If someone posted a photo or scanned copy of your ID online, your first concern is usually practical: remove it before it spreads, preserve proof before it disappears, and file the right complaint without wasting time. In the Philippines, posting another person’s government ID, passport, driver’s license, employee ID, school ID, alien certificate, or similar document may be a data privacy violation, especially when it exposes your full name, address, birthdate, ID number, signature, photo, or other identifying details. This guide explains when the Data Privacy Act applies, what to do immediately, how to file a complaint with the National Privacy Commission, what documents you need, and what other legal remedies may apply.

Why Posting Your ID Online Is a Data Privacy Issue

An ID is not “just a picture.” It usually contains personal information that can identify you directly. Many IDs also contain information issued by government agencies, such as license numbers, passport numbers, SSS/GSIS/PhilHealth-related identifiers, tax-related information, or other unique identifiers.

Under Republic Act No. 10173, or the Data Privacy Act of 2012, “personal information” includes information from which your identity is apparent or can be reasonably and directly ascertained. The law also treats certain government-issued identifiers and records as sensitive personal information, which receives stronger protection. “Processing” is broadly defined and includes collection, recording, storage, use, disclosure, blocking, erasure, and destruction of personal data. Posting your ID online is usually a form of disclosure, use, storage, or other processing of personal data. (National Privacy Commission)

In practical terms, this may cover situations such as:

A lending app, collector, seller, landlord, employer, school, barangay page, condo admin, clinic, or business page posts your ID online.
Someone uploads your ID in a Facebook group, Marketplace conversation, Viber group, TikTok video, X post, Reddit thread, or public Google Drive folder.
A person posts your ID to shame you, accuse you of a debt, warn others about you, “verify” you publicly, or threaten you.
A scammer posts or uses your ID to make people believe they are dealing with you.

The key question is not only “Was my ID posted?” but also who posted it, why, how they got it, where it was posted, how public it was, and what harm it caused or could cause.

Your Rights Under Philippine Data Privacy Law

The Data Privacy Act gives you rights as a data subject, meaning the person whose personal information is being processed. These include the right to be informed, the right to access information about how your data was processed, the right to dispute inaccurate data, the right to suspend, withdraw, block, remove, or order the destruction of personal information in certain cases, the right to be indemnified for damages, and the right to lodge a complaint before the National Privacy Commission. (National Privacy Commission)

The law and its Implementing Rules and Regulations require personal data processing to follow three core principles:

Principle	What it means in an ID-posting case
Transparency	You should know who is using your ID, why, how, and who else can see it.
Legitimate purpose	The posting must have a lawful, declared, and proper purpose, not harassment, public shaming, intimidation, or unnecessary exposure.
Proportionality	Even if there is a valid purpose, exposing the full ID online is usually excessive if a less intrusive method would work.

The Supreme Court emphasized in Zoleta v. Investigating Staff, Internal Affairs Board, Office of the Ombudsman, G.R. No. 258888, April 8, 2024, that personal data must be processed lawfully and fairly, with strict adherence to transparency, legitimacy, and proportionality, and that processing must be adequate and not excessive for its purpose. (Supreme Court E-Library)

When the Data Privacy Act Applies — and When It Can Get Complicated

The Data Privacy Act applies to the processing of personal data by natural and juridical persons in the government and private sector. It may also apply to acts done outside the Philippines if the processing relates to personal data about a Philippine citizen or resident, is done in the Philippines, or has sufficient links to the Philippines. (National Privacy Commission)

However, not every online ID post automatically results in a successful NPC complaint. The law excludes an individual who processes personal information in connection with purely personal, family, or household affairs. This can become an issue when the person who posted your ID is a private individual, not a business, employer, school, lender, association, public office, or organization. (National Privacy Commission)

That does not mean you have no remedy. Depending on the facts, you may still have:

a civil claim for damages under the Civil Code;
a criminal complaint if there is identity theft, cyber libel, grave threats, unjust vexation, extortion, or fraud;
a platform takedown/reporting remedy;
a complaint against the company, office, or organization that obtained or failed to protect your ID.

