I. Introduction

Online lending apps often require borrowers or applicants to submit personal information before a loan is approved or released. This may include a mobile number, government ID, selfie, address, employment details, bank or e-wallet account, emergency contacts, device information, and sometimes access to phone contacts, photos, location, or other device data.

In the Philippines, a borrower or applicant is not powerless after submitting personal data to an online lending app. The Data Privacy Act of 2012, its implementing rules, and related issuances of the National Privacy Commission recognize rights of data subjects, including the right to be informed, object, access, correct, and in appropriate cases, block, remove, or destroy personal data.

However, deletion is not always automatic. A lending company may retain some information when retention is required by law, needed to establish or defend legal claims, necessary for legitimate business records, or required by financial, tax, anti-money laundering, audit, consumer protection, or regulatory obligations. The correct remedy is therefore not simply “delete everything immediately,” but to make a proper data subject request requiring the app or lending company to delete data that it no longer has a lawful basis to retain, stop unlawful processing, withdraw unnecessary permissions, and cease disclosure or misuse.

This article explains how to delete personal data from an online lending app in the Philippine context, what rights apply, what documents to prepare, where to complain, and what to do if the lending app refuses or ignores the request.

II. What Personal Data Online Lending Apps Commonly Collect

Online lending apps may collect several categories of personal information.

A. Identity Data

This may include:

Full name;
Date of birth;
Place of birth;
Civil status;
Nationality;
Gender or sex;
Government-issued ID;
ID number;
Selfie or facial image;
Signature;
Tax identification number, if requested;
Other identity verification records.

B. Contact Data

This may include:

Mobile number;
Email address;
Home address;
Work address;
Social media account;
Emergency contact details;
Character reference details;
Family contact information.

C. Financial and Employment Data

This may include:

Employer name;
Job title;
Salary;
Payslip;
Bank account;
E-wallet account;
Loan history;
Credit score or internal risk profile;
Payment behavior;
Debt collection records;
Other lending app accounts.

D. Device and Technical Data

This may include:

Device ID;
IP address;
Location data;
App usage data;
Operating system details;
SIM-related information;
Advertising ID;
Installed app metadata;
Login and authentication logs.

E. Contacts, Photos, and Media

Some abusive lending apps have been reported to access or misuse:

Phone contacts;
Photos;
Videos;
Messages;
Call logs;
Social media contacts;
Stored documents.

Accessing or using this kind of information for harassment or public shaming can raise serious data privacy and cybercrime concerns.

III. Legal Basis: Data Privacy Rights in the Philippines

The Philippine Data Privacy Act gives individuals rights over their personal data. In the lending app setting, the user is the data subject, while the lending company, app operator, or financing company is typically a personal information controller or personal information processor, depending on its role.

The rights most relevant to deletion include:

Right to be informed;
Right to object;
Right to access;
Right to rectification;
Right to erasure or blocking;
Right to damages;
Right to file a complaint.

The right to erasure or blocking is sometimes called the right to deletion, removal, destruction, or suppression of data. It allows a data subject to require that personal data be removed or blocked under legally recognized circumstances.

IV. What “Deletion” Means

Deletion may mean different things depending on the data and system involved.

It may include:

Removing the user’s profile from the app;
Deleting uploaded IDs and selfies;
Removing contact list data;
Stopping use of personal data for marketing;
Deactivating or closing the account;
Deleting unnecessary loan application data;
Removing data from active databases;
Blocking access to data;
Destroying stored files;
Anonymizing data so it can no longer identify the user;
Stopping disclosure to collectors, affiliates, or third-party processors;
Removing unlawfully posted or shared personal information.

A company may not be able to erase every record if lawful retention applies, but it should stop processing data that is no longer necessary or lawful.

V. When a Borrower May Request Deletion

A user may request deletion or blocking of personal data when:

The loan application was abandoned or denied, and the app no longer needs the data;
The loan has been fully paid and retention is no longer necessary except for legally required records;
Consent is withdrawn for optional processing;
The app collected excessive personal data;
The app accessed contacts, photos, or files unrelated to lending;
The app used personal data for harassment or public shaming;
The app disclosed data to unauthorized persons;
The app sent messages to contacts without lawful basis;
The app continued marketing despite opt-out;
The data is outdated, false, or unlawfully obtained;
The lending company is unregistered or operating illegally;
The app has no privacy notice or fails to identify a legitimate controller;
The user wants account closure and deletion of unnecessary data;
The user is a victim of identity theft or fraudulent loan application.

VI. When the Lending App May Refuse Full Deletion

A lending app may lawfully refuse immediate full deletion if it has a valid legal basis to retain certain records.

Common reasons include:

The user has an outstanding loan;
Records are needed to collect a legitimate debt;
Records are needed for accounting and audit;
Records are required for tax compliance;
Records are needed for anti-fraud and identity verification;
Records are needed to comply with financial regulations;
Records must be retained under lending, financing, or corporate rules;
Records are needed to establish, exercise, or defend legal claims;
The company must preserve records due to a pending complaint, dispute, or investigation;
Retention is required by law or lawful order.

However, even when some retention is allowed, the app should not keep or use more data than necessary. For example, it may retain loan transaction records but should not continue accessing or using the borrower’s phone contacts for harassment.

VII. Deletion Versus Account Closure

Deleting personal data is not always the same as closing the app account.

A. Account Closure

Account closure means the user’s app account is deactivated or closed. The user may no longer access the app or borrow through it.

B. Data Deletion

Data deletion means personal data is removed, blocked, anonymized, or destroyed to the extent legally required.

A lending company may close the account but retain some records. Conversely, it may remove optional data while keeping the account open for payment records. A good request should ask for both account closure and deletion or blocking of unnecessary personal data.

VIII. Deletion Versus Withdrawal of Consent

A user may withdraw consent for processing that depends on consent. However, not all processing depends only on consent.

For lending, some processing may be based on:

Contract;
Compliance with law;
Legitimate interest;
Protection of legal claims;
Consent;
Other lawful criteria.

Withdrawing consent is strongest for optional processing, such as marketing, unnecessary device permissions, contact harvesting, promotional messages, or disclosure to affiliates. It may not erase records needed to document a loan contract or unpaid balance.

