When a lending app uses your contacts, photos, employer details, social media accounts, or private loan information to shame, threaten, or pressure you or your family, the issue is no longer just debt collection. It may be a privacy violation under Philippine law. You can file a complaint with the National Privacy Commission (NPC), but the complaint must be prepared correctly: you need evidence, you usually need to first write to the lending company, and your complaint must be verified or notarized before filing.

What counts as a lending app privacy violation?

A lending app may collect and use some personal data to evaluate a loan, verify identity, service the loan, and collect payment. But it cannot process personal data in a way that is excessive, unauthorized, disproportionate, or unrelated to a legitimate loan purpose.

Common privacy violations by online lending apps include:

Accessing your phone contacts when that access is not necessary for the loan.
Messaging your relatives, friends, co-workers, or employer about your debt.
Creating group chats to shame you or pressure people around you.
Sending your photo, ID, address, or loan information to third persons.
Claiming that your contacts are “co-makers” or “guarantors” when they never agreed to be guarantors.
Using threats, public shaming, edited photos, or reputational attacks as collection tactics.
Continuing to use or disclose your personal data after you objected or requested blocking, erasure, or correction.
Processing your data for purposes not explained in the privacy notice or consent screen.

The government has specifically recognized reports of online lending platforms engaging in harassment, intimidation, public shaming, and unlawful use of personal data in collection practices. A 2026 DICT-NPC-SEC advisory states that unnecessary app permissions, excessive access to contact lists, processing that leads to harassment, and contacting persons other than guarantors for debt collection are prohibited.

The legal basis: your privacy rights under Philippine law

The main law is the Data Privacy Act of 2012, or Republic Act No. 10173. It protects “data subjects,” meaning people whose personal data is being collected, stored, used, disclosed, blocked, erased, or otherwise processed.

Under the Data Privacy Act, you have rights such as:

the right to be informed whether your personal data is being processed;
the right to know the purpose, scope, method, recipients, and storage period of processing;
the right to reasonable access to your personal data;
the right to dispute and correct inaccurate data;
the right to object to certain processing;
the right to erasure or blocking in proper cases;
the right to damages for unauthorized use of personal data. (National Privacy Commission)

For lending apps, the most important NPC issuance is NPC Circular No. 20-01, as amended by NPC Circular No. 2022-02, on the processing of personal data for loan-related transactions. These rules apply to lending and financing companies, persons acting as such, and third-party service providers involved in processing borrower data, whether or not the lending entity has the required authority from the Securities and Exchange Commission (SEC).

This matters because some borrowers are told, “We are not registered,” or “The app is only a platform,” as if that excuses the conduct. It does not automatically remove NPC jurisdiction. If the company, app operator, collector, or service provider processed personal data in connection with a Philippine loan transaction, the NPC may still look into the privacy violation.

NPC complaint vs. SEC complaint: which one should you file?

Many lending app cases involve both privacy violations and unfair debt collection. These are related, but they are not the same.

Issue	File with NPC?	File with SEC?
App accessed your contact list without proper basis	Yes	Possibly
App messaged your contacts about your debt	Yes	Yes, if the lender is a lending or financing company
App threatened, insulted, or shamed you during collection	Yes, if personal data was misused	Yes
Excessive interest, unclear fees, or misleading loan terms	Usually not the main NPC issue	Yes
Unregistered lending company or unauthorized online lending platform	Not the main NPC issue	Yes
Request to block, erase, or stop unlawful use of personal data	Yes	Sometimes, depending on facts
Request to cancel the loan itself	No	Not automatically; depends on contract and applicable financial regulations

The SEC regulates lending and financing companies, and Republic Act No. 11765, the Financial Products and Services Consumer Protection Act of 2022, strengthened consumer protection in financial products and services. (Lawphil) The SEC also uses its iMessage system for public complaints and requests, including complaints involving financing and lending companies. (Securities and Exchange Commission)

In practice, many borrowers file:

an NPC complaint for privacy violations; and
an SEC complaint for unfair debt collection, unauthorized lending activity, disclosure issues, or abusive collection practices.

If the messages contain serious threats, extortion, identity misuse, or cyber harassment, there may also be possible criminal issues under laws such as the Revised Penal Code and the Cybercrime Prevention Act of 2012, depending on the exact facts.

Before filing with the NPC: do this first

1. Preserve evidence immediately

Do not rely on memory. Lending app harassment often happens through texts, calls, group chats, Messenger, Viber, Telegram, WhatsApp, email, and changing phone numbers. Save evidence before the sender deletes messages, changes profile names, or blocks you.