Article 26 of the Civil Code separately provides that every person must respect the dignity, personality, privacy, and peace of mind of others, and that similar acts may produce a cause of action for damages, prevention, and other relief even when they do not constitute a criminal offense. (Lawphil)

What to Do Immediately After Your ID Is Posted Online

1. Preserve evidence before the post disappears

Do this before sending angry messages, reporting the post, or asking the poster to delete it. Deletion helps stop exposure, but it can also make proof harder.

Save:

screenshots showing the ID image clearly;
the full webpage or app screen showing the poster’s name, username, profile URL, group name, page name, caption, comments, date, and time;
the post URL or permalink;
the number of shares, reactions, comments, or views, if visible;
screenshots of messages where the poster admits uploading or obtaining your ID;
proof of how the poster got your ID, such as an application form, transaction chat, delivery booking, loan application, visitor log, tenant record, employment file, or school record.

For social media posts, take both a close-up screenshot and a wider screenshot showing context. If possible, use another device to record a short screen video scrolling from the profile/page to the post and the ID image.

2. Report the post to the platform

Use Facebook, TikTok, X, Instagram, Reddit, Google, or the relevant platform’s privacy, impersonation, harassment, or doxxing report tool. Platform reports can sometimes remove the post faster than a government complaint.

Keep proof of the report, including the reference number, email confirmation, or screenshot of the submitted report.

3. Reduce the risk of identity theft

If the exposed ID contains information that can be used for financial accounts or government transactions, consider:

changing passwords and enabling two-factor authentication;
notifying your bank, e-wallet, telco, or employer if the ID was linked to account verification;
monitoring suspicious loan, SIM registration, delivery, marketplace, or job-related activity;
requesting replacement or annotation from the issuing agency if the ID number or document is high-risk;
preserving proof of any scam attempts using your identity.

4. Send a written notice to the respondent

Before filing an NPC complaint, the usual rule is exhaustion of remedies. This means you must first inform the respondent in writing about the privacy violation or personal data breach and give them a chance to act. Under the NPC’s rules, the complaint generally will not be given due course unless you show that you informed the respondent in writing and that they failed to take timely or appropriate action, or did not respond within 15 calendar days from receiving your written information. (National Privacy Commission)

Your written notice should be calm and specific. It should state:

what ID was posted;
where it was posted;
when you discovered it;
why you did not consent;
what harm or risk it caused;
what you want done.

Ask for:

immediate takedown or removal;
deletion of copies in their possession;
confirmation of who accessed or received the ID;
assurance that the ID will not be reposted or shared;
explanation of how they obtained and protected your ID;
compensation, if you are claiming damages.

Send the notice by email, registered mail, courier, official business channel, or messaging app where delivery can be proven. Save proof of sending and receipt.

When You May Not Need to Wait 15 Days

The NPC may waive the exhaustion requirement in certain serious situations, such as when there is grave and irreparable damage that can only be prevented or mitigated by NPC action, when the respondent cannot provide a plain, speedy, or adequate remedy, or when the act is patently illegal.

This may matter if your ID is spreading quickly, being used for scams, connected to threats or extortion, or posted by an unknown account that cannot realistically respond.

How to File a Data Privacy Complaint With the National Privacy Commission

The National Privacy Commission, or NPC, is the government agency that receives complaints and investigates violations of the Data Privacy Act. The NPC can receive complaints, conduct investigations, facilitate settlement or mediation, issue orders, impose administrative fines, award indemnity in appropriate cases, issue cease-and-desist orders, and recommend criminal prosecution to the Department of Justice when warranted. (National Privacy Commission)

Step 1: Identify the proper respondent

Name the person, company, agency, association, school, employer, lending app, page owner, or organization that posted or caused the posting of your ID.

If you do not know the person’s real identity, describe what you know:

username or page name;
profile URL;
contact number;
email address;
screenshots of the account;
transaction details;
company or platform involved;
circumstances that may lead to identification.

If a company employee posted your ID, consider naming both the company and responsible officers or employees when the facts show they participated in, authorized, or grossly neglected the violation. The NPC rules allow responsible officers of juridical persons to be included when they participated in, or by gross negligence allowed, the alleged violation.

Step 2: Download and complete the NPC complaint form

The NPC requires a formal complaint in a specific format. Its official complaint page states that a complainant may download the form, print and fill it out, have it notarized, and submit it in person, by courier, or by scanned email to the NPC. (National Privacy Commission)

The complaint must generally be in writing, signed, verified, and must identify the complainant, respondent, contact information, material facts, evidence, and reliefs sought.

