Quick answer

If your personal data was misused, exposed, accessed, disclosed, altered, retained, or disposed of unlawfully, you may file a formal complaint with the National Privacy Commission (NPC). In most cases, you must first notify the organization, person, or government office in writing and give it an opportunity to act. You may proceed if it fails to take timely or appropriate action, or does not respond within 15 calendar days after receiving your notice.

Use the NPC’s current Complaint-Affidavit, have it notarized, attach your evidence and prior correspondence, and submit it personally, by registered mail, courier, or authorized electronic mail. A complaint can be dismissed without prejudice if it lacks the required form, supporting facts, evidence, or proof that the respondent was first given an opportunity to address the matter. These requirements come from the 2021 NPC Rules of Procedure, as amended by NPC Circular No. 2024-01.

When an NPC complaint is appropriate

A formal complaint is generally available to a data subject—an individual whose personal data is being processed—who is affected by a privacy violation or data breach. Examples may include:

Unauthorized collection, use, disclosure, sharing, or sale of your personal data;
Access to your data caused by gross negligence;
Use of your data for a purpose different from the declared or authorized purpose;
Improper disposal of records containing your data;
Failure to provide reasonable access to your data or to correct inaccurate information;
Unjustified refusal to erase or block unlawfully processed data;
Inadequate security measures that led to unauthorized access or disclosure; or
Other violations of the Data Privacy Act of 2012, its Implementing Rules and Regulations, or NPC issuances.

A breach does not have to affect thousands of people before an affected individual may complain. Conversely, an unpleasant disclosure or a refusal to follow your request is not automatically a Data Privacy Act violation.

Consent is also not the only lawful basis for processing ordinary personal information. Depending on the facts, processing may be supported by a contract, legal obligation, vital interests, public-order requirements, a public authority’s statutory mandate, or a legitimate interest that is not overridden by the data subject’s fundamental rights. Sensitive personal information is subject to stricter conditions. The NPC must evaluate the actual data, purpose, parties, legal basis, safeguards, and circumstances—not simply whether you gave consent. See the Data Privacy Act Implementing Rules and Regulations.

Who may file

You may file if you are the individual affected by the alleged violation or breach. The following special rules apply:

A representative may file for you if authorized by a special power of attorney.
For a minor represented by a father or mother, attach the birth certificate as proof of relationship.
A court-appointed guardian should attach the order designating the guardian.
A juridical entity may represent one or more affected data subjects, but it needs their special powers of attorney. The individual acting for the entity must also have the required board authorization and notarized Secretary’s Certificate, or the government-agency equivalent.
A Filipino citizen living abroad who has no Philippine representative or cannot appoint one may submit a complaint notarized by a Philippine embassy or consulate, or accompanied by an apostille certificate from the country of origin.

A corporation is not itself a data subject merely because corporate information was used. However, it may represent affected individuals when the NPC’s authorization requirements are met.

If you were not personally affected, you ordinarily cannot substitute yourself for the data subject in a formal complaint. You may still inform the NPC of a substantiated concern. The NPC may initiate its own investigation based on sources that include corroborated and substantiated tips, government reports, pending cases, or other reliable information.

Step 1: Prevent further harm

Filing a complaint does not immediately secure an account, stop fraudulent transfers, remove an online post, or protect you from physical danger. Take proportionate protective action first:

Change compromised passwords and enable multi-factor authentication.
Sign out unknown devices and preserve the account-access history.
Notify your bank, e-wallet, card issuer, telecommunications provider, or online platform immediately if fraud or account takeover is involved.
Preserve an online post, message, or page before requesting its removal.
Report threats, stalking, extortion, blackmail, or an immediate safety risk to law enforcement.
Consider placing additional safeguards on accounts if government identification numbers, financial information, health information, or authentication credentials were exposed.

Do not delete the messages or files that show what happened.

Step 2: Notify the respondent in writing

Before filing with the NPC, write to the organization’s Data Protection Officer, privacy office, customer-service channel, responsible government office, or the person concerned. Your notice should clearly state:

Your name and contact details;
The personal data involved;
What you believe happened, including relevant dates, accounts, transactions, recipients, or URLs;
How you learned of the incident;
Why you believe the processing or disclosure was unauthorized, excessive, inaccurate, insecure, or otherwise unlawful;
The data-subject right you are exercising, if applicable;
The action you want, such as access, correction, erasure, blocking, an explanation, containment, notification of recipients, or compensation; and
A request that relevant records, logs, CCTV footage, messages, access histories, and other evidence be preserved.