IX. Special Concern: Contact List Access

Contact list access is one of the most sensitive issues in online lending apps.

Some apps request permission to access contacts, then use those contacts to shame, threaten, or pressure borrowers. This may involve unlawful or excessive processing if the contacts were not necessary for the loan, if contacts did not consent, or if the data was used for harassment.

A deletion request should specifically demand:

Deletion of all uploaded or scraped phone contacts;
Cessation of messages or calls to contacts;
Disclosure of whether contact data was shared with collectors;
Identification of third parties that received contact data;
Written confirmation that contact data has been removed or blocked;
Preservation of evidence if harassment occurred.

Even if the borrower has an outstanding loan, contacting unrelated persons in an abusive, deceptive, or humiliating manner may raise legal issues.

X. Special Concern: Uploaded Government IDs and Selfies

Uploaded IDs and selfies may be misused for identity theft or fraudulent accounts.

A deletion request should ask the lending app to:

Delete unnecessary copies of IDs and selfies;
Stop using the ID for marketing or profiling;
Confirm whether the ID was shared with third parties;
Retain only what is legally required for loan, audit, or anti-fraud purposes;
Securely store any retained copy;
Block further unauthorized access;
Notify the user if a data breach occurred.

If the app is unregistered, fraudulent, or suspected of identity theft, the user should preserve evidence before deletion, because the data may be needed for complaints.

XI. Special Concern: Harassment and Public Shaming

Online lending harassment may include:

Threatening messages;
Calling family members or co-workers;
Posting the borrower’s photo online;
Sending defamatory messages to contacts;
Accusing the borrower of fraud or theft;
Threatening arrest;
Threatening to send edited photos;
Releasing private data;
Using obscene or abusive language;
Creating group chats to shame the borrower.

In such cases, deletion is only one remedy. The borrower may also consider complaints for data privacy violations, cyber-related offenses, unfair debt collection, harassment, or abusive lending practices.

Before requesting deletion, the borrower should preserve screenshots, call logs, names of collectors, phone numbers, app notices, and messages.

XII. Step One: Identify the Lending Company

Before making a deletion request, identify the real company behind the app.

Look for:

App name;
Lending company or financing company name;
SEC registration details, if shown;
Certificate of authority number, if shown;
Business address;
Customer service email;
Data protection officer contact;
Privacy policy;
Terms and conditions;
Developer name in app store;
Official website;
Collection agency name, if any;
Phone numbers and email addresses used.

If the app hides its identity or provides no privacy contact, that itself may be a compliance red flag.

XIII. Step Two: Secure Evidence Before Deleting the App

Do not immediately uninstall the app without preserving evidence, especially if there has been harassment or unauthorized data use.

Save:

Screenshots of app profile;
Screenshots of loan details;
Privacy policy;
Permissions requested by the app;
Uploaded documents;
Chat or SMS messages;
Call logs;
Collection notices;
Payment receipts;
Proof of full payment, if applicable;
Contacts who received messages;
App store listing;
Customer service replies;
Data deletion requests sent.

Uninstalling the app may remove useful evidence.

XIV. Step Three: Revoke App Permissions

Before or while making a deletion request, revoke unnecessary permissions on the device.

Common permissions to revoke:

Contacts;
Photos and videos;
Camera;
Microphone;
Location;
SMS;
Call logs;
Storage;
Nearby devices;
Background data access, if unnecessary.

Revoking permissions stops future access from the device, but it does not delete data already collected by the app. A separate deletion request is still needed.

XV. Step Four: Pay or Dispute Any Outstanding Loan

If there is an outstanding legitimate loan, the app may retain records needed for collection and legal documentation.

The borrower should determine:

Is the loan real and released?
How much was actually received?
What fees were deducted?
What is the due date?
What payments were made?
Are charges lawful and disclosed?
Is the app registered or authorized?
Is the debt disputed?
Are collectors using unlawful methods?
Has the loan been fully paid?

If the loan is fully paid, request a certificate of full payment or account closure confirmation. This strengthens the deletion request.

If the loan is disputed, request a statement of account and preserve evidence.

XVI. Step Five: Send a Written Data Deletion Request

The request should be in writing and sent to the lending company’s official customer service, data protection officer, or privacy contact.

Use email if possible. If only in-app support exists, take screenshots. If the company has a physical address, a written letter may also be sent.

The request should clearly state:

Full name;
Registered mobile number or account ID;
Email address used;
Specific data to be deleted;
Account closure request;
Withdrawal of consent for optional processing;
Request to stop contacting third parties;
Request to identify retained data and legal basis;
Request for written confirmation;
Deadline for response.

XVII. Sample Data Deletion Request

Subject: Request for Deletion, Blocking, and Cessation of Processing of Personal Data

To the Data Protection Officer / Privacy Office / Customer Support of [Name of Lending App or Company]:

I am [full name], registered with your app under mobile number [number] and/or email address [email].

I am exercising my rights as a data subject under Philippine data privacy law. I request the deletion, blocking, destruction, or anonymization of my personal data that is no longer necessary for any lawful purpose, including but not limited to uploaded IDs, selfies, contact list data, device data, photos, location data, marketing data, and other personal information collected through your app.

I also withdraw my consent to any optional processing, marketing, profiling, sharing with affiliates, access to my contacts, and disclosure to third parties not necessary for a lawful and legitimate purpose.

If you claim that any data must be retained, please identify the specific data retained, the legal basis for retention, the retention period, and the persons or entities with whom the data has been shared.

I further request that you stop contacting, messaging, or disclosing my personal information to my family, friends, employer, co-workers, phone contacts, or any third party, except where expressly authorized by law.

Please confirm in writing within a reasonable period that my request has been acted upon.

This request is made without prejudice to any complaint I may file before the National Privacy Commission, SEC, law enforcement, or other appropriate agency for any unlawful processing, harassment, unauthorized disclosure, or misuse of my personal data.

Sincerely,

[Name] [Mobile Number] [Email Address] [Date]

XVIII. Step Six: Request Information on Data Sharing

Deletion should include not only the app itself but also third parties that received the data.

Ask the lending company:

What personal data was collected?
What data came from device permissions?
Was the contact list uploaded?
Was data shared with collection agencies?
Was data shared with affiliates?
Was data shared with credit bureaus or databases?
Was data stored outside the Philippines?
What is the retention period?
What data was deleted?
What data was retained and why?