Step 3: Prepare your complaint-affidavit or complaint-assisted form

Your complaint should tell a clear story:

Who you are.
Who posted your ID.
What ID was posted.
Where it was posted.
When it was posted or discovered.
How the respondent obtained your ID.
Why the posting was unauthorized, unnecessary, excessive, or harmful.
What you did to ask for removal or correction.
How the respondent replied, ignored you, or failed to act within 15 calendar days.
What remedies you seek.

Possible reliefs include:

removal or takedown of the ID post;
deletion or blocking of personal data;
order to stop further disclosure;
explanation and accounting of who received or accessed the ID;
implementation of security measures;
indemnity or damages, if proven;
recommendation for prosecution, if facts show a criminal violation;
temporary ban or cease-and-desist relief in urgent cases.

Step 4: Attach evidence

The NPC warns that complaints insufficient in form or substance may be dismissed outright, and that complaints should be accompanied by supporting documents and affidavits as evidence. (National Privacy Commission)

Use a numbered set of attachments:

Attachment	Examples
Proof of identity	Your valid ID, passport, or other identification, preferably with unnecessary details redacted in copies
Proof of posting	Screenshots, URLs, screen recordings, printouts
Proof of respondent identity	Profile screenshots, business registration, company emails, transaction records
Proof of prior notice	Demand letter, email, chat, courier receipt, registered mail tracking
Proof of receipt	Seen status, email delivery, signed receiving copy, courier proof
Proof of harm	Scam messages, bank/e-wallet alerts, harassment messages, lost transaction, medical or psychological records if relevant
Witness affidavit	Statement from someone who saw the post, received the ID, or interacted with the poster

For screenshots, write a short label below each one: “Screenshot of Facebook post by [name/page], taken on [date/time], showing my [type of ID] posted publicly.”

Step 5: Have the complaint notarized

The NPC complaint must be notarized. A notarized complaint is treated as a sworn statement, so make sure every factual allegation is accurate and supported by evidence.

For Filipinos abroad, the amended NPC Rules recognize that a non-resident citizen who has no authorized representative in the Philippines, or cannot appoint one, may submit a complaint that is notarized by the Philippine Embassy or Consulate, or with an apostille certificate from the country of origin.

If someone will file for you in the Philippines, prepare a Special Power of Attorney (SPA) authorizing that person to act on your behalf. If executed abroad, the SPA may need consular notarization or apostille, depending on where it is signed and how it will be used.

Step 6: Pay the filing fee and applicable fees

Under NPC Circular No. 2023-01, the filing fee for complaints is ₱500.00. Additional fees may apply for claims of damages, motions for reconsideration, applications for cease-and-desist orders, and related requests.

Item	Amount under NPC Circular No. 2023-01
Filing fee for complaint	₱500.00
Additional fee for damages not more than ₱20,000	₱150.00
Additional fee for damages over ₱20,000 up to ₱100,000	₱500.00
Additional fee for every succeeding ₱100,000, or fraction thereof	₱500.00
Motion for reconsideration	₱500.00
Application for cease-and-desist order	₱1,000.00

Payment procedures can change, especially for online or Friday transactions, so rely on the NPC’s current payment instructions when filing.

Step 7: Submit the complaint

The NPC accepts complaints through the methods stated in its public guidance:

personally;
by registered mail;
by courier;
by electronic mail, as authorized by the Commission.

The NPC’s official complaint guidance states that a notarized complaint may be submitted in person, by courier, or by scanned email to complaints@privacy.gov.ph. Electronic documents should be digitally signed and in PDF format if practicable, and page sizes should comply with the Efficient Use of Paper Rule. (National Privacy Commission)

Step 8: Watch for acknowledgement, docketing, mediation, investigation, and decision

Based on the NPC Citizen’s Charter, online complaint filing includes acknowledgement, checking completeness of documents, assignment of a docket number, preliminary conference, possible mediation, investigation, fact-finding report, adjudication, and enforcement of orders. The Citizen’s Charter shows a one-day target for email acknowledgement, a 30-day step for assigning a docket number, and a total service target of 376 days for the full process in the listed complaint route.

