If you’ve been bombarded with threatening calls, shaming messages sent to your family and contacts, or public embarrassment orchestrated by an online lending app using your personal data, you have clear rights under Philippine law to fight back. These aggressive collection tactics frequently violate the Data Privacy Act of 2012 because they involve unauthorized or excessive processing of your personal information and that of third parties. The National Privacy Commission (NPC) is the primary government body that investigates and acts on such privacy violations. This article gives you a complete, practical roadmap—from recognizing the violation and gathering evidence to filing a formal complaint, understanding the process, and knowing what results are realistic—so you can take effective action.

Common Harassment Tactics by Online Lending Apps That Violate Privacy Rights

Online lending apps (OLAs) often cross the line when collecting or using personal data. Typical problematic practices include:

Accessing and harvesting your entire phone contact list during app installation or loan application, then using those contacts for collection even when they are not guarantors or references.
Sending shaming or threatening messages, calls, or voice notes to your family, friends, employer, or colleagues, disclosing your loan details or labeling you a “scammer” or “deadbeat.”
Posting or threatening to post your photo, personal information, or debt status on social media, group chats, or public platforms.
Making repeated calls or messages outside reasonable hours, using profane language, or making baseless threats of legal action, arrest, or harm to reputation or property.
Continuing to process or retain your data (and that of your contacts) long after the loan purpose has ended or after you have objected or settled the debt.

These actions usually breach core data privacy principles: purpose limitation (data collected for a small loan cannot be used for aggressive third-party collection), data minimization and proportionality (scraping an entire contact list is excessive), lawful basis (no valid consent or other basis for disclosing your information to non-parties or for harassment), and your data subject rights to object to processing and demand erasure of unlawfully processed data.

Legal Basis: Data Privacy Act and Specific Rules for Lending Apps

The foundation is Republic Act No. 10173, the Data Privacy Act of 2012 (DPA). It protects personal information and sensitive personal information throughout its lifecycle and gives data subjects enforceable rights.

Key supporting rules include:

NPC Circular No. 20-01 (Guidelines on the Processing of Personal Data for Loan-Related Transactions), as amended by NPC Circular No. 2022-02. These explicitly prohibit “unbridled processing” that leads to harassment, debt collection outside the guarantors you provided, or unfair collection practices. Apps must use separate interfaces for character references (verification only) and guarantors (who must give separate consent). They cannot require unnecessary app permissions or use your data in ways that harass.
The March 2026 joint public advisory by DICT, NPC, and SEC, which reiterates these prohibitions and warns OLAs against harassment, intimidation, public shaming, and unlawful use of personal data.

Violations can fall under specific DPA provisions such as unauthorized processing (Section 25), processing for unauthorized purposes, or malicious/unauthorized disclosure (Section 31 and related sections). The NPC can investigate, issue cease-and-desist or compliance orders, impose administrative fines, order data deletion, and recommend criminal prosecution. Past NPC actions have included temporary bans on data processing by dozens of apps, and the Supreme Court has upheld NPC decisions ordering damages and referring cases for prosecution in lending app harassment scenarios.

You also retain civil remedies (damages under the Civil Code) and can pursue parallel reports for criminal aspects (e.g., grave threats or unjust vexation under the Revised Penal Code) with the PNP Anti-Cybercrime Group or a prosecutor.

Preparing Your Case: Strong Documentation and Exhausting Remedies First

NPC complaints require proof of exhaustion of remedies. Before filing, you must inform the lending app or company in writing (email or formal letter with proof of sending and receipt) about the specific privacy violation and give them an opportunity to act. They generally have 15 calendar days from receipt to respond adequately. Attach this correspondence (or proof of no response) to your complaint.