This is important because the lending app may have already shared the data with collectors or processors.

XIX. Step Seven: Demand Cessation of Third-Party Contact

If collectors are contacting the borrower’s contacts, include a specific demand.

I specifically demand that you and your agents, collectors, service providers, and representatives immediately stop calling, texting, messaging, or otherwise contacting my phone contacts, family members, employer, co-workers, references, or any third person for the purpose of collecting, shaming, threatening, or disclosing information about me or any alleged loan.

I further demand deletion or blocking of any phonebook, contact list, or third-party personal data obtained from my device or account, except where you can prove a lawful basis for retention and processing.

XX. Step Eight: Ask for Account Closure and Certificate of Full Payment

If the loan is fully paid, request proof.

Please confirm that my loan account is fully paid and closed. Kindly issue a certificate or written confirmation of full payment, account closure, and cessation of further collection activity.

Upon closure, please delete, block, anonymize, or destroy all personal data no longer necessary for lawful retention, and confirm the categories of data retained, if any.

A certificate of full payment helps prevent repeated collection, relending, or future misuse.

XXI. Step Nine: Follow Up and Set a Deadline

A reasonable follow-up period may be stated in the request. If the company ignores the request, the user should send a follow-up and preserve proof.

The follow-up should include:

Date of original request;
Copy of original request;
Reminder of data subject rights;
Demand for written response;
Notice that a complaint may be filed.

XXII. Sample Follow-Up Letter

Subject: Follow-Up on Data Deletion Request

To [Company/App]:

I refer to my data deletion and account closure request dated [date]. As of today, I have not received a complete written response.

Please act on my request and confirm what personal data has been deleted, blocked, anonymized, or retained, including the legal basis and retention period for any data you continue to keep.

If I do not receive a proper response, I will consider filing a complaint with the National Privacy Commission and other appropriate government agencies.

Sincerely,

[Name]

XXIII. Step Ten: File a Complaint if the App Refuses or Misuses Data

If the online lending app refuses deletion without lawful basis, ignores the request, continues harassment, or discloses data to contacts, the borrower may file complaints with appropriate agencies.

Possible complaint forums include:

National Privacy Commission;
Securities and Exchange Commission, for lending or financing company issues;
Bangko Sentral ng Pilipinas, if a BSP-supervised financial institution or payment provider is involved;
Philippine National Police Anti-Cybercrime Group;
National Bureau of Investigation Cybercrime Division;
Prosecutor’s office, if criminal acts are involved;
Courts, for damages or injunction in appropriate cases;
App store reporting channels;
Digital wallet or payment provider complaints, if payment abuse occurred.

The strongest privacy-related forum is usually the National Privacy Commission.

XXIV. Complaint Before the National Privacy Commission

A complaint may be filed when the lending app:

Collects excessive data;
Accesses contacts without lawful basis;
Discloses personal data to contacts;
Posts or threatens to post personal data;
Uses data for harassment;
Refuses to respond to a data subject request;
Retains data without lawful basis;
Fails to provide a privacy notice;
Shares data with unauthorized collectors;
Fails to secure personal data;
Uses false or misleading consent;
Processes data for purposes not disclosed.

The complaint should include evidence and a clear narrative.

XXV. Evidence for an NPC Complaint

Prepare:

Copy of data deletion request;
Proof the request was sent;
App privacy policy;
Screenshots of permissions requested;
Screenshots of account profile;
Screenshots of uploaded data, if visible;
Harassing messages;
Messages sent to contacts;
Affidavits or screenshots from contacts;
Call logs;
Full payment proof;
Statement of account;
App store listing;
Company identity or SEC details, if available;
Customer support replies or refusal;
Timeline of events.

The complaint should be organized and factual.

XXVI. Sample NPC Complaint Narrative

I am filing this complaint against [name of lending app/company] for unlawful processing, unauthorized disclosure, and refusal to delete or block my personal data.

On [date], I installed and registered with [app name] using mobile number [number]. The app required me to submit [IDs/selfie/employment details] and requested access to my contacts and other device data.

On [date], I requested deletion, blocking, and cessation of processing of my personal data, especially my contact list and uploaded documents. Despite my request, the company failed/refused to respond and continued to [state acts: contact my phone contacts, send threatening messages, disclose my alleged loan, use my photo, etc.].

Attached are screenshots of my request, proof of sending, messages from the app/collectors, screenshots from my contacts, payment proof, and the app’s privacy policy.

I respectfully request investigation and appropriate relief, including deletion or blocking of unlawfully processed data, cessation of unauthorized disclosure, and other remedies allowed by law.

XXVII. Complaint Before the SEC

The SEC regulates lending companies and financing companies. If the app is operated by a lending or financing company, or if it claims to be one, the SEC may be relevant.

Complaints may involve:

Unregistered lending operations;
Abusive debt collection;
Unfair lending practices;
False or misleading app identity;
Excessive or hidden charges;
Harassment;
Misuse of borrower data by online lending operators;
Operating despite revocation or suspension;
Failure to disclose terms;
Use of unauthorized collection practices.

A data deletion complaint may be paired with an SEC complaint if the app’s business practices are abusive or illegal.

XXVIII. Complaint to Law Enforcement

If the app or collectors threaten, extort, harass, defame, use obscene content, impersonate officials, or publish personal data online, law enforcement may be appropriate.

Possible criminal concerns include:

Grave threats;
Unjust vexation;
Coercion;
Cyber libel;
Identity theft;
Computer-related fraud;
Illegal access;
Data privacy offenses;
Other crimes depending on the facts.

Preserve all evidence before blocking or deleting messages.

XXIX. App Store Complaints

Users may also report the app to the platform where it is distributed.

An app store complaint may state:

The app collects excessive data;
It accesses contacts or media without proper need;
It harasses users;
It discloses borrower data;
It uses misleading identity;
It refuses deletion requests;
It engages in predatory lending.

This may help get the app reviewed or removed, but it is not a substitute for legal complaint.

XXX. Can the Borrower Demand Deletion While the Loan Is Unpaid?

Yes, but the request may be partially granted.