Gather:

screenshots showing the full message, phone number, username, profile, date, and time;
screen recordings showing the conversation thread;
call logs, voicemail, and recordings if legally and safely obtained;
screenshots from relatives, friends, co-workers, or employers who received messages;
affidavits or written statements from people contacted by the app;
the loan agreement, disclosure statement, promissory note, repayment schedule, and privacy policy;
app screenshots showing requested permissions, consent screens, or privacy notices;
Play Store/App Store listing, developer name, website, and customer service details;
proof of payments and account status;
any message where the collector admits using contacts or threatens to contact more people.

For screenshots, capture enough context. A screenshot showing only the insult may be less useful than a screenshot showing the sender, date, time, your name, the app name, and the full threat.

2. Identify the respondent

The respondent is the person or entity you are complaining against. For lending app cases, possible respondents include:

the lending company;
the financing company;
the app operator;
the collection agency;
the specific collector, if identifiable;
responsible officers of a corporation, if they participated in or grossly allowed the violation.

Under the NPC Rules of Procedure, a complaint must identify the respondent, and if the responsible officers of a juridical person participated in or, by gross negligence, allowed the violation, they may also be included as respondents. If you do not know the exact legal name, state the facts that may help identify the respondent, such as app name, developer name, website, phone numbers, payment channels, SEC registration details, and screenshots.

3. Write first to the lending app or its Data Protection Officer

This is a common step people miss.

Under the NPC Rules, a complaint generally will not be given due course unless you show that you informed the personal information controller, personal information processor, or concerned entity in writing about the privacy violation or data breach, and that the entity failed to act timely or failed to respond within 15 calendar days from receipt. The NPC may waive this requirement for good cause or serious cases, such as grave and irreparable damage, lack of a plain and adequate remedy, or patently illegal action.

Your written notice should be simple and specific. Include:

your full name and contact details;
the app name and loan account number, if any;
what happened and when;
the personal data misused;
names or numbers of people contacted;
screenshots or evidence;
what you want them to do.

Example requests:

stop contacting third persons who are not guarantors;
stop disclosing your loan information;
block, erase, or stop unauthorized processing of your contact list or photos;
identify the source of the data used;
provide the name and contact details of the Data Protection Officer;
preserve records, call logs, messages, and collection instructions for investigation;
confirm in writing what corrective action was taken.

Send it by email, in-app support, registered mail, courier, or any channel where you can prove receipt. Save the email, delivery receipt, ticket number, or screenshot of submission.

How to file an NPC complaint against a lending app

Step 1: Download the current NPC complaint form

The NPC has a formal complaint process and uses complaint forms or complaint-affidavit templates. The NPC announced that a new Complaint-Affidavit template took effect on 1 July 2025, and its website reminds complainants to use the improved complaints-assisted form and attach supporting documents. (National Privacy Commission)

Use the current form from the NPC website because old forms may be rejected.

Step 2: Prepare your complaint narrative

Your complaint should tell the story clearly and chronologically.

A strong narrative usually follows this structure:

Who you are. State whether you are the borrower, a contacted relative/friend, an employer, a co-worker, or another affected person.
Who the respondent is. State the lending app name, company name if known, collector name or number, and any known address, email, website, or SEC information.
What personal data was collected or misused. Examples: contact list, photo, address, employer, Facebook profile, ID, debt amount, due date, or phone number.
How the data was misused. Explain if they messaged contacts, created group chats, disclosed debt, threatened posting, or used humiliating statements.
When it happened. Give dates, times, and sequence of events.
Who was affected. Include names or descriptions of contacts who received messages.
What you did before filing. Attach your written complaint to the lending app and proof of receipt or no response after 15 calendar days.
What relief you are asking from the NPC.

Step 3: Attach evidence and witness affidavits

The NPC Rules require the complaint to include material facts and supporting testimonial or documentary evidence, such as documents and witness affidavits, if any. The complaint must also attach correspondence with the respondent and a statement of what action the respondent took, if any.

For lending app cases, useful attachments include:

Evidence	Why it helps
Screenshots of threats or messages	Shows actual content, sender, date, and time
Screenshots from contacted persons	Proves disclosure to third parties
Affidavits of relatives, friends, co-workers, or employer	Confirms they received messages and were affected
Loan documents	Shows relationship with app and account details
Privacy notice or consent screen	Shows what was disclosed or not disclosed
App permission screenshots	Helps show excessive data access
Written notice to DPO/company	Shows compliance with exhaustion requirement
Proof of receipt or no response	Shows the 15-day waiting requirement was met
SEC registration or app store listing	Helps identify the respondent
Payment records	Prevents confusion about the account and timeline

Affidavits should be notarized if possible. For witnesses abroad, a Philippine consular notarization or apostille may be needed depending on where the document is executed and how it will be used.

