Quick answer

If a person, business, employer, school, government office, online platform, or other organization mishandled your personal data, you may file a formal complaint with the National Privacy Commission (NPC).

In most cases, you must first notify the person or organization in writing and give it an opportunity to act. If it takes no timely or appropriate action—or does not respond within 15 calendar days after receiving your written notice—you may submit a verified and notarized complaint, supporting evidence, proof of your prior notice, the required assessment form, and the filing fee to the NPC.

A complaint may be filed personally, by registered mail, by courier, or through the email channel authorized by the NPC. The NPC’s current complaint email is complaints@privacy.gov.ph. Use the latest form from the NPC complaint-filing page, because older versions may no longer be accepted.

When an NPC complaint may be appropriate

The NPC handles alleged violations of the [Data Privacy Act of 2012,

Quick answer

File a written, signed, verified, and notarized complaint with the National Privacy Commission (NPC). In most cases, you must first notify the person or organization responsible for the alleged privacy violation in writing and give it an opportunity to act. If it does not take timely and appropriate action—or does not respond within 15 calendar days after receiving your notice—you may proceed with the NPC complaint.

Use the NPC’s current Complaint-Affidavit form, attach your evidence and prior correspondence, complete the verification and certification against forum shopping, and submit it personally, by registered mail, courier, or authorized email filing. The NPC currently accepts complaint submissions at complaints@privacy.gov.ph.

A data privacy complaint is appropriate when the problem involves the processing of identifiable personal data—for example, unlawful collection or use, unauthorized disclosure, improper disposal, inadequate security, or denial of a data-subject right. A scam, workplace dispute, offensive post, or personal disagreement is not automatically a Data Privacy Act violation unless personal-data processing is involved.

Check whether the complaint belongs with the NPC

The Data Privacy Act of 2012 generally covers the collection, recording, storage, use, disclosure, alteration, retrieval, blocking, erasure, or destruction of information that identifies, or can reasonably identify, an individual.

Common grounds for an NPC complaint include:

Personal data was collected, accessed, used, shared, or sold without a lawful basis.
Data was used for a purpose materially different from the purpose originally declared.
Sensitive information—such as health, education, sexual-life, government-issued, tax, or offense-related information—was improperly processed or disclosed.
Records containing personal data were carelessly discarded or left publicly accessible.
An organization failed to use reasonable security measures.
You were not properly informed about the processing.
A valid request for access, correction, blocking, erasure, or another data-subject right was improperly refused.
You were affected by a personal data breach and the organization failed to respond appropriately.

Lack of consent does not by itself prove a violation. Ordinary personal information may also be lawfully processed when necessary for a contract, legal obligation, vital interests, public authority, or a legitimate interest that is not overridden by the data subject’s fundamental rights. Sensitive and privileged information is subject to stricter lawful-processing conditions.

The Act also contains exclusions and special rules for certain government-related information, public-authority functions, journalism, art, literature, research, and specified investigations. Even where a government mandate permits processing, the Supreme Court has emphasized that processing must still comply with transparency, legitimate purpose, and proportionality. See Zoleta v. Office of the Ombudsman, G.R. No. 258888, April 8, 2024.

Who may file

Under the 2021 NPC Rules of Procedure, as amended, a data subject affected by a privacy violation or data breach may file a complaint.

A representative may file if authorized by a special power of attorney. Additional rules apply in these situations:

A parent representing a minor should attach the minor’s birth certificate as proof of relationship.
A guardian representing a minor or a person alleged to be incompetent should attach the court order appointing the guardian.
If a juridical person represents one or more data subjects, it needs their special powers of attorney. Its individual representative must also have authority established through a board resolution contained in a duly notarized secretary’s certificate, or the government-agency equivalent.
A non-resident Filipino citizen who has no representative in the Philippines, or cannot appoint one, may file directly, but the complaint must be notarized by a Philippine embassy or consulate or carry an apostille from the country of origin.

A formal complaint cannot normally be anonymous because it must identify the complainant and be verified under oath. The NPC may, however, start its own investigation based on a corroborated and substantiated anonymous tip.

Step 1: Stop further harm and preserve evidence

Do not wait for the complaint process before protecting yourself.

If credentials, financial accounts, or identity documents may be compromised:

Change affected passwords and use unique passwords for other accounts.
Enable multi-factor authentication.
Notify the bank, card issuer, e-wallet, telecommunications provider, or platform involved.
Request account restrictions or replacement credentials where appropriate.
Review transactions and account-recovery settings.
Report unauthorized transactions through the provider’s official fraud channel.