Gather these key pieces of evidence (organized chronologically, with clear labels and timestamps):

Screenshots or screen recordings of all harassing messages, calls, voice notes, or posts—including sender details, dates/times, and content. Note any disclosure of your personal information to third parties.
Call logs or records showing frequency and timing of contacts.
Affidavits from family members, friends, or colleagues who received messages or calls (they can also file their own complaints).
The loan agreement, app terms, privacy notice, and any consent forms you signed or clicked—highlight what you actually consented to.
Proof that the app accessed your contacts (e.g., permission requests, messages from contacts confirming receipt, or app behavior).
Your written demand letter to the app/company and any response (or proof of delivery and silence).
Proof of your identity (government-issued ID) and, if possible, any company or developer details (app name, package name from Play Store, SEC registration if known).

Strong, timestamped, and corroborated evidence significantly increases the chances that your complaint will be given due course.

Step-by-Step Guide to Filing a Complaint with the NPC

Download and complete the official form. Go to the NPC website and download the latest Complaint Affidavit Form (CAF). Fill it out completely and legibly. It requires your full details and those of the respondent (use the exact app name, any known company name or address from your loan documents, or “unknown operators of [App Name]” if needed), a list of the personal information processed, details showing you exhausted remedies, checkboxes for specific DPA violations (e.g., unauthorized processing, malicious disclosure), a clear chronological narration of facts, a list of attached evidence, and the reliefs you seek (investigation, cease-and-desist order, data deletion, administrative fines, damages, etc.). There is also a verification and certification against forum shopping that must be sworn.
Notarize the form. Bring a valid government-issued ID (passport, driver’s license, etc.) to a notary public. Notarization is required.
Prepare supporting documents. Attach clear copies (or scanned PDFs) of all evidence as annexes. Number them and refer to them in your narration. Include proof of exhaustion.
Handle the filing fee. The standard filing fee for a complaint is PHP 500 (plus additional amounts if claiming damages). Pay in advance as instructed. If you qualify as an indigent litigant, you may be exempt—prepare a barangay certificate of indigency, notarized affidavits meeting the income and property thresholds, and supporting documents.
Submit your complaint. Options include:
- Email clear scanned PDFs (including the notarized form and all annexes) to complaints@privacy.gov.ph.
- Send via courier or registered mail.
- File in person at the NPC office: 25th–27th Floors, The Upper Class Tower, Quezon Avenue corner Scout Reyes Street, Quezon City.
Electronic submissions should be in PDF format compliant with paper-efficiency rules. Keep your own complete copies and any tracking details.
Receive acknowledgment. You should receive a reference or docket number. Use it for all follow-ups. The NPC will evaluate sufficiency; insufficient complaints may be dismissed outright, so completeness matters.

What Happens After Filing and Realistic Timelines

The NPC’s investigating officer reviews the complaint for form, substance, and whether it involves a DPA violation with enough basis to proceed. If it passes, the respondent usually receives a copy and is given time (often 15 days) to file a comment or answer. The process may include mediation, further evidence gathering, or hearings (including e-hearings with consent).

In urgent cases involving ongoing harassment, you can request a Temporary Ban or Cease-and-Desist Order (additional requirements and possible bond apply).

Outcomes can include orders to stop all unauthorized processing and contacting of third parties, delete unlawfully processed data (especially contact lists), comply with your data subject rights, pay administrative fines, and in serious cases, referral for criminal prosecution. The NPC has successfully acted against multiple OLAs in the past.

Timelines vary—simple cases may resolve in a few months; complex ones with multiple parties or appeals can take longer. There is no strict statutory deadline like court cases, but acting promptly while evidence is fresh and within the general 6-month window from the violation (factoring in exhaustion) is advisable. Stay organized and responsive to NPC requests for additional information.