Step 4: State the relief you want

Be specific. The NPC is not a debt forgiveness office, so avoid making the complaint only about inability to pay. Focus on the privacy violation.

Possible reliefs include:

an order to stop unauthorized processing of your personal data;
blocking, removal, or destruction of unlawfully processed personal data;
a temporary or permanent ban on processing;
deletion of harvested contact lists, photos, or other unnecessary data;
correction of false information sent to third persons;
disclosure of who accessed or received your personal data;
indemnity for damages related to data privacy rights;
administrative fines or enforcement action;
referral to the Department of Justice for possible prosecution under the Data Privacy Act.

The NPC may issue decisions that include indemnity related to personal data protection, a permanent ban on processing, recommendation to the DOJ for prosecution, fines, orders to compel compliance, or other orders enforcing the Data Privacy Act.

For civil damages outside the NPC process, the Civil Code may also be relevant. Articles 19, 20, and 21 require persons to act with justice, honesty, and good faith, and provide liability for damage caused contrary to law, morals, good customs, or public policy. (Lawphil)

Step 5: Verify and notarize the complaint

The NPC Rules require the complaint to be in writing, signed, and verified in the format required by the Rules of Court. It must also include a certification against forum shopping.

In ordinary terms, “verified” means you swear that the allegations are true based on your personal knowledge or authentic records. “Certification against forum shopping” means you disclose whether you have filed another case involving the same issues in any court, tribunal, or quasi-judicial agency.

For Filipinos abroad, the amended NPC Rules specifically state that a non-resident citizen with no authorized representative in the Philippines, or who cannot appoint one, may submit a complaint, provided it is notarized by the Philippine Embassy or Consulate or has an apostille certificate from the country of origin.

Foreigners affected by a Philippine lending app should also expect authentication issues if documents are signed abroad. In practice, foreign notarized documents may need apostille or consular authentication before Philippine agencies accept them.

Step 6: Pay filing fees or request waiver if qualified

The NPC Rules state that no further action on a complaint will be taken unless the appropriate filing fees are paid, except for certain exempt complainants, indigent complainants, or cases where the NPC waives the requirement for good cause.

Check the latest NPC fee schedule before filing because fees and payment procedures may change. If you are indigent, prepare documents supporting indigency, such as a certificate of indigency, income documents, or other proof accepted by the NPC.

Step 7: File with the NPC

The NPC allows filing by personal submission, registered mail, courier, or electronic mail as authorized by the Commission. The official complaint page says a formal complaint must be downloaded, printed, filled out, notarized, and submitted to the NPC in person, by courier, or by scanned email.

The NPC website currently lists its office at the 25th–27th Floor, The Upper Class Tower, Quezon Avenue corner Scout Reyes Street, Brgy. Paligsahan, Quezon City, and lists complaint contact channels including email, hotline, and mobile numbers. Always verify the latest address and complaint email on the NPC website before sending physical or electronic copies. (National Privacy Commission)

When filing by email:

scan the notarized complaint clearly;
use PDF format if practicable;
attach evidence in organized folders or numbered files;
label files clearly, such as “Annex A - Loan Agreement,” “Annex B - Screenshot from Collector,” “Annex C - Message to Employer”;
keep the sent email, delivery status, and any NPC acknowledgment.

Electronic submissions that are illegible, erroneous, or malfunctioning may not be considered by the NPC, so check all attachments before sending.

What happens after filing?

After the NPC receives your complaint, it will be assigned for evaluation. Under the Rules, the NPC raffles or assigns the case to an investigating officer within 5 calendar days from receipt. The investigating officer may give the complaint due course or dismiss it without prejudice within 30 calendar days from receipt if there are grounds such as insufficient form, failure to first give the respondent an opportunity to address the complaint, lack of a DPA issue, insufficient information, or inability to identify or trace parties despite diligence.

If the complaint proceeds, the respondent is required to file a verified comment within 15 calendar days from receipt of the order. The case may then proceed to preliminary conference, mediation if both sides agree, investigation, hearings, position papers, and decision.

Mediation may be available if both parties agree. It may be conducted by videoconferencing or within NPC premises, and the mediation period is generally up to 60 calendar days, extendible for good cause, but not beyond 90 calendar days.

