If you're being bombarded with calls, texts, or messages from an online lending app — or worse, discovering that the app has contacted your family, friends, colleagues, or posted about your debt on social media — you're not alone. Thousands of Filipinos have faced aggressive debt collection tactics that cross into privacy violations. The National Privacy Commission (NPC) handles complaints precisely for this kind of situation: when personal data is collected, used, or disclosed in ways that cause harassment, shaming, or harm. This article walks you through exactly how to file a complaint with the NPC against an online lending app, based on the Data Privacy Act and the Commission's actual procedures and past cases.

Online lending apps often request broad permissions during installation or loan application — access to your contacts, SMS, call logs, photos, or location. While some data is needed for “Know Your Customer” (KYC) checks or credit assessment, many apps go far beyond what is necessary or what you actually consented to. They then use that data to pressure repayment by reaching out to people in your contact list or making public shaming posts. These practices violate core rules on data minimization, purpose limitation, and security under Philippine law.

Legal Basis for Your Complaint

The primary law is Republic Act No. 10173, the Data Privacy Act of 2012 (DPA). It regulates how personal information is collected, processed, stored, used, and disclosed. Key principles in Section 11 require that processing be transparent, have a legitimate purpose, and be proportionate — not excessive. Section 16 gives you data subject rights, including the right to be informed, to object, to access your data, and to have it corrected or deleted.

Specific violations commonly seen with lending apps include:

Unauthorized processing (Section 25) — collecting or using your contacts or other data without a valid legal basis or proper consent.
Processing for unauthorized purposes (Section 28) — using your data for aggressive collection or shaming instead of the loan-related purpose you agreed to.
Malicious or unauthorized disclosure (Sections 31 and 32) — sharing information about your debt with third parties (your contacts) or publicly.
Failure to implement reasonable security measures (Section 20), allowing data to be misused.

The NPC reinforced these rules with NPC Circular No. 20-01 (Guidelines on the Processing of Personal Data for Loan-Related Transactions), as amended by NPC Circular No. 2022-02. Online lending apps are prohibited from harvesting phone or social media contact lists for debt collection or harassment. They cannot require unnecessary app permissions (full contact access, camera, gallery, location, or SMS) unless strictly necessary for KYC or credit assessment — and even then, they must use “just-in-time” notices and allow you to revoke permissions afterward. The Commission has conducted hearings on hundreds of similar complaints and taken action against non-compliant apps.

The Supreme Court has upheld NPC decisions in cases involving lenders that accessed borrowers’ contact lists and messaged third parties about unpaid loans, confirming that such actions violate the DPA and can result in orders for damages and other remedies.

You can also have overlapping claims under consumer protection laws (such as RA 11765, the Financial Products and Services Consumer Protection Act) or, in severe cases involving threats or public shaming, under the Revised Penal Code or Cybercrime Prevention Act (RA 10175). The NPC focuses on the privacy violation angle, which directly addresses the data misuse enabling the harassment.

Step-by-Step: How to File a Complaint with the NPC

Filing is straightforward but requires preparation. The NPC uses a standardized Complaint-Affidavit form (available on their website) that includes helpful Q&A guidance to make sure you cover the required elements. Complaints that skip required parts or lack evidence are often dismissed outright.