Actual timelines can vary depending on completeness of documents, respondent participation, mediation, complexity of evidence, volume of NPC cases, and whether urgent relief is requested.

Filing Against a Business, Employer, School, Lender, or Government Office

Complaints are usually stronger when the respondent collected your ID for a specific transaction, then used or disclosed it for a different or excessive purpose.

Examples:

A condo admin posts a visitor’s ID in a residents’ group.
A school posts a student ID to discipline or shame a student.
An employer uploads an employee’s ID in a public chat or group.
A lending app or collector posts a borrower’s ID to pressure payment.
A barangay or local office posts an ID without redacting sensitive details.
A clinic, delivery service, recruitment agency, or online seller exposes customer IDs.

In these cases, ask: Why did they collect the ID, what privacy notice did they give, who had access, what safeguards existed, and why was public posting necessary?

For organizations, useful evidence includes privacy notices, application forms, consent forms, terms and conditions, screenshots of the public post, and messages showing that the ID was collected for a limited purpose.

Filing Against a Private Individual

If a private individual posted your ID, the NPC may examine whether that person was acting as a personal information controller or whether the matter falls under personal, family, or household affairs. A public Facebook post, marketplace post, online shaming post, or upload to a large group is harder to characterize as purely private than a limited family chat, but the facts matter.

Even if the NPC route is uncertain, preserve evidence. The same incident may support:

a civil action under Article 26 of the Civil Code;
a criminal complaint for computer-related identity theft under RA 10175 if the ID was acquired, used, transferred, possessed, altered, or deleted without right;
a cyber libel complaint if the post includes defamatory accusations;
a complaint for threats, extortion, harassment, or unjust vexation depending on the messages and conduct.

RA 10175 penalizes computer-related identity theft, including intentional acquisition, use, misuse, transfer, possession, alteration, or deletion of identifying information belonging to another without right. It also recognizes cyber libel when libel under Article 355 of the Revised Penal Code is committed through a computer system or similar means. (Supreme Court E-Library)

When to Go to PNP Anti-Cybercrime Group or NBI Cybercrime Division

File with law enforcement when the ID posting is connected to:

identity theft;
impersonation;
fake accounts;
online loans or unauthorized credit;
threats or extortion;
blackmail;
scams using your name or ID;
defamatory accusations;
hacked accounts;
repeated harassment.

The NPC handles data privacy violations. The PNP and NBI handle criminal investigation. These remedies can proceed separately depending on the facts.

Bring:

printed screenshots and digital copies;
URLs and usernames;
your valid ID;
proof that the ID belongs to you;
proof of unauthorized use;
messages from victims or scammers, if your ID was used in fraud;
proof of financial loss, if any.

Common Mistakes That Can Hurt Your Complaint

Deleting or reporting before preserving evidence

If the post disappears, your case becomes harder. Capture evidence first, then report.

Sending only emotional screenshots

Screenshots should show context: who posted, where, when, and how public it was. A cropped ID image without the account name or URL may be weak.

Skipping the written notice requirement

The NPC generally requires proof that you informed the respondent in writing and waited for action or response within 15 calendar days, unless waiver grounds exist. (National Privacy Commission)

Filing an unnotarized or incomplete complaint

The complaint should be verified, notarized, and supported by evidence. Missing notarization, missing respondent details, or vague allegations can delay or weaken the filing.

Naming only the social media platform

If your complaint is really against the person, business, or office that posted the ID, identify them. A platform takedown report is different from an NPC complaint against the party responsible for the disclosure.

Expecting the NPC to prosecute crimes directly

The NPC can recommend prosecution to the DOJ when there is substantial evidence of criminal acts, but criminal prosecution follows a different process through law enforcement, prosecutors, and courts. (National Privacy Commission)

Practical Tips for Stronger Evidence

Use a simple evidence log:

Date	Event	Evidence
March 1, 8:40 PM	Discovered Facebook post showing my driver’s license	Screenshot A, screen recording A
March 1, 9:10 PM	Reported post to Facebook	Screenshot B
March 2, 10:00 AM	Sent written notice to respondent by email	Email C
March 2, 10:05 AM	Email delivered	Delivery receipt D
March 17	No response after 15 calendar days	Screenshot E
March 18	Prepared NPC complaint	Complaint-affidavit

Keep original files. Do not edit screenshots except to make separate redacted copies for sharing. If you print screenshots, keep the digital originals with metadata when possible.