Even with an unpaid loan, the borrower may demand deletion or blocking of data that is unnecessary, excessive, unlawfully collected, or unlawfully used.

The lender may retain data needed for:

Loan contract;
Collection of legitimate debt;
Accounting;
Legal claims;
Regulatory compliance.

But the borrower can still object to:

Contact list misuse;
Public shaming;
Harassment;
Marketing;
Unnecessary profiling;
Disclosure to unrelated third parties;
Access to photos or media;
Collection methods violating privacy rights.

An unpaid loan does not give the lender unlimited authority over the borrower’s personal data.

XXXI. Can the Borrower Demand Deletion After Full Payment?

Yes. After full payment, the lender’s justification for active processing becomes weaker, although some records may still be retained for lawful periods.

The borrower may demand:

Account closure;
Certificate of full payment;
Deletion of unnecessary data;
Blocking of archived data;
End of collection activity;
Removal from marketing lists;
Deletion of contacts data;
Confirmation of retention period for any remaining data.

The lender may retain payment and contract records for legal, accounting, audit, and regulatory reasons, but it should not continue unnecessary or abusive processing.

XXXII. Can the App Keep Data for Credit Reporting?

A lender may report legitimate credit information to authorized credit reporting systems if legally allowed and properly disclosed. However, reporting must be accurate, fair, and lawful.

The borrower may request:

Copy of reported information;
Correction of inaccurate information;
Identification of recipients;
Basis for credit reporting;
Removal of unlawfully reported information.

If the lender reports false delinquency or continues reporting after full payment without basis, the borrower may seek correction.

XXXIII. Can the App Keep Screenshots of the Borrower’s ID?

It may retain identity verification records if there is a lawful basis, especially for an active or recently closed loan. However, retention should be limited, secure, and tied to legitimate purposes.

The borrower may demand deletion if:

No loan was released;
Application was rejected and retention is unnecessary;
Data was collected by an unregistered or fraudulent app;
Data is being used for harassment;
Retention period has expired;
The company cannot explain a lawful basis.

At minimum, the app should identify why it is keeping the ID, how long it will retain it, and how it protects it.

XXXIV. Can the App Keep the Borrower’s Contact List?

This is more doubtful and more sensitive. A lender may ask for references, but scraping an entire phonebook is often excessive relative to a loan transaction.

The borrower should specifically demand deletion of:

Uploaded phonebook;
Contact list;
Non-borrower third-party details;
Employer contacts not voluntarily provided;
Family contacts collected through device access;
Any contact information used for shaming or threats.

Third-party contacts are also data subjects. They did not necessarily consent to having their data collected by the lending app.

XXXV. Can the Borrower Ask the App to Delete Data From Collection Agencies?

Yes. The borrower should ask the lending company to instruct its collectors, agents, processors, and affiliates to delete or return personal data no longer needed or unlawfully obtained.

The request should include:

Name of collection agencies;
Data shared with them;
Purpose of sharing;
Legal basis;
Confirmation of deletion;
Cessation of calls and messages to contacts.

The principal lending company may still be responsible for how its agents process borrower data.

XXXVI. Can the Borrower Delete Data by Uninstalling the App?

No. Uninstalling the app only removes the app from the device. It does not automatically delete data already uploaded to the app’s servers or shared with third parties.

After uninstalling, the borrower should still send a deletion request and revoke permissions.

XXXVII. Can the Borrower Delete Data by Changing Phone Number?

Changing phone number may stop some calls, but it does not delete data. It may also make it harder to receive notices or prove account ownership.

It is better to:

Preserve evidence;
Send a written deletion request;
Revoke permissions;
Close the account;
File complaints if harassment continues.

XXXVIII. What If the App Has No Deletion Button?

Many apps do not provide a clear deletion button. The user may still exercise data subject rights by contacting the company’s privacy office or customer support.

A deletion mechanism should not be illusory. If the app makes deletion impossible or ignores requests, that may support a privacy complaint.

XXXIX. What If the App Requires the User to Log In but the Account Is Locked?

If the account is locked, send the request by email or written letter and include enough information to identify the account, but do not submit unnecessary additional data.

State:

Account mobile number;
Full name;
Approximate application date;
Loan reference number, if known;
Request for deletion or account closure;
Request for alternative verification method.

Do not provide new sensitive documents unless necessary and safe.

XL. What If the App Demands Another ID Before Deleting Data?

A company may need to verify identity before acting on a deletion request, but it should not collect excessive additional data.

If the request comes from the same registered email or mobile number, additional verification may be limited.

If the app demands another government ID, the user may ask:

Why it is necessary;
How it will be used;
Whether partial masking is allowed;
Whether another verification method is available;
Whether the ID will be deleted after verification.

Avoid sending more sensitive documents to suspicious or abusive apps.

XLI. What If the Lending App Is Fake or a Scam?

If the app is fake or a scam, deletion may be difficult because the operator may not comply.

The user should:

Preserve evidence;
Revoke permissions;
Change passwords;
Monitor bank and wallet accounts;
Report to app store;
Report to NPC;
Report to law enforcement;
Report to SEC if it poses as a lender;
Warn contacts that scammers may message them;
Monitor for identity theft.

Do not pay additional “deletion fees,” “account closure fees,” or “data removal fees” demanded by scammers.

XLII. What If the App Threatens to Post Personal Data Unless Paid?

That is a serious red flag.

The borrower should:

Preserve screenshots;
Do not panic-pay without verifying the debt;
Report to NPC;
Report to cybercrime authorities;
Report to SEC if the entity is a lending company;
Notify trusted contacts;
Secure social media privacy settings;
Keep payment proof if any payment is made;
Seek legal assistance if threats continue.

Threatening to expose personal information is not a lawful collection practice.

XLIII. What If the App Posted the Borrower’s Data Online?

If personal data has been posted publicly, request immediate takedown from:

Lending app;
Collection agency;
Social media platform;
Website host, if identifiable;
Group administrator, if posted in a group.

Also preserve evidence before takedown:

Full screenshots;
URL;
Date and time;
Account that posted;
Comments;
Shares;
Persons tagged;
Messages received afterward.

Then file appropriate privacy and cyber complaints.

