payment disputes;
Consumer complaints;
Loan disputes;
Identity theft investigation;
Proof of transactions;
Warranty claims;
Tax or accounting needs;
Evidence of harassment;
Knowing what data was collected.

After deletion, access may become harder.

XLI. Marketing Opt-Out vs. Deletion

Unsubscribing from marketing is not the same as deleting personal data.

A user may request both:

Stop marketing messages;
Delete marketing profile;
Remove from mailing list;
Stop SMS promotions;
Stop push notifications;
Stop sharing data with advertisers;
Delete account data where applicable.

An app may retain a suppression list containing minimal contact information to ensure the user is not marketed to again. This should be limited and explained.

XLII. Data Retention Periods

Apps should not keep personal data forever without lawful reason. Retention should be tied to purpose.

Common retention reasons include:

Active account;
Contract performance;
Transaction records;
Legal compliance;
Fraud prevention;
Dispute resolution;
Regulatory audit;
Security logs;
Tax records;
Consumer complaint handling.

After the retention period, data should be deleted, anonymized, or securely destroyed.

Users may ask for the retention period in writing.

XLIII. Anonymization as an Alternative

Sometimes an app may anonymize data instead of deleting it. Anonymization means the data can no longer identify the user.

For example, a company may keep aggregated statistics such as:

Number of users by city;
Average transaction value;
App usage trends;
Fraud risk statistics;
Service performance analytics.

If data is truly anonymized, it is no longer personal data. But if the company can still re-identify the user, it is not truly anonymized.

XLIV. Backups and Archived Data

Companies may claim that personal data cannot be immediately deleted from backups. This may be technically true in some systems.

But the company should explain:

Whether the data is in backups;
Whether backups are isolated from active use;
How long backups are retained;
When the data will be overwritten or deleted;
Whether restored backups will respect the deletion request;
Who can access archived data.

Backup retention should not be used as an excuse for continued active processing.

XLV. Deletion of Public Posts and Search Results

If an app or platform made personal data public, deletion may require more than account closure.

The user may request:

Removal of public post;
De-indexing from search;
Deletion of cached copies where possible;
Removal from group pages;
Removal of tagged photos;
Removal of public comments;
Removal of profile from public search;
Notice to third parties who received data.

If the data was copied by others, the original app may not control all copies, but it should remove what it controls and take reasonable steps where applicable.

XLVI. Identity Verification for Deletion Requests

Apps may ask the requester to verify identity before deleting data. This is reasonable because the company must avoid deleting the wrong person’s account.

However, verification should be proportionate.

The app should not demand excessive new personal data if it already has sufficient means to verify the user.

Good verification methods include:

Confirmation through registered email;
OTP to registered mobile number;
In-app authenticated request;
Partial ID confirmation;
Account security questions;
Minimal document verification where necessary.

If the app demands a new government ID for a simple deletion request without clear reason, the user may ask why it is necessary.

XLVII. Authorized Representatives

A data subject may act through an authorized representative in proper cases.

This may apply when the user is:

A minor;
Elderly;
Ill;
Deceased, with heirs or legal representatives acting for estate matters;
Abroad;
Unable to access the account;
Represented by counsel.

The app may require authorization documents, such as:

Authorization letter;
Valid ID of data subject;
Valid ID of representative;
Proof of relationship;
Special power of attorney, where appropriate;
Guardianship documents, where applicable.

The app should request only what is necessary.

XLVIII. Deleting Data of a Deceased Person

Family members may want to delete or memorialize accounts of a deceased person.

Requirements may include:

Death certificate;
Proof of relationship;
Proof of authority;
Account details;
Specific request for deletion, memorialization, or data access;
Legal documents if estate issues are involved.

Data of deceased persons may still involve privacy, dignity, fraud prevention, and estate concerns. Apps may have special processes for deceased users.

XLIX. If the App Says the Data Belongs to the Company

An app may say user data is part of its business records. This may be partly true for transaction records, but personal data rights still apply.

A company may own its database system, software, and business records, but it does not mean it can freely misuse personal data. Personal data must still be processed lawfully.

The user may still ask for deletion, blocking, correction, restriction, or explanation of retention.

L. If the App Says Consent Cannot Be Withdrawn

Consent may generally be withdrawn when consent is the legal basis for processing. But withdrawal may not affect processing based on other lawful grounds.

A proper company response should distinguish:

Data processed based on consent;
Data processed based on contract;
Data retained for legal compliance;
Data retained for legal claims;
Data processed based on legitimate interest, where applicable.

A blanket statement that consent can never be withdrawn is questionable.

LI. If the App Says “We Need It for Legal Purposes”

The user should ask for specifics.

The app should explain:

What law or obligation requires retention;
What exact data must be retained;
How long it must be retained;
Whether the data will be blocked from other uses;
Whether unnecessary data can be deleted;
Whether third-party sharing will stop;
Whether marketing and profiling will stop.