Send the notice through a channel that produces proof of delivery. Keep the sent email with its headers, ticket number, registered-mail receipt, courier tracking record, acknowledgment, and every response.

The respondent has up to 15 calendar days from receipt for purposes of the NPC’s exhaustion requirement. You may file when there is no response within that period or when the action taken is not timely or appropriate.

When prior notice may be waived

The NPC has discretion to waive some or all of the prior-notice requirement if you properly allege and prove good cause, or when the complaint involves a serious violation or breach considering the risk of harm. The rules identify circumstances such as:

Grave and irreparable damage that only NPC action can prevent or mitigate;
No plain, speedy, or adequate remedy available from the respondent; or
Patently illegal conduct.

Do not merely write “urgent.” Explain the specific danger, why ordinary notice is inadequate, what harm is occurring or imminent, and attach supporting proof.

Step 3: Preserve and organize your evidence

The complaint should establish what data was processed, who processed it, what occurred, and why the act or omission may violate the law. Preserve:

Original emails, including headers and attachments;
Complete message threads, not isolated excerpts;
Screenshots showing the account name, date, time, URL, and surrounding context;
Downloaded copies of posts, pages, notices, or files before they change;
Privacy notices, consent forms, contracts, terms, application forms, and relevant policies;
Access logs, login alerts, breach notices, transaction histories, and account-recovery records;
Copies of your access, correction, objection, erasure, or blocking requests;
Proof that the respondent received your written notice;
The respondent’s replies and remedial actions;
Receipts, statements, medical records, affidavits, or other proof of claimed loss or injury; and
Affidavits from witnesses who have relevant personal knowledge.

Keep original files unchanged and store working copies separately. Record when and how each item was obtained. For electronic evidence, avoid cropping away identifying details or editing the content. If a screenshot is necessary, retain the original message, page, device, or exported file where practicable.

Your filing and evidence will ordinarily be furnished to the respondent. Avoid including unrelated passwords, authentication codes, or third-party personal data. Where limited redaction is necessary for security, retain an unredacted original and clearly explain the redaction.

Step 4: Prepare the complaint

The simplest route is to use the NPC’s current bilingual Complaint-Affidavit and Question-and-Answer Form. Complete it legibly and accurately.

A compliant complaint should include:

Your identity, address, active email address, and contact number;
The respondent’s identity and available contact or service address;
If the respondent’s identity is unknown, facts that may lead to identification;
The specific personal information or sensitive personal information involved;
A concise, chronological narration of material facts;
The acts or omissions attributed to each respondent;
The legal or privacy rights allegedly violated, if known;
Every form of relief you are requesting;
All correspondence with the respondent and a statement of what it did, if anything;
Documentary evidence and witness affidavits, where available;
A valid identification document requested by the form;
Any special power of attorney or proof of relationship required for a representative;
Verification under oath; and
A certification against forum shopping.

The certification against forum shopping must disclose whether the same issues are pending in any court, tribunal, or quasi-judicial agency. If you later learn that the same or a similar action has been filed or is pending elsewhere, you must report that fact to the NPC within five calendar days after learning of it.

Have the completed complaint notarized. Do not sign the verification or jurat in advance if the notary requires you to sign in the notary’s presence.

Step 5: Choose the relief you are seeking

State what result you are asking the NPC to order. Depending on the facts and the NPC’s authority, possible relief may include:

Access to or correction of personal data;
Erasure, blocking, or removal of unlawfully processed data;
Compliance or enforcement measures;
A temporary or permanent ban on specified processing;
Indemnity for proven damage affecting personal-data protection or data-subject rights;
Administrative fines against a covered controller or processor;
Other measures needed to enforce the Data Privacy Act; or
Referral or recommendation to the Department of Justice where prosecution may be warranted.

The NPC does not automatically award damages merely because a violation is alleged. The claimed injury, causation, amount, and supporting evidence remain material. An NPC complaint also does not itself result in a criminal conviction; criminal prosecution and punishment require the appropriate proceedings before the proper authorities and courts.

Step 6: File with the NPC

The NPC’s current filing guidance permits submission:

Personally;
By registered mail;
By accredited courier;
By electronic mail, as authorized by the Commission.