XLIV. What If Contacts Were Messaged?

If contacts were messaged, ask them to send screenshots showing:

Sender number or account;
Date and time;
Exact message;
Any image or attachment;
Caller ID or call logs;
Group chat details, if any.

The borrower should ask the lending app to delete third-party contact data and stop contacting those people.

Contacts themselves may also have privacy rights because their data was collected and used without their direct participation in the loan.

XLV. What If the App Claims the Borrower Consented?

Many apps rely on consent through terms and conditions. But consent must be valid, specific, informed, and tied to lawful processing. Consent does not authorize everything.

Even if the borrower clicked “agree,” the app may still be questioned if it:

Collected excessive data;
Hid important terms;
Used vague consent;
Accessed contacts unrelated to lending;
Disclosed data to shame the borrower;
Processed data for purposes not disclosed;
Used unfair or deceptive design;
Made consent a condition for unnecessary processing;
Refused withdrawal for optional processing.

Consent is not a license for harassment.

XLVI. What If the App’s Privacy Policy Allows Sharing?

A privacy policy may disclose sharing, but the sharing must still be lawful, necessary, fair, and not excessive.

The borrower may ask:

Who received the data?
What data was shared?
Why was it shared?
Was the recipient a collector, affiliate, processor, or credit bureau?
How long will they keep it?
Can it be deleted or blocked?
Was the borrower informed clearly?

A broad privacy policy does not automatically justify abusive disclosure.

XLVII. Data of References and Emergency Contacts

Borrowers may voluntarily submit references or emergency contacts. However, the app should use those contacts only for legitimate and disclosed purposes.

The app should not:

Shame the borrower to references;
Disclose unnecessary loan details;
Threaten references;
Harass family members;
Contact employers abusively;
Pretend references are co-borrowers;
collect payment from people who did not guarantee the loan.

A deletion request should ask the app to remove references once no longer necessary or after full payment.

XLVIII. Employer Contact and Workplace Harassment

Some apps contact the borrower’s employer or co-workers. This may create reputational and employment harm.

The borrower may demand that the app stop:

Calling the office;
Messaging HR;
Disclosing the loan to supervisors;
Sending defamatory messages;
Threatening workplace complaints;
Using employer contact data for harassment.

If the app falsely accuses the borrower of fraud or crime, additional legal remedies may apply.

XLIX. Deleting Marketing Data

Even where loan records are retained, the borrower may separately opt out of marketing.

The request should say:

Stop promotional SMS;
Stop push notifications;
Stop email marketing;
Stop telemarketing;
Stop sharing data with marketing affiliates;
Delete marketing profile;
Remove from remarketing audiences.

Marketing is usually easier to stop than legally required loan record retention.

L. Deleting Data After Denied Application

If the app denied the loan application, the borrower may ask why data must still be retained.

A denied applicant may request deletion of:

Uploaded ID;
Selfie;
Employment data;
Contact list;
Device data;
Application profile;
Marketing data.

The app may retain limited anti-fraud or application records for a lawful period, but it should explain the legal basis and retention period.

LI. Deleting Data After Account Inactivity

If the account has been inactive for a long time, the borrower may request account closure and deletion of unnecessary records.

The app should not indefinitely retain personal data without a lawful purpose. Retention must be tied to a legitimate reason.

LII. Deleting Data of a Fraudulent Account Opened in Your Name

If someone used your identity to open a lending app account, take immediate steps.

Notify the app that the account is fraudulent;
Request suspension or blocking of the account;
Request deletion of unlawfully submitted data;
Ask for copies of documents used;
File a police or cybercrime report;
File an NPC complaint if identity data was misused;
Inform banks, e-wallets, and credit bureaus if necessary;
Preserve all collection messages.

The app should not continue collection against a person who did not apply for or receive the loan without investigating identity theft.

LIII. Deleting Data From an Unregistered Online Lender

If the lender is unregistered, the user should still send a deletion request if contact information exists. But the user should also file complaints with relevant agencies.

An unregistered lender may be more likely to ignore privacy rights, so evidence preservation is crucial.

The user should avoid giving more personal data to an unverified entity.

LIV. What to Include in a Strong Deletion Request

A strong request includes:

Name of borrower;
Account mobile number;
Loan reference number, if any;
Statement that the request is made under data privacy rights;
Request for account closure;
Request for deletion or blocking of unnecessary data;
Specific mention of contact list, photos, IDs, selfies, and device data;
Withdrawal of consent for optional processing;
Objection to marketing;
Demand to stop contacting third parties;
Request to identify retained data and legal basis;
Request for retention period;
Request for list of third-party recipients;
Request for written confirmation;
Warning that complaints may be filed.

LV. What Not to Say in a Deletion Request

Avoid:

Threats of violence;
False statements;
Admission of debt if the loan is disputed;
Abusive language;
Unnecessary personal details;
Sending new IDs unless necessary;
Waiving claims;
Agreeing to pay illegal fees;
Deleting evidence before complaint;
Posting sensitive details publicly.

Keep the request firm, factual, and documented.

LVI. Should the Borrower Use a Lawyer?

A lawyer may help if:

The amount is large;
There is harassment;
Personal data was posted online;
Employer or contacts were messaged;
The borrower is being threatened;
Identity theft occurred;
The app refuses deletion;
Multiple agencies must be approached;
A civil or criminal case is being considered;
The borrower needs a formal demand letter.

For simple account closure, a user may first send a direct deletion request. For serious abuse, legal assistance is advisable.

LVII. Role of a Data Protection Officer

A legitimate lending company should have a privacy contact or data protection officer. The DPO or privacy office should receive and process data subject requests.

The borrower should look for the DPO contact in:

Privacy policy;
App settings;
Website;
Terms and conditions;
SEC or company disclosures;
Customer service channels.

If no DPO or privacy contact is provided, send the request to official support and state that it should be forwarded to the responsible privacy officer.

LVIII. Retention Periods

A legitimate lender should not keep personal data forever without reason. Its privacy policy should state retention periods or criteria.

Retention may be based on:

Loan term;
Dispute period;
Accounting requirements;
Tax records;
Regulatory audit;
Anti-fraud monitoring;
Legal claims;
Complaint handling.

The borrower may ask for the specific retention period for each category of data.