Document everything thoroughly and organize your evidence.
Take clear, dated screenshots of: the app’s permission requests and what you granted, all harassing messages or calls (including those sent to your contacts), any public posts or group messages about your debt, your loan agreement and the app’s privacy policy or terms (these show what you actually consented to), and proof of any damage (e.g., messages from family or employer, emotional distress notes, or lost opportunities). Export chat histories if possible. Ask affected contacts for short affidavits describing what they received and how it affected them. Keep originals safe and make organized copies labeled as Annexes (A, B, C…).
Exhaust remedies first — send a formal written notice to the lending company.
Before the NPC will accept your complaint, you must give the company (the Personal Information Controller) a chance to fix the problem. Send a clear, factual letter or email to their official channels (Data Protection Officer if listed in the app or privacy policy, customer service email, or registered address). State the facts chronologically, identify the specific data misused and how it caused harassment, cite the DPA sections and NPC Circular 20-01, and demand concrete actions: stop all contact with third parties, stop processing or disclosing your data improperly, delete or return your data where appropriate, confirm in writing what data they hold and how it was used, and provide compensation for any harm. Send it via email with read receipt or registered mail/courier with proof of delivery. Keep copies and proof of sending/receipt.
Give them 15 calendar days to respond and act. If they ignore you, give an inadequate response, or continue the harassment, you have satisfied the exhaustion requirement. Attach all correspondence to your NPC complaint.
Download and complete the NPC Complaint-Affidavit form.
Go to the official page at privacy.gov.ph/filing-a-complaint/ and download the current Complaint-Affidavit (with Q&A guidance). Fill it legibly and completely. It asks for your details, the respondent’s details (use the exact legal name of the company — check SEC records or the app’s official documents if needed), a list of personal data processed, tick-boxes for the specific DPA violations, a chronological narration of facts (use the attached Q&A to guide you on what details to include for each violation type), list of attached evidence, and the relief you are seeking (damages, administrative fines, orders to stop processing, compliance with data subject rights, or others). Be factual and specific — dates, exact messages or actions, which contacts were affected, and how it violated the law.
Have the Complaint-Affidavit notarized.
Sign it in front of a notary public and present a valid government-issued ID with photo and signature (passport, driver’s license, UMID, etc.). Notarization turns it into a sworn statement. This is mandatory. If you are abroad, you can usually have it notarized at a Philippine Embassy or Consulate.
Submit your complete complaint package.
Include the notarized Complaint-Affidavit, all evidence annexes, proof of exhaustion (your demand letter and any response or proof of no response), and copies of your ID.
Submission options (confirm current details on the NPC website, as digital options continue to expand):
- Email scanned clear PDFs to complaints@privacy.gov.ph (preferred by many for convenience; follow any instructions for digital signatures or file format).
- Courier or registered mail.
- In person at the NPC office (currently at the 25th–27th Floors, The Upper Class Tower, Quezon Avenue corner Scout Reyes Street, Quezon City — verify the exact location, floor, and hours on privacy.gov.ph/contactus/ or by calling before traveling).
  Electronic submissions must generally be in PDF and comply with paper-efficiency rules. The NPC may charge for printing if needed. Malware-infected files or incomplete submissions will not be accepted.
Follow through.
The NPC will docket your complaint and may ask for additional information or clarification. The respondent will usually be given time to file an answer. Proceedings may include mediation, clarificatory conferences, or e-hearings via video. You can request protective measures or a temporary ban on processing in urgent cases of ongoing harm. Participate actively and respond promptly to NPC requests. Decisions are issued in writing and can include orders for the company to pay you damages, stop the unlawful processing, delete data, pay administrative fines, or face further sanctions. NPC decisions may be appealed to the Court of Appeals.

Common Pitfalls, Challenges, and Real-Life Scenarios

Many complaints are dismissed because the complainant skipped the written notice to the company or submitted vague allegations without strong evidence. Organize your evidence clearly and tie every fact to a specific DPA violation or NPC circular provision. Use the exact legal name of the respondent company.

Delays are common — NPC caseloads can be heavy, especially with lending-related complaints, so resolution often takes several months (sometimes longer). The process is administrative, not a quick police-style intervention, although you can request urgent protective relief.

Scenarios many people face:

The app contacted your employer or relatives even though you never listed them as guarantors or references.
Harassment continues after you partially paid or disputed the debt.
The app or debt was sold to another collector that continues the same practices.
You are an OFW or living abroad — you can still file (the DPA applies if the controller is in the Philippines or processing occurs here). Notarization at a Philippine consulate works; you may need apostille for certain foreign documents used as evidence.
Public shaming posts in Facebook groups or pages — screenshot everything with context and dates.
The company claims you gave “broad consent” in the terms — your evidence of what was actually shown versus what happened, plus the data minimization rules in Circular 20-01, helps counter this.

If the harassment involves clear criminal threats or grave coercion, consider also filing with the PNP Cybercrime Unit or NBI, or seeking a barangay protection order or court injunction alongside the NPC complaint. Many borrowers file parallel complaints with the SEC for unfair collection practices.

Required Documents, Fees, Timelines, and Key Offices

Core documents for your NPC complaint:

Notarized Complaint-Affidavit (using the official NPC form with Q&A)
Proof of exhaustion (demand letter + proof of sending/receipt or no response after 15 days)
Supporting evidence (screenshots, logs, loan documents, privacy policy, witness affidavits) — labeled as annexes
Valid government ID of the complainant (and SPA + Board Resolution/Secretary’s Certificate if filing as a representative of a juridical entity)
Any other documents the NPC requests later

Fees: There is generally no filing fee for a standard data privacy complaint. Possible minor printing fees for digital submissions. Notary fees are your responsibility (typically a few hundred pesos).