The NPC’s published contact address is:

National Privacy Commission 25th–27th Floors, The Upper Class Tower Quezon Avenue corner Scout Reyes Street Quezon City, Philippines

For complaints, the NPC lists complaints@privacy.gov.ph. Confirm current contact details on the NPC contact page immediately before filing.

The NPC’s formal-complaint filing page instructs complainants to complete and notarize the form, then submit it personally, by courier, or by scanning and emailing it. For an electronic filing:

Use a clear, complete PDF;
Make sure every page, signature, notarial portion, and attachment is readable;
Use descriptive filenames and an attachment index;
Check that links or cloud permissions are not required to open the evidence;
Follow any current NPC instruction on digital signatures, paper size, printing fees, or original copies; and
Keep the sent email, automated acknowledgment, and any case or reference number.

For personal filing, the procedural rules require two original copies plus as many copies as there are receiving parties. If filing by mail or courier, retain the complete filing set, envelope, receipt, and tracking proof. The documented filing or transmission date may be legally important.

Filing fees

The NPC’s current published schedule lists:

₱500 filing fee for a complaint;
A legal research fee equal to 1% of the filing fee, but not less than ₱10;
An additional ₱150 for a damages claim not exceeding ₱20,000;
An additional ₱500 for a damages claim over ₱20,000 up to ₱100,000; and
₱500 for every succeeding ₱100,000, or fraction thereof, for higher damages claims.

Other applications, motions, bonds, or services may carry separate charges. Obtain an official assessment and payment instructions from the NPC, and pay only through the NPC cashier or an officially designated payment channel. The Commission generally takes no further action until the required fee is paid.

Indigent litigants may qualify for exemption. The published schedule requires both an income and property test and supporting documents, including a barangay Certificate of Indigency, specified affidavits, and the current tax declaration if any. Because minimum-wage figures and documentary requirements may vary or be updated, check the NPC Schedule of Fees and Charges and ask the NPC for a current assessment before filing.

What happens after filing

The NPC rules provide the following general sequence:

Assignment: Within five calendar days after receipt, the complaint should be raffled or assigned to an investigating officer.
Initial evaluation: Within 30 calendar days after receipt, the investigating officer may give the complaint due course or recommend outright dismissal without prejudice.
Respondent’s comment: If the complaint proceeds, the respondent is generally directed to file a verified comment within 15 calendar days after receiving the order.
Preliminary conference: This addresses possible mediation, discovery, simplification of issues, admissions, and other matters that may speed up the case.
Mediation: The parties may jointly choose mediation before the case is endorsed for decision. A confirmed settlement has the effect of a decision on the complaint, although it does not necessarily prevent a separate NPC-initiated investigation.
Investigation: The NPC may require more documents, witnesses, technical examination, or on-site inspection.
Memoranda and fact-finding report: The parties may be directed to submit memoranda, after which the investigating officer prepares a report and recommendation.
Decision: The Commission reviews the record and may decide the case, seek clarification, require additional documents, or issue appropriate enforcement orders.

These are procedural periods for particular stages, not a guarantee that the entire case will finish within a fixed number of days.

A complaint may be dismissed without prejudice when, among other grounds, it is deficient in form, does not show prior notice or a justified exception, does not involve a Data Privacy Act matter, lacks enough information or evidence, or fails to identify or trace the necessary parties despite diligence. “Without prejudice” generally allows refiling after the defect is corrected.

If the decision is adverse

A Commission decision generally becomes final and executory 15 calendar days from notice, with proof of service to the adverse party. One motion for reconsideration may be filed within the applicable period and suspends its running. The published fee for a motion for reconsideration is ₱500.

An appeal must be taken to the proper court in accordance with applicable law and procedural rules. Appellate deadlines and the effect of a motion for reconsideration can be technical, so obtain legal advice immediately after receiving an adverse decision rather than waiting until the fifteenth day.

While a complaint is pending, notify the NPC and the other parties of any change in your physical or email address within five calendar days. Service to the address on record may otherwise be treated as valid.

Urgent cases and temporary protection

A complainant may move for a temporary ban on specified processing from the filing of the complaint until before the NPC decision becomes final. This is not automatic. The applicant must show facts supporting the relief, establish that the measure is necessary to protect relevant rights or interests, comply with the hearing requirements, and ordinarily post a bond unless exempt.