LIX. Secure Deletion

A request should ask not only for deletion but secure deletion.

Secure deletion means:

Active databases updated;
Uploaded files removed or blocked;
Backups handled under retention protocols;
Third-party processors instructed;
Access logs preserved where needed;
Marketing lists updated;
Contact list data removed;
Future processing stopped.

Some data may remain in backups temporarily, but it should not be actively used and should be deleted according to backup retention schedules.

LX. Anonymization as an Alternative

If a lender needs statistics but not identity, it may anonymize data. Proper anonymization means the data can no longer identify the borrower.

For example, the company may retain aggregate loan statistics without the borrower’s name, phone number, ID, or account details.

Anonymization can satisfy privacy goals while allowing legitimate analytics.

LXI. Blocking as an Alternative

Blocking means restricting further processing even if data is not immediately destroyed.

Blocking may be appropriate where:

A legal dispute is pending;
Data must be preserved as evidence;
The company must retain records but should not use them for marketing or collection harassment;
Deletion is temporarily impossible but further use must stop.

A borrower may request blocking of data pending investigation.

LXII. Correcting Data Instead of Deleting

If the app reports incorrect information, the remedy may be correction rather than deletion.

Examples:

Wrong outstanding balance;
Incorrect late payment status;
Loan marked unpaid despite full payment;
Wrong name or phone number;
Wrong employer information;
Fraudulent account.

The borrower should request correction, not only deletion, especially where credit records are affected.

LXIII. Deletion and Evidence Preservation Conflict

If the borrower intends to file a complaint, complete deletion by the app may remove evidence. The borrower should preserve their own copies first.

In some cases, the request may ask the app to:

Stop unlawful processing;
Block public disclosure;
Preserve records for investigation;
Delete only unnecessary data;
Provide a copy of personal data before deletion.

This is important where the borrower needs proof of abuse.

LXIV. Requesting Access Before Deletion

A borrower may first request a copy of data being processed.

An access request may ask:

What data do you hold about me?
Where did you obtain it?
Why are you processing it?
Who received it?
How long will you retain it?
What automated decisions were made?
What data came from my device?
What data came from third parties?

After receiving the response, the borrower can make a more precise deletion request.

LXV. Sample Access and Deletion Request Combined

Subject: Request for Access, Account Closure, and Deletion of Personal Data

To [Company/App]:

I request a copy or summary of all personal data your company processes about me, including identity documents, selfies, loan application data, device data, contact list data, location data, communications, payment records, and data shared with collection agencies or third parties.

I also request account closure and deletion, blocking, anonymization, or destruction of all personal data no longer necessary for a lawful purpose.

For any data you claim must be retained, please identify the data, purpose, legal basis, retention period, and third-party recipients.

I withdraw consent to optional processing, marketing, profiling, contact list processing, and sharing not necessary for a lawful purpose.

Please provide written confirmation.

[Name] [Registered mobile number] [Date]

LXVI. If the App Responds With a Generic Refusal

A generic refusal may say: “We cannot delete your data under company policy.”

This is insufficient if it does not explain the legal basis, data categories, and retention period.

The borrower may reply:

Your response does not identify the specific personal data you are retaining, the legal basis for retention, or the retention period. Please provide a specific response to my data subject request.

Company policy alone is not a sufficient explanation if it is not tied to a lawful basis for continued processing. I reiterate my request for deletion, blocking, or anonymization of data no longer necessary for lawful purposes, especially contact list data, marketing data, device data, and personal data disclosed to third parties.

LXVII. If the App Says Deletion Is Impossible Because of System Limitations

System limitations are generally not a complete excuse for ignoring data rights. The company should at least block, restrict, anonymize, or stop unnecessary processing.

The borrower may reply:

If immediate deletion is not technically possible, please block or restrict further processing of the data, stop all unnecessary use and disclosure, remove me from marketing and contact lists, and provide your timeline for permanent deletion or anonymization.

Please also identify the specific technical limitation and the safeguards applied while the data remains stored.

LXVIII. If the App Continues Harassment After Deletion Request

Continuing harassment after a deletion request strengthens the case for complaint.

The borrower should:

Preserve new messages;
Record dates and times;
Ask contacts for screenshots;
Send a final warning;
File NPC complaint;
File SEC complaint if a lender is involved;
Consider cybercrime report;
Avoid engaging with abusive collectors except through documented channels.

LXIX. Demand to Collection Agency

If a collection agency is contacting the borrower or third parties, send a separate request.

Subject: Demand to Cease Unauthorized Processing and Contact

To [Collection Agency/Collector]:

I demand that you stop processing and disclosing my personal data and stop contacting my family, employer, co-workers, phone contacts, or any third party regarding any alleged loan with [lending app/company].

Please identify the source of the personal data you are using, the legal basis for processing it, and the authority under which you are acting.

I also demand deletion or return of any personal data not necessary for a lawful purpose, including any phonebook or contact list data obtained from my device or from the lending app.

This demand is without prejudice to complaints before the National Privacy Commission, SEC, law enforcement, and other appropriate agencies.

LXX. Protecting Yourself After Sending the Request

After sending the request:

Save proof of sending;
Screenshot replies;
Revoke app permissions;
Change passwords;
Enable two-factor authentication;
Monitor e-wallet and bank accounts;
Watch for unauthorized loans;
Warn close contacts if harassment is likely;
Check credit or lending records if available;
Keep all evidence in a folder.

LXXI. Deleting Personal Data From the Phone

Apart from deletion from the lending app’s servers, the borrower may remove local data from the phone.

Steps may include:

Clear app cache;
Clear app storage;
Revoke permissions;
Uninstall app;
Delete downloaded loan documents, if desired;
Remove suspicious files;
Check device administrator permissions;
Scan for malware;
Update operating system;
Change passwords.

However, do not delete evidence needed for complaints unless copies are safely preserved.

LXXII. Securing Social Media Accounts

If the app or collectors threaten to contact or shame contacts:

Set profiles to private;
Hide friends list;
Limit who can tag or mention you;
Review old public posts;
Remove phone number visibility;
Block suspicious accounts;
Preserve threatening messages before blocking;
Warn close contacts not to engage.

This does not delete data from the app but reduces misuse risk.