Common Pitfalls, Challenges, and Special Situations

Skipping exhaustion of remedies — Almost always leads to outright dismissal. Always send and document the written demand first.
Weak or disorganized evidence — Vague narration or missing proof of third-party contacts or app responsibility weakens the case.
Unidentifiable respondents — Provide every possible identifier (app name, screenshots of the interface, any company details). NPC can still investigate and issue orders even if full corporate details are hard to obtain.
Ongoing vs. past harassment — Request urgent interim relief if harassment continues. Past violations are still actionable for accountability and data deletion.
Foreigners or complainants abroad — You can file via email. If executing documents outside the Philippines, consider apostille or Philippine consulate authentication where required, though initial email submissions are often accepted with clear scans. The DPA applies when personal data is processed in the Philippine context.
Apps that are unregistered or have “disappeared” — Enforcement is harder but not impossible; NPC can still document violations, order cessation where possible, and support other agency actions.
Wanting monetary compensation — NPC can consider damages in some cases and has ordered them in lending app decisions upheld by the Supreme Court, but for substantial claims you may also need a separate civil action in court.
Criminal elements (threats, extortion-like behavior) — File a separate blotter or complaint with the PNP Anti-Cybercrime Group or prosecutor. NPC complaints are primarily administrative/privacy-focused but can lead to criminal referral.

You may also report unfair collection practices to the SEC and cyber-related threats to DICT, NBI, or PNP, but the privacy misuse angle belongs squarely with the NPC.

Frequently Asked Questions

Do I need a lawyer to file with the NPC?
No. Many individuals successfully file on their own using the official Complaint Affidavit Form. The form is designed to be straightforward, though complex cases or those seeking significant damages may benefit from legal assistance.

How much does it cost?
The standard filing fee is PHP 500, plus notary fees (typically PHP 100–300). Additional fees apply for claiming damages or requesting certain interim orders. Indigent litigants can apply for exemption with proper documentation.

How long does the whole process take?
It varies. Initial evaluation is relatively quick, but full investigation and resolution often take several months. Urgent relief like a cease-and-desist order can be sought faster in ongoing harassment situations.

Can the NPC order the app to pay me money?
Yes, in appropriate cases the NPC has ordered damages or considered compensation claims, and courts have upheld such orders against lending apps. The form allows you to request damages as relief.

What if the lending app is foreign-operated or no longer active?
You can still file. Provide all available details. The NPC can investigate processing that occurred in the Philippine context, issue orders where enforceable, and coordinate with other agencies.

Will the app find out I complained?
In most cases, yes. The respondent usually receives a copy of the complaint or an order to comment so they can respond. This is part of due process.

Can family members or contacts who were harassed also file?
Yes. Each affected data subject can file their own complaint or support yours with affidavits. Their personal information was also processed without proper basis when contacted.

Is there a deadline to file?
You should act within a reasonable time. General guidance under the rules points to filing within six months from the violation or shortly after exhausting remedies. Prompt action preserves evidence and strengthens your position.

What evidence is most effective in lending app cases?
Timestamped screenshots and recordings of messages/calls to you and third parties, affidavits from affected contacts, proof the app accessed contacts, your loan documents showing limited consent, and the written demand plus proof of delivery or non-response.

Can I file if I already paid the loan or the debt is disputed?
Yes. Privacy violations are separate from the debt itself. You can still seek orders to delete unlawfully processed data, stop further misuse, and hold the app accountable for past actions.

Key Takeaways

Harassment by online lending apps that misuses your personal data or that of your contacts is often a clear violation of the Data Privacy Act and NPC Circulars on loan-related processing.
Document everything thoroughly with timestamps and third-party corroboration before filing.
Exhaust remedies first by sending a clear written demand to the app or company and keeping proof—this is mandatory.
Use the official NPC Complaint Affidavit Form, notarize it, attach strong evidence, and submit via email, courier, or in person at the Quezon City office along with the PHP 500 filing fee (or indigency exemption documents).
The NPC can order the app to stop the unlawful processing, delete data, cease contacting third parties, and face penalties; serious cases may lead to criminal referral.
Parallel reports to PNP, SEC, or other agencies may be appropriate for criminal threats or unfair collection practices.
Stay organized, follow up with your reference number, and act promptly while evidence is fresh for the strongest possible outcome.

You have practical, enforceable rights. Following these steps gives you the best chance of stopping the harassment and holding the responsible parties accountable under Philippine law.