Special Notes for Filipinos Abroad and Foreigners

Filipinos abroad can file a complaint if their personal data is involved and the case has the required Philippine connection. If they have no authorized representative in the Philippines, the NPC Rules allow notarization through a Philippine Embassy or Consulate, or use of an apostille certificate from the country of origin in the situation covered by the amended rules.

Foreign nationals may also avail of NPC services when their personal data is processed in the Philippines, as reflected in the NPC Citizen’s Charter. (National Privacy Commission)

In cross-border cases, enforcement may be slower if the poster, platform, server, or company is outside the Philippines. Helpful Philippine links include proof that:

the data subject is a Philippine citizen or resident;
the ID was collected in the Philippines;
the respondent is in the Philippines;
the respondent does business in the Philippines;
the post targeted people in the Philippines;
the harm occurred in the Philippines;
a Philippine company, school, employer, lender, landlord, agency, or office was involved.

Frequently Asked Questions

Can I file a data privacy complaint if someone posted my ID on Facebook?

Yes, if the posting involved unauthorized or unlawful processing of your personal data and the facts fall within the Data Privacy Act. Preserve screenshots, URLs, account details, and proof that you asked the poster or responsible organization to remove it.

Do I need to send a demand letter before filing with the NPC?

In most cases, yes. The NPC rules require exhaustion of remedies, meaning you must inform the respondent in writing and give them a chance to act. If they fail to take timely or appropriate action, or do not respond within 15 calendar days, attach proof to your complaint. The NPC may waive this requirement in serious or urgent cases.

What if the post was already deleted?

You can still file if you have enough evidence. Screenshots, screen recordings, witnesses, platform reports, messages, and archived links can help prove that the post existed. The case is harder if there is no proof of the post, so preserve evidence immediately.

Is posting an ID online automatically a crime?

Not always. It may be a data privacy violation, a civil wrong, a cybercrime, or a combination depending on the facts. If the ID was used to impersonate you, scam others, obtain benefits, harass you, or cause harm, criminal laws such as RA 10175 may become relevant.

Can the NPC order the post removed?

The NPC has enforcement powers, including compliance orders, cease-and-desist orders, and temporary or permanent bans on processing personal data in appropriate cases. For immediate removal, also use the platform’s privacy or harassment reporting process.

Can I claim damages for emotional distress or identity theft risk?

You may claim damages or indemnity if you can prove injury caused by unauthorized or unlawful processing. Strong proof includes harassment messages, scam attempts, financial loss, reputational harm, medical or psychological records, missed work, or other documented consequences.

What if the ID belongs to my child?

A parent or authorized representative may file for a minor. The NPC Rules recognize representation for minors and require proof of authority, such as a birth certificate for a parent or a court order for a guardian, depending on the circumstances.

Can I file from abroad?

Yes, if the case has the required Philippine connection. A Filipino abroad may use consular notarization or apostille in the situation covered by the NPC Rules. You may also authorize someone in the Philippines through a Special Power of Attorney.

Should I file with the NPC, PNP, or NBI?

File with the NPC for data privacy violations. Go to the PNP Anti-Cybercrime Group or NBI Cybercrime Division if there is identity theft, impersonation, hacking, threats, extortion, cyber libel, or fraud. In serious cases, both tracks may be relevant.

Key Takeaways

A posted ID may expose sensitive personal information and create real risks of identity theft, harassment, scams, and reputational harm.
Preserve evidence first: screenshots, URLs, account details, dates, comments, shares, and proof of how the poster got your ID.
The usual NPC rule requires written notice to the respondent and a 15-calendar-day opportunity to act, unless urgent waiver grounds apply.
A formal NPC complaint should be written, verified, notarized, supported by evidence, and filed using the NPC’s accepted channels.
The complaint filing fee under NPC Circular No. 2023-01 is ₱500, with possible additional fees for damages claims and urgent applications.
The NPC handles data privacy violations; PNP and NBI handle criminal cybercrime investigation when identity theft, impersonation, threats, or fraud are involved.
Filipinos abroad and foreigners may file when the required Philippine connection exists, but notarization, apostille, and representative authority should be prepared carefully.