Timelines:

15 calendar days for the company to respond to your demand letter.
NPC acknowledgment is usually quick once submitted.
Full investigation and decision: variable, often several months depending on complexity and caseload. Past waves of lending app complaints led to hearings and enforcement actions within months in some cases.

Key office and contacts:
National Privacy Commission — check privacy.gov.ph/contactus/ for the current address (Quezon City tower location) and exact complaint submission details. Email: complaints@privacy.gov.ph. Main line and complaint-specific numbers are listed on the site. Always verify the latest on the official website before acting.

Frequently Asked Questions

Can I still file if I have already paid or settled the loan?
Yes. The privacy violation (unauthorized access to contacts, disclosure to third parties, or excessive processing) is separate from the debt itself. You can still seek orders to stop further misuse, delete data, and obtain damages for the harm caused.

What if the lending app is no longer operating or is foreign-owned?
File against the entity that processed your data. If the company has dissolved or is hard to locate, provide whatever identifying information you have (app name, previous contact details, SEC registration if known). The NPC can still investigate and may coordinate with other agencies. Foreign controllers are subject to the DPA when they process personal data in the Philippines or target Philippine data subjects.

Will filing stop the harassment right away?
Not automatically, but you can request urgent protective measures or a temporary ban on further processing/disclosure in cases of ongoing severe harm. Many borrowers report that formal complaints, combined with a strong demand letter, lead companies to back off. Continue documenting any new incidents.

Can my family members or contacts who were harassed also file complaints?
Yes. Each affected data subject can file their own complaint if their personal information was processed or disclosed without basis. They can coordinate evidence with you.

Is there a time limit to file an NPC complaint?
The DPA and NPC Rules do not impose a strict prescriptive period like some civil actions, but file as soon as possible while evidence is fresh and to prevent further harm. Unreasonable delay without justification can weaken your case.

What can the NPC actually order or award?
The Commission can issue cease-and-desist orders, require deletion or blocking of data, order the company to pay you damages, impose administrative fines on the company, direct compliance with your data subject rights, and recommend criminal prosecution to the proper authorities for serious DPA violations. It cannot directly impose criminal penalties itself but its findings carry significant weight.

Do I need a lawyer to file?
No. The process is designed to be accessible. The official form and Q&A guidance help ordinary people prepare complete complaints. However, if your case is complex, involves large amounts, or you want help with evidence or strategy, consulting a lawyer experienced in data privacy or consumer cases is advisable. Free or low-cost legal assistance may be available through the Public Attorney’s Office (PAO), Integrated Bar of the Philippines chapters, or legal aid organizations.

Can I file anonymously?
Generally no. Complaints must be verified and sworn, and the NPC needs your details to process the case and notify parties. Confidentiality measures may apply during proceedings in sensitive situations.

What happens if my complaint is dismissed?
You may receive an order explaining the reasons (e.g., insufficient evidence or failure to exhaust remedies). You can usually refile with corrected deficiencies or appeal the dismissal if there are legal grounds. Strong documentation from the start greatly reduces this risk.

Can I file complaints with multiple agencies at the same time?
Yes. Many people file with the NPC for the privacy violation, the SEC for lending and collection practices, and law enforcement for any criminal elements. Coordinate your evidence so it is consistent across filings.

Key Takeaways

Online lending app harassment that involves misusing your personal data (especially contacting your network or public shaming) is often a clear violation of the Data Privacy Act and NPC Circular 20-01 — you have a strong basis to complain to the National Privacy Commission.
You must first send a formal written demand to the company and give them 15 days to respond before filing (exhaustion of remedies is mandatory).
Strong, well-organized evidence — screenshots, timelines, proof of third-party contacts, and the company’s own privacy policy — is the single most important factor for success.
Use the official NPC Complaint-Affidavit form (with its built-in Q&A guidance) available at privacy.gov.ph/filing-a-complaint/. Notarize it and submit via email, courier, or in person at the current NPC office.
The NPC can order the company to stop the unlawful processing, pay you damages, delete your data, and face fines or further sanctions. Past cases show real accountability is possible.
Document everything from the beginning, consider parallel complaints to other agencies when appropriate, and verify the latest forms, address, and submission rules directly on the official NPC website before filing.
Acting promptly with complete documentation gives you the best chance of stopping the harassment and obtaining relief.

You have clear rights under Philippine law. Preparing a well-documented complaint puts you in a strong position to hold the company accountable through the National Privacy Commission. Start with thorough documentation and the formal demand letter today — many borrowers in similar situations have successfully used this process to regain control and obtain remedies.