LXXIII. Securing Contacts

If the app accessed contacts, consider informing important contacts briefly.

A simple message may say:

Hi, I’m dealing with a privacy issue involving a lending app. You might receive strange messages or calls using my name. Please ignore them, don’t share any information, and send me a screenshot if you receive anything. Thank you.

Avoid lengthy public posts that may create defamation or privacy issues.

LXXIV. Securing Financial Accounts

If you uploaded IDs, selfies, or bank details:

Monitor bank accounts;
Monitor e-wallets;
Change passwords;
Enable biometric or two-factor authentication;
Report suspicious activity;
Lock cards if compromised;
Watch for loan applications in your name;
Keep copies of reports.

If identity theft is suspected, file a police or cybercrime report.

LXXV. If the Borrower Is Being Collected for a Loan Already Paid

Request:

Certificate of full payment;
Updated statement of account;
Deletion of collection profile;
Stop-collection instruction to agents;
Correction of internal records;
Correction of any credit report;
Written confirmation.

Send proof of payment with sensitive information masked where possible.

LXXVI. If There Was No Loan Released

If the app collected personal data but no loan was released, the borrower has a strong basis to request deletion of unnecessary application data.

The request should say:

No loan was released;
No continuing account exists;
No debt is owed;
Data is no longer necessary;
Delete ID, selfie, contacts, and application data;
Stop marketing and profiling;
Confirm deletion.

If the app demands payment despite no released loan, preserve evidence and consider complaints.

LXXVII. If the App Charged Fees but Did Not Release Loan

This may be both a lending scam and data privacy issue.

Actions:

Preserve payment receipts;
Preserve chat instructions;
Demand refund if money was paid;
Demand deletion of personal data;
Report to wallet provider if payment was sent;
Report to SEC or law enforcement;
File NPC complaint if data is misused.

Do not send additional fees to “delete data.”

LXXVIII. If the App Is Still on Your Phone

Before uninstalling:

Screenshot account details;
Screenshot loan status;
Screenshot privacy settings;
Screenshot permissions;
Download statements if available;
Save payment history;
Send deletion request;
Revoke permissions;
Then uninstall if no longer needed.

LXXIX. If the App Was Removed From the App Store

If the app is removed but the company still processes data:

Use prior email or website contacts;
Search old privacy policy saved in screenshots;
Contact the company name shown in loan documents;
Contact collection agency if identified;
File NPC complaint if no response;
File SEC complaint if lender was operating abusively;
Preserve app store removal evidence.

Removal from app store does not erase collected data.

LXXX. If the App Operator Is Outside the Philippines

Some apps may be operated from abroad or hide behind foreign entities. If they process data of Philippine users or operate in the Philippine lending market, Philippine agencies may still be relevant, especially if a local lending company, collection agency, payment channel, or representative is involved.

The borrower should identify:

Local company name;
Philippine collection agency;
Payment account holder;
App developer;
Website operator;
Customer support email;
Privacy contact;
App store listing.

Complaints may be harder to enforce against purely foreign operators, but local partners may still be accountable.

LXXXI. Deletion and Blacklisting

Some borrowers worry that requesting deletion will lead to “blacklisting.” A legitimate lender may maintain lawful internal risk records or credit reporting records, but it should not use deletion requests as retaliation.

A borrower has a right to exercise privacy rights. The lender may not lawfully punish the borrower for objecting to unlawful processing or harassment.

However, if the borrower has an unpaid legitimate loan, the lender may still maintain collection and credit records consistent with law.

LXXXII. Deletion and Loan Waiver

Deleting personal data does not automatically erase a valid debt. If a loan was validly released and remains unpaid, the borrower may still owe the loan even if some data is deleted or blocked.

Likewise, paying the loan does not automatically erase all data, but it strengthens the request to close the account and delete unnecessary data.

Data deletion and debt payment are related but distinct.

LXXXIII. Deletion and Credit Score

If a lender lawfully reported credit information, deletion from the app may not automatically delete credit bureau records.

The borrower should separately request correction or deletion of inaccurate or unlawful credit reporting from the relevant entity.

If the account is fully paid, request that the lender update the status as paid.

LXXXIV. Deletion and Co-Borrowers or Guarantors

If the loan has a co-borrower or guarantor, the lender may retain some records involving them. The borrower cannot necessarily demand deletion of another person’s data without authority.

However, the borrower may still demand deletion of excessive or unlawfully collected third-party contact data.

LXXXV. Deletion and Minors

If a minor’s data was collected by a lending app, the issue is serious. Minors generally lack full contractual capacity, and processing their data requires heightened care.

A parent or guardian may demand deletion, account closure, and investigation.

Documents may include:

Proof of parent or guardian identity;
Proof of minor’s age;
Screenshots of app account;
Data collected;
Any collection messages.

If the app granted a loan to a minor or harassed a minor, complaints should be considered.

LXXXVI. Deletion and Deceased Borrowers

If the borrower is deceased, heirs or representatives may seek closure of the account and cessation of unnecessary processing, particularly if collectors continue harassing family members.

The representative may need:

Death certificate;
Proof of relationship;
Authority to act for estate, if required;
Account details;
Payment or loan documents.

Debt claims against the estate are separate from privacy and harassment concerns.

LXXXVII. Corporate Borrowers and Personal Data

If the borrower is a sole proprietor or corporate officer who used a lending app for business purposes, personal data may still be involved.

The individual may request deletion of personal data not necessary for the business loan, especially personal contacts, photos, and private information.

For corporate borrowers, authorized representatives may need to act for the business account, but personal data rights remain with individuals.

LXXXVIII. Data Breach Concerns

If the app’s database was leaked or personal data was exposed, users may ask:

What data was affected?
When did the breach occur?
What actions were taken?
Were regulators notified?
Were affected users notified?
What protections are offered?
Will data be deleted or secured?

If the app fails to notify or respond, complaint may be filed with the NPC.

LXXXIX. Practical Timeline

A practical timeline may be:

Day 1: Preserve evidence and revoke permissions.
Day 1–2: Check loan status and payment records.
Day 2: Send data deletion and account closure request.
Day 5–10: Follow up if no response.
Day 10–15: Send final demand if harassment continues.
After continued refusal: File complaint with NPC and other agencies.
Ongoing: Monitor accounts, contacts, and credit records.