Legal retention does not justify unrelated processing.

LII. If the App Continues Marketing After Deletion Request

Continued marketing after opt-out or deletion request may indicate improper processing.

The user should:

Screenshot marketing messages;
Save sender number or email;
Send a follow-up objection;
Ask to be removed from marketing lists;
File a complaint if it continues.

Marketing should stop when the user validly objects, subject to reasonable processing time.

LIII. If the App Shares Data With Collectors

If a lending, subscription, or service app shares data with collectors, the user may ask:

Who are the collectors?
What data was shared?
What is their authority?
What is the purpose?
Are they processors or independent controllers?
Are they allowed to contact third parties?
How will the company stop abusive processing?
Will data be deleted after collection ends?
What safeguards exist?

The company remains responsible for lawful data handling, especially if collectors process data on its behalf.

LIV. If the App Is Abroad

Many apps are operated by foreign companies. Philippine data privacy law may still be relevant if the app processes personal data of individuals in the Philippines or has sufficient Philippine connection.

Practical enforcement may be harder, but the user can still:

Use the app’s privacy request process;
Contact the data protection officer;
File a complaint where applicable;
Report the app to app stores;
Report abuse to payment channels;
Stop using the app;
Revoke permissions;
Secure accounts.

For foreign apps, also check whether the app offers privacy rights under its own jurisdictional policy.

LV. Reporting to App Stores

If an app refuses deletion or abuses data, the user may report the app to the app store.

Possible grounds:

Privacy violation;
Unauthorized contact access;
Harassment;
Deceptive lending;
Fake financial services;
Misuse of personal data;
Scam behavior;
Lack of deletion mechanism;
Abusive permissions.

App store reporting does not replace legal complaint, but it may help prevent further harm.

LVI. Data Breach Concerns

If the user’s data was leaked, hacked, exposed, or accessed by unauthorized persons, the issue may involve a personal data breach.

Signs include:

Sudden spam after using the app;
Unknown loan applications;
Identity theft;
Unauthorized account access;
Public exposure of user data;
Messages from strangers with private information;
Data being sold or shared;
Unauthorized transactions.

The user should ask the app whether a breach occurred and what measures were taken.

LVII. Deletion After Data Breach

After a breach, a user may request deletion or blocking of unnecessary data. However, the company may need to retain some records to investigate the breach, comply with law, or address claims.

The company should still secure the data, restrict access, and delete what is no longer needed.

LVIII. Security Steps While Waiting for Deletion

The user should protect themselves while waiting for the app to act.

Practical steps:

Revoke app permissions;
Uninstall app after saving evidence;
Change passwords;
Enable two-factor authentication;
Remove saved cards;
Monitor bank and e-wallet accounts;
Check email security;
Watch for phishing;
Warn contacts if contact list was accessed;
Report suspicious transactions;
Keep evidence;
Avoid clicking links from unknown senders.

Deletion is not the only protection. Account security matters too.

LIX. Revoking App Permissions

On the phone, users may revoke permissions for:

Contacts;
Camera;
Microphone;
Photos;
Files;
Location;
SMS;
Call logs;
Notifications;
Background activity.

Revoking permission stops future access from the device but does not automatically delete data already uploaded to the company’s servers.

LX. Removing Saved Payment Methods

Before account deletion, remove:

Saved debit cards;
Saved credit cards;
Bank accounts;
E-wallet links;
Auto-debit authorizations;
Subscription payments;
Stored billing addresses.

Also check whether recurring subscriptions must be cancelled separately through the app store, bank, or payment provider.

LXI. Deleting Data From the Device

Aside from server-side deletion, the user may clear local data.

This may involve:

Logging out;
Clearing app cache;
Clearing app storage;
Deleting downloaded files;
Removing saved images;
Removing offline documents;
Deleting screenshots if no longer needed;
Removing browser cookies;
Clearing autofill information.

Keep evidence first if a complaint may be filed.

LXII. Minimize Future Data Collection

To reduce future risk:

Read app permissions before installing;
Avoid apps requiring unnecessary contact access;
Use separate email for apps;
Avoid uploading unnecessary IDs;
Do not save cards unless needed;
Use privacy settings;
Disable location access when not needed;
Avoid suspicious lending apps;
Check privacy policy;
Use official apps only;
Avoid logging in through social media if unnecessary;
Regularly delete unused accounts.

Prevention is easier than deletion.

LXIII. Common Mistakes by Users

Users often weaken their deletion request by:

Only uninstalling the app;
Not sending a written request;
Not identifying the account;
Deleting evidence before complaint;
Sending too many extra IDs;
Not saving ticket numbers;
Confusing deactivation with deletion;
Ignoring retained transaction records;
Not asking for third-party deletion;
Not following up;
Using emotional or threatening language;
Assuming all data must be deleted immediately.