Urgent interim applications require precise evidence and service on the respondent. Seek legal help promptly when:

Highly sensitive data or authentication credentials are still being published or exploited;
Fraudulent transactions or identity theft are ongoing;
A child, victim of violence, patient, employee, or other vulnerable person faces immediate harm;
Intimate material, medical information, or location data is being distributed;
Evidence is likely to be deleted or overwritten;
Several courts or agencies may have overlapping jurisdiction;
You seek substantial damages, a processing ban, or criminal prosecution; or
You have received an NPC order, dismissal, or decision with a running deadline.

An NPC complaint does not replace immediate reports to a bank, platform, police agency, sector regulator, employer, school, or other authority that can stop an active threat.

Common filing mistakes

Avoid these frequent problems:

Filing without first notifying the respondent in writing and proving receipt;
Assuming that the absence of consent automatically makes all processing unlawful;
Saying only “my privacy was violated” without identifying the data and processing act;
Submitting screenshots without dates, URLs, account identifiers, or context;
Omitting correspondence, supporting evidence, verification, notarization, or the certification against forum shopping;
Filing for another adult without a special power of attorney;
Naming officers personally without facts showing participation or gross negligence;
Claiming damages without identifying the injury, amount, and supporting proof;
Sending unreadable, corrupted, password-locked, or inaccessible attachments;
Missing the fee assessment or using an unofficial payment channel;
Ignoring orders sent to the email address used for filing; or
Allowing original electronic evidence to be edited, deleted, or overwritten.

Frequently asked questions

Do I need a lawyer?

Not necessarily. The NPC provides a complaint form designed for individuals. A lawyer is advisable when the respondent disputes jurisdiction, the case involves several parties or countries, urgent interim relief is needed, substantial damages are claimed, or related civil or criminal proceedings are being considered.

Can I file entirely by email?

The NPC’s current filing page permits a scanned, notarized complaint to be emailed to its complaints address. Submit a clear PDF and follow any current instruction on digital signatures, payment, printing, or later production of originals. Keep proof of successful transmission and ask for acknowledgment if none arrives.

Is 72 hours my deadline to complain about a breach?

No. The 72-hour rule generally concerns a personal information controller’s duty to notify the NPC and affected data subjects of a qualifying personal data breach. It is not a 72-hour deadline for an affected person to file a formal complaint.

Must I always wait 15 days before filing?

Ordinarily, you must give the respondent an opportunity to act, and the rules use 15 calendar days from its receipt of your written notice. The NPC may waive this requirement for proven good cause or a serious violation or breach involving circumstances such as grave and irreparable harm, an inadequate remedy, or patently illegal conduct.

Can I request deletion of my data?

You may request erasure or blocking, but the right is not absolute. The respondent may have another lawful basis or retention obligation. Explain why the data is inaccurate, unlawfully obtained, no longer necessary, used for an unauthorized purpose, or otherwise processed unlawfully.

Can I recover damages?

The Data Privacy Act recognizes a right to indemnity for qualifying damage, and the NPC may award indemnity under the Civil Code. Recovery depends on the evidence and circumstances. Identify the relief sought, prove the injury and its connection to the violation, and pay any applicable additional filing fee.

Can I file anonymously?

An anonymous tip is not the same as a formal complaint by an affected data subject. However, the NPC may initiate its own investigation based on corroborated and substantiated anonymous information. A formal complainant should expect to be identified to the respondent as part of due process.

Can I complain against a government office or my employer?

Yes. The Data Privacy Act generally applies to personal-data processing in both the government and private sectors. However, government agencies and employers may have lawful duties or authority to process particular information. The legality depends on purpose, necessity, proportionality, notice, security, and other applicable laws.

Is there one deadline for every privacy complaint?

No single limitation period safely covers every possible administrative, civil, and criminal remedy. The NPC rules adopt the prescription periods under Act No. 3326 for penal provisions of the Data Privacy Act, while other claims may be governed by different laws and starting points. File promptly and obtain legal advice if the incident is old or another remedy has a running deadline.

Official sources

This article provides general Philippine legal information, not legal advice or a prediction of how the NPC will decide a particular case. Procedures and conclusions may depend on the documents, dates, parties, and applicable sector-specific laws. Official sources and filing information were checked as of 1 August 2026.