The exact timing depends on urgency, harassment, and whether the loan is active.

XC. Data Deletion Checklist

Before sending the request:

Identify the app and company;
Screenshot app profile and loan details;
Save privacy policy;
Save payment records;
Save harassment evidence;
Revoke permissions;
Prepare account details;
Draft request;
Send to official channels;
Save proof of sending.

XCI. Complaint Checklist

For filing a complaint:

Narrative of events;
Copy of deletion request;
Proof of sending;
App screenshots;
Privacy policy;
Messages from collectors;
Screenshots from contacts;
Payment records;
Full payment certificate, if any;
Company details;
App store listing;
Witness statements, if available;
Government ID for complainant, if required by agency;
Contact details.

XCII. Common Mistakes by Borrowers

Uninstalling the app before saving evidence;
Deleting messages from collectors;
Sending additional IDs to suspicious apps;
Paying “data deletion fees”;
Ignoring app permissions;
Posting accusations online with unverified claims;
Failing to request deletion in writing;
Not asking for full payment certificate;
Not filing complaints when harassment continues;
Assuming full payment automatically deletes data.

XCIII. Common Mistakes by Lending Apps

Collecting entire contact lists unnecessarily;
Using contacts for shaming;
Failing to provide a clear privacy notice;
Hiding the company identity;
Refusing deletion without legal basis;
Retaining data indefinitely;
Sharing data with unauthorized collectors;
Using abusive collection language;
Posting borrower data online;
Ignoring data subject requests;
Treating consent as unlimited;
Failing to secure uploaded IDs and selfies.

XCIV. Remedies Available to the Borrower

Depending on facts, the borrower may seek:

Deletion of unnecessary data;
Blocking of data;
Account closure;
Correction of records;
Full payment certification;
End of collection harassment;
Takedown of online posts;
Identification of third-party recipients;
Damages;
Regulatory sanctions;
Criminal investigation;
Civil action;
App store enforcement;
Correction of credit reports.

XCV. Frequently Asked Questions

1. Can I force an online lending app to delete my data?

You can request deletion, blocking, or destruction of data that is unlawfully processed or no longer necessary. The app may retain some records if required by law, needed for a loan contract, collection, audit, tax, regulatory compliance, or legal claims.

2. Can I delete my data if I still have an unpaid loan?

You may still request deletion of unnecessary or unlawfully collected data, such as contact list data or marketing data. The lender may retain data necessary to document and collect a legitimate debt.

3. Can I delete my data after fully paying the loan?

Yes. Ask for account closure, certificate of full payment, deletion of unnecessary data, and explanation of any retained records.

4. Does uninstalling the app delete my data?

No. It only removes the app from your phone. Data already uploaded to the company’s servers may remain.

5. How do I stop the app from accessing my contacts?

Revoke contact permission in your phone settings. Then send a written request demanding deletion of any contact list data already collected.

6. Can the app message my contacts?

A lender should not use your contacts for harassment, shaming, threats, or unauthorized disclosure. If this happens, preserve evidence and consider complaints with the NPC, SEC, or law enforcement.

7. What if the app refuses to delete my data?

Ask for the legal basis, data categories, and retention period. If the refusal is unsupported or abusive processing continues, file a complaint with the National Privacy Commission.

8. What if the app has no customer service or DPO contact?

Send the request to all available official channels, preserve proof, and file a complaint if there is no response. Lack of a clear privacy contact is itself a warning sign.

9. Can I ask collection agencies to delete my data?

Yes. You can demand that the lender and its collectors stop unnecessary or unlawful processing and delete or return data not needed for a lawful purpose.

10. Can I demand deletion of my ID and selfie?

Yes, especially if no loan was released, the data is no longer necessary, or the app is misusing the data. The lender may claim limited retention for legal or anti-fraud purposes, but it must explain the basis and retention period.

11. Can I ask for damages?

If unlawful processing caused harm, humiliation, financial loss, identity theft, or emotional distress, damages may be pursued through appropriate legal remedies.

12. Should I file with the NPC or SEC?

For data privacy violations, file with the NPC. For abusive lending practices or unregistered lending operations, file with the SEC. Serious threats or online abuse may also justify law enforcement action.

XCVI. Best Practices for Borrowers

Borrowers should:

Use only legitimate lending companies;
Read privacy policies before applying;
Avoid apps requiring excessive permissions;
Never grant contact access unless truly necessary;
Keep screenshots of loan terms;
Use written communication;
Pay through official channels only;
Request a full payment certificate;
Revoke permissions after use;
Send deletion requests in writing;
File complaints when harassment occurs;
Protect IDs and selfies from misuse.

XCVII. Best Practices for Lending Apps

Legitimate lenders should:

Collect only necessary data;
Provide a clear privacy notice;
Identify the company and DPO;
Avoid contact scraping;
Limit access to sensitive documents;
Use lawful collection practices;
Train collectors;
Honor data subject requests;
Publish retention periods;
Secure IDs and selfies;
Delete or anonymize data when no longer needed;
Maintain complaint channels;
Avoid abusive third-party disclosure.

XCVIII. Conclusion

Deleting personal data from an online lending app in the Philippines requires more than uninstalling the app. A borrower should preserve evidence, revoke app permissions, identify the lending company, send a written data deletion and account closure request, demand cessation of unnecessary processing, and require written confirmation of what data was deleted, retained, or shared.

The borrower has rights under Philippine data privacy law, including the right to request erasure or blocking of personal data under appropriate circumstances. However, a lending app may retain certain records when necessary for a lawful loan, collection, accounting, audit, regulatory compliance, or legal claims. The key is proportionality: the lender may keep what the law allows, but it may not misuse personal data, harass contacts, publicly shame borrowers, or retain excessive data indefinitely.

If the app ignores the request, refuses without legal basis, contacts third parties, posts personal information, or uses data for harassment, the borrower may file complaints with the National Privacy Commission, SEC, cybercrime authorities, or other appropriate agencies. In serious cases, legal counsel may be needed.

The safest approach is to act quickly, document everything, communicate in writing, demand deletion of unnecessary data, stop unlawful processing, and escalate to regulators when the app fails to respect privacy rights.