Preserve evidence before posts, messages, accounts, or system records disappear. Keep:

Original emails, including headers and attachments.
Complete chat exports, not only selected screenshots.
Screenshots showing the account name, URL, date, time, and surrounding context.
Copies of privacy notices, consent forms, contracts, application forms, and terms that applied when the data was collected.
Breach notices and other communications from the organization.
Your written notice to the respondent and proof of receipt.
The respondent’s complete reply, including attachments.
Transaction records, access alerts, call logs, and official incident or reference numbers.
Receipts and records of measurable loss, mitigation expenses, or other damage you intend to claim.
Witness affidavits, where another person can authenticate documents or directly describe relevant events.

Keep unedited originals and create separate working copies. Do not obtain evidence by breaking into another person’s account or device. Avoid posting sensitive evidence publicly; disclose only what is reasonably necessary to the NPC and other proper authorities.

Step 2: Notify the responsible party in writing

Before filing, write to the organization’s data protection officer, privacy office, customer-service channel, or responsible individual. State:

Your name and contact information.
What personal data is involved.
What happened, in chronological order.
When and how you discovered it.
Why you believe the processing was improper.
What immediate risks or harm exist.
What you want the respondent to do—for example, investigate, explain the lawful basis, correct a record, stop a disclosure, secure an account, delete unlawfully retained data, or provide access.
A request for written confirmation of the action taken.

Send the notice through a channel that produces proof of receipt, such as email with delivery records, registered mail, courier, or an official ticketing system. Save the receipt date because the 15-calendar-day period is counted from the respondent’s receipt.

If there is no response within 15 calendar days, the exhaustion requirement is generally satisfied. An earlier response that does not provide timely or appropriate action may also support filing.

The NPC may waive prior notice for proven good cause or a serious violation or breach, including situations involving grave and irreparable damage that only NPC action can prevent or mitigate, the absence of a plain, speedy, and adequate remedy from the respondent, or conduct that is patently illegal. Explain and prove the exceptional circumstances in the complaint; waiver is discretionary, not automatic.

Step 3: Prepare the complaint

Download the form directly from the NPC complaint page on the day you prepare the filing. Do not rely on an old saved template because the NPC periodically replaces its forms.

You may use the current Complaint-Affidavit or prepare a separate verified complaint. It should contain:

Your identity and complete contact details, including an active email address and an address where NPC documents may be served.
The respondent’s correct legal or commonly used name, contact information, and service address, if known.
If the respondent’s identity is unknown, the facts and available information that may lead to identification.
The specific personal data involved.
A clear, chronological statement of material facts.
The acts or omissions alleged to violate the Data Privacy Act, its implementing rules, or an NPC issuance.
The relief you are asking the NPC to grant.
All correspondence with the respondent and a statement of what action it took, if any.
Copies of documentary evidence and relevant witness affidavits.
A verification under oath.
A certification against forum shopping.

If a company or other juridical entity is the respondent, responsible officers should be individually named only when there is a factual basis to allege that they participated in the violation or, through gross negligence, allowed it. Do not indiscriminately name every employee or officer.

The certification against forum shopping must truthfully disclose whether the same issues are pending before another court, tribunal, or quasi-judicial agency. If you later learn of the same or a similar action, you must report it to the NPC within five calendar days.

The current form also asks for a valid government-issued ID. Complete every applicable part, mark genuinely inapplicable items accordingly, identify each attachment, and use consistent exhibit labels.

Step 4: Sign, notarize, and assemble the filing

Sign the complaint and have its verification and certification properly notarized. Attach the documents establishing a representative’s authority, if applicable.

For email filing, scan the notarized complaint into a clear and complete PDF. The NPC’s complaint mechanics state that electronic documents should be digitally signed and, where practicable, submitted in PDF on page sizes compliant with the Efficient Use of Paper Rule. Retain the notarized original.

Check that:

Every page is readable and correctly oriented.
No attachment is missing or corrupted.
File names correspond to the exhibit list.
Passwords or access instructions for protected files are transmitted securely.
Links do not expire before the NPC can open them.
Portable storage devices, if used, are free of malware.

For personal paper filing, the procedural rules require two original copies plus as many copies as there are receiving parties. The NPC Citizen’s Charter separately describes additional file copies for paper submissions. Confirm the current required number with the Complaints and Investigation Division before sending a paper package.

Step 5: Submit through an accepted channel

The Rules permit filing:

Personally at an NPC office.
By registered mail.
By courier.
By electronic mail when authorized by the Commission.

The NPC’s current public instructions authorize sending the scanned complaint to complaints@privacy.gov.ph.