A clear written request is stronger than repeated informal chats.

LXIV. Common Mistakes by Apps

Apps create privacy risk when they:

Have no deletion mechanism;
Ignore data subject requests;
Collect excessive permissions;
Hide privacy contacts;
Retain data indefinitely;
Fail to explain retention;
Share data with unknown third parties;
Use data for harassment;
Continue marketing after objection;
Refuse correction of false data;
Demand excessive verification;
Fail to delete data from processors;
Fail to secure uploaded IDs and selfies.

These practices may support complaints.

LXV. Checklist for a Strong Deletion Request

Before sending, prepare:

App name;
Company name;
Registered email;
Registered mobile number;
Account ID;
Screenshots of account;
Data to be deleted;
Reason for deletion;
Withdrawal of consent, if applicable;
Objection to processing, if applicable;
Request for third-party deletion;
Request for retention explanation;
Contact details for response;
Proof of identity, if necessary and minimal.

LXVI. Checklist Before Filing a Complaint

Prepare:

Copy of deletion request;
Proof of sending;
Company response or non-response;
Follow-up request;
Privacy policy;
Terms and conditions;
Screenshots of app permissions;
Evidence of data misuse;
Screenshots of continued processing;
Marketing messages after opt-out;
Public posts or disclosures;
Third-party messages;
Account screenshots;
Written timeline;
Harm suffered.

LXVII. Sample Timeline

Date	Event	Evidence
January 5	Created account with app	Account screenshot
January 6	Uploaded ID and selfie	App screenshot
February 1	Requested account deletion	Email copy
February 10	No response received	Follow-up email
February 15	App continued sending marketing SMS	SMS screenshot
February 20	App disclosed data to third party	Screenshot from recipient
February 22	Complaint prepared	Annexes

A timeline helps regulators understand the case.

LXVIII. Frequently Asked Questions

1. Does uninstalling the app delete my personal data?

No. Uninstalling only removes the app from your device. The company may still keep data in its servers.

2. Can I force an app to delete all my data immediately?

Not always. You may request deletion, but the app may retain certain data for lawful reasons such as legal compliance, transaction records, fraud prevention, or disputes. It should explain what it retains and why.

3. Can I withdraw consent?

Yes, where consent is the basis for processing. But some data may still be retained under other lawful bases.

4. Can I ask a lending app to delete my contacts?

Yes. Contact list data is often excessive and sensitive in effect. The app should explain whether it collected contacts and what it has done with them.

5. Can the app keep my data if I still owe money?

It may retain data necessary to enforce or manage the account, but it cannot use data for harassment, public shaming, or unlawful disclosure.

6. Can I ask for deletion of my government ID and selfie?

Yes. The app should delete them if they are no longer necessary, unless there is a lawful retention reason. If retained, the app should explain why and for how long.

7. What if the app ignores my deletion request?

Send a follow-up and preserve proof. If still ignored, consider filing a complaint with the National Privacy Commission.

8. What if the app has no data protection officer email?

Use available official channels and document the absence of a privacy contact. This may support a complaint.

9. Can I ask for deletion from third-party collectors?

Yes. The controller should address data shared with processors or collectors and take steps to stop unlawful processing.

10. Should I delete my evidence after the company deletes my account?

Keep evidence if there is a pending dispute, complaint, harassment issue, refund claim, or identity theft concern.

LXIX. Conclusion

Deleting personal data from an online app in the Philippines is not simply a technical account setting. It is a legal right connected to privacy, dignity, security, and control over personal information. Under the Data Privacy Act, a user may request deletion, blocking, removal, or destruction of personal data in proper cases, especially when the data is no longer needed, was unlawfully obtained, is being misused, or is processed beyond the purpose originally disclosed.

The first step is to identify the app operator and send a clear written request to the company or its data protection officer. The request should specify the account, the data to be deleted, withdrawal of consent where applicable, objection to further processing, deletion from third-party processors, and written confirmation. If the app cannot delete everything immediately, it should explain the legal basis, purpose, and retention period for any data retained.

Users should remember that uninstalling an app does not delete server-side data. Account deletion may not erase all backend records. Financial, lending, health, and transaction-based apps may lawfully retain some records, but they should not continue using personal data for marketing, harassment, excessive profiling, or unauthorized disclosure.

If an app ignores, refuses, or mishandles a deletion request, the user may escalate to the National Privacy Commission and other proper agencies depending on the facts. The strongest complaints are organized, evidence-based, and supported by screenshots, privacy requests, app permissions, company responses, and proof of data misuse.

Personal data should not live forever in an app simply because a user once clicked “agree.” In the Philippines, companies that collect personal data must also respect the user’s right to control, correct, block, and delete it when the law requires.