Temporary ban on processing: when the harassment is ongoing

If the lending app continues to message your contacts, post your data, or threaten wider disclosure, you may consider asking for a temporary ban on processing of personal data.

Under the NPC Rules, a complainant may apply for a temporary ban upon filing the complaint or any time before the NPC decision becomes final. A temporary ban may be granted when necessary to preserve the complainant’s rights, protect data subjects, or protect public interest, subject to required facts, bond unless exempted, and summary hearing. The investigating officer must decide the temporary ban application within 30 calendar days from conclusion of the summary hearing, and if issued, the ban remains until final resolution or further order.

This is usually reserved for urgent situations, such as continuing disclosure, repeated harassment of third persons, public posting, or threats to release more personal data.

Common mistakes that cause problems in NPC complaints

Filing only screenshots without a clear story

Screenshots are important, but the NPC also needs to understand what happened. Explain the relationship between the screenshots, the loan, the app, the collector, and the people contacted.

Not writing to the lending app first

Unless your situation falls under an exception, you usually need to show that you first informed the company in writing and waited 15 calendar days for action or response.

Complaining only about the debt amount

The NPC handles privacy violations, not ordinary loan disputes. If the issue is mainly interest, fees, disclosure statement, or abusive collection without personal data misuse, the SEC or another regulator may be the more direct forum.

Not identifying the legal entity

Many lending apps use trade names. The app name may be different from the SEC-registered corporation. Search the privacy policy, loan documents, payment receipts, app store developer page, and SEC records.

Posting the collector’s personal data online

It is understandable to feel angry, but publicly posting someone’s phone number, face, ID, or personal details can create a separate privacy or defamation issue. Preserve evidence for the NPC instead of escalating online.

Ignoring messages sent to third persons

If your relatives, friends, co-workers, or employer received messages, ask them to preserve their own screenshots. Their evidence may be stronger than yours because it directly proves disclosure to third parties.

Special situations

If you are a third-party contact, not the borrower

You may still be a data subject if the lending app processed your name, phone number, profile photo, messages, employer details, or other personal data. Your complaint should focus on how your data was obtained and used without your consent or other lawful basis.

If your employer was contacted

Save the message sent to your employer and get a written statement from the recipient, if possible. Disclosure to an employer can be serious because it may affect reputation, employment, and workplace relationships.

If your contacts were called “guarantors”

A character reference is not automatically a guarantor. A guarantor is someone who expressly agreed to be responsible for the loan in case of default. The 2026 advisory emphasizes the distinction between character references used for identification or verification and guarantors who expressly consented to assume responsibility.

If the lending app is unregistered or no longer on the app store

Still preserve evidence. NPC Circular No. 20-01 covers lending or financing companies and persons acting as such, whether or not they have the required SEC authority. You may also file a separate complaint with the SEC for unauthorized lending activity or unfair collection practices.

If you are abroad

You can prepare the complaint abroad, but pay attention to notarization and authentication. Non-resident Filipino complainants without a Philippine representative may need Philippine Embassy or Consulate notarization or an apostille. Foreign complainants should also expect that affidavits and identity documents executed abroad may need apostille or consular authentication.

Frequently Asked Questions

Can I file an NPC complaint even if I really owe money?

Yes. A valid debt does not give a lending app permission to misuse your personal data. The NPC complaint is about unauthorized or excessive processing, disclosure, harassment using personal data, or violation of data subject rights. It does not automatically erase the loan.

Can a lending app contact my references?

It depends on the purpose and the role of the person contacted. Contacting a character reference for identity verification is different from contacting that person to collect your debt. For debt collection, lending and financing companies should contact only guarantors who expressly agreed to assume responsibility for the loan.

Is accessing my phone contacts automatically illegal?

Not every technical permission is automatically a privacy violation, but access to contact lists is highly sensitive in lending app cases. If the app required unnecessary permission, harvested contacts, or used them for harassment or debt collection, that can support an NPC complaint.

Do I need a lawyer to file with the NPC?

The NPC provides complaint forms and a complaints-assisted process, so many complainants file on their own. However, the complaint still needs to be properly written, verified, notarized, supported by evidence, and compliant with NPC procedure.

How long does an NPC complaint take?

Timelines vary. The Rules include early procedural periods, such as 5 calendar days for assignment after receipt, 30 calendar days for initial action or possible outright dismissal, 15 calendar days for respondent’s comment if the complaint proceeds, and up to 