The current central-office address is:

Complaints and Investigation Division National Privacy Commission 25th–27th Floors, The Upper Class Tower Quezon Avenue corner Scout Reyes Street Barangay Paligsahan, Quezon City

Check the NPC contact page immediately before visiting or dispatching documents because office arrangements can change.

For registered mail or courier, the mailing date shown by the post-office stamp or receipt is treated as the filing date. For email, the transmission date is the filing date only if the submission is sufficient in form. Illegible, erroneous, or malfunctioning electronic submissions are not considered.

Keep the sent email, complete attachment set, registry or courier receipt, delivery confirmation, NPC acknowledgment, docket number, and official receipt.

Filing fees and payment

The current NPC schedule of fees provides:

Item	Fee
Basic complaint filing fee	₱500
Additional fee when claimed damages do not exceed ₱20,000	₱150
Additional fee when claimed damages exceed ₱20,000 but do not exceed ₱100,000	₱500
Each succeeding ₱100,000 of claimed damages, or fraction thereof	₱500
Legal Research Fund fee	1% of the filing fee, but not less than ₱10
Motion for reconsideration	₱500

Submit the Service Request and Assessment Form available on the NPC forms page. Let the NPC assess the exact amount, particularly when claiming damages. The Citizen’s Charter states that the NPC may send a LandBank Link.Biz.Portal payment link after assessment; in-person payment may be made through the NPC cashier. Follow only payment instructions received through official NPC channels and submit proof of payment as directed.

The NPC presently advises that cash or over-the-counter filing-fee payments are not accepted on Fridays; Friday payments must be made through Link.Biz. Check the NPC homepage for current work and payment advisories.

No further action will ordinarily be taken until the assessed fees are paid. Qualifying indigent complainants may be exempt. Under the fee schedule, the applicant and immediate family must have gross income not exceeding twice the applicable monthly minimum wage and must not own real property with a fair market value above ₱300,000. Required proof includes a barangay or DSWD certificate of indigency, supporting notarized affidavits, and the current tax declaration, if any. Government complainants may also qualify for exemptions under the procedural rules. The NPC may waive the fee on motion for good cause.

What happens after filing

The NPC should assign the complaint to an investigating officer within five calendar days after receipt. During pre-investigation, the officer generally has 30 calendar days from receipt to give the complaint due course or recommend outright dismissal.

A complaint may be dismissed without prejudice when it:

Does not comply with the required form and contents.
Fails to show that the respondent was first given an opportunity to act, without adequate justification.
Does not concern a Data Privacy Act violation, privacy violation, or data breach.
Contains insufficient information or evidence.
Does not provide enough information to identify or trace the parties despite diligent effort.

If the complaint is given due course, the respondent is generally ordered to submit a verified comment within 15 calendar days. A preliminary conference should then be held no later than 30 calendar days after the period for the comment expires. The conference may address settlement, discovery, simplification of issues, admissions, and preservation of electronically stored information.

Mediation is voluntary and requires both parties’ agreement. If approved, the complaint proceeding may be suspended for up to 90 calendar days while mediation is attempted.

If the case proceeds, the investigating officer may request more evidence, examine relevant systems and procedures, and require simultaneous memoranda. The rules contain deadlines for individual stages, but they do not promise a single fixed period for final resolution. Complexity, service problems, discovery, mediation, additional evidence, and clarificatory proceedings can extend the case.

Monitor the email and physical address listed in the complaint. If either changes while the case is pending, notify the NPC and the other parties within five calendar days. NPC electronic service can be complete upon transmission, notification, or upload, so an unread email may still affect a deadline.

Possible outcomes

Depending on the evidence and applicable law, the NPC may:

Dismiss the complaint.
Order corrective or compliance measures.
Award indemnity concerning personal-data protection or data-subject rights, with the amount determined under the Civil Code.
Impose a temporary or permanent ban on personal-data processing.
Impose administrative fines.
Compel an entity or government instrumentality to take appropriate action.
Recommend prosecution to the Department of Justice when criminal charges appear warranted.

Administrative fines are paid to the government; they are not the complainant’s compensation. A damages claim must be specifically pleaded and supported. Under NPC Circular No. 2022-01, the total administrative fine for a single act resulting in one or more infractions cannot exceed ₱5 million. Criminal prosecution and imprisonment are not automatic results of an NPC complaint; criminal liability must be established in the proper proceedings.

A complainant may request a temporary ban on processing after filing and before the NPC decision becomes final. This is an exceptional remedy requiring a supported motion, a summary hearing, and ordinarily a bond fixed by the investigating officer. Obtain legal assistance if continued processing creates serious and immediate harm.

Filing deadlines and prescription

Do not assume that the 15-day prior-notice period is a deadline for filing. It is ordinarily a condition that must be completed before the NPC gives the complaint due course.

The NPC Rules do not provide one universal incident-to-filing deadline for every administrative complaint. They adopt the prescriptive periods under Act No. 3326 for penal violations of the Data Privacy Act, while related civil, criminal, employment, consumer, and contractual claims may have different periods. Prescription may also depend on the particular offense, discovery, interruption, and the remedy pursued. File promptly and obtain legal advice if the incident is old or another legal deadline may be running.

After an NPC decision, deadlines are short. A decision generally becomes final and executory 15 calendar days from notice unless a timely motion for reconsideration or proper appeal is filed. One motion for reconsideration of a Commission decision suspends the running of that period. An outright-dismissal decision may permit refiling or a motion for reconsideration, depending on its terms. Seek counsel immediately upon receiving an adverse decision rather than waiting until the fifteenth day.

Common mistakes to avoid

Sending an informal inquiry instead of a verified and notarized complaint.
Using an obsolete complaint form.
Failing to notify the respondent first or omitting proof of receipt.
Treating lack of consent as conclusive without addressing other possible lawful bases.
Describing unfair conduct without identifying the personal data and processing involved.
Providing conclusions but no dates, chronology, documents, or witness evidence.
Naming the wrong company, branch, employee, or platform.
Omitting the relief requested.
Failing to disclose a related case in the certification against forum shopping.
Submitting unreadable screenshots, incomplete conversations, expired links, or malware-infected devices.
Overlooking the Service Request and Assessment Form, filing fee, or proof of payment.
Ignoring NPC messages or failing to report a changed email or address within five calendar days.
Publishing sensitive evidence online and causing a second disclosure.

When legal or emergency help is urgent

Seek prompt assistance if:

Identity theft, unauthorized transfers, account takeover, or continuing disclosure is occurring.
Medical, sexual, biometric, financial, children’s, or government-issued data is exposed.
The respondent is deleting evidence or threatening retaliation.
You need a temporary ban on processing.
Several people are affected and coordinated representation is being considered.
You are claiming substantial damages.
The same facts may support criminal, employment, consumer, banking, cybercrime, or civil proceedings.
You receive an NPC dismissal, final decision, or order with a running deadline.

An NPC complaint does not replace an urgent report to a bank, platform, telecommunications provider, employer, local police, the NBI, or another regulator with jurisdiction. If there is immediate physical danger, threats, extortion, stalking, or sexual exploitation, contact law enforcement at once.

Important distinction: complaint versus breach notification

The 72-hour breach-notification rule is primarily an obligation of the personal information controller, not a 72-hour deadline for an affected individual to file a complaint. Organizations submit qualifying breach notifications through the NPC’s Data Breach Notification Management System. An affected person seeking a remedy should use the complaint process described above.

If an organization tells you that it reported a breach, that does not prevent you from filing a complaint concerning your own affected data, its security measures, its notification, or its response to you.

FAQ

Do I need a lawyer?

No lawyer is required merely to use the NPC Complaint-Affidavit, and an individual may sign and file personally. A lawyer is advisable for substantial damages, complicated lawful-basis issues, multiple respondents, urgent interim relief, prescription questions, or an appeal.

Can I file immediately without waiting 15 days?

Usually, you must first notify the respondent in writing. You may ask the NPC to waive that requirement for proven good cause or a serious violation, but you must clearly allege and support the exceptional circumstances.

Can I complain if I do not know who leaked the data?

Yes, but state every fact that may help identify or trace the respondent, such as account details, URLs, phone numbers, email addresses, transaction references, platform records, and the entities that previously held the data. A complaint may be dismissed if the parties cannot be identified or traced despite diligent effort.

Can I ask the NPC to delete information from the internet?

You may request appropriate blocking, removal, destruction, or a ban on unlawful processing, but relief depends on the respondent’s control over the data, the lawful basis for processing, applicable exceptions, and the evidence. The NPC cannot guarantee removal from every copy, search result, archive, or third-party account.

Can I recover damages?

The NPC may award indemnity on matters affecting personal-data protection or data-subject rights. State the relief clearly and provide evidence connecting the violation to the loss or injury. Additional filing fees apply to a damages claim, and an award is not automatic.

How long will the case take?

The rules set deadlines for particular stages but no single guaranteed completion date. Keep your contact information current, preserve the complete case file, and respond promptly to every NPC order.

Official sources

This article provides general legal information, not legal advice for a particular case. Facts, documents, other available remedies, and later legal changes can affect the correct procedure and outcome. Official sources and current NPC public instructions were checked on August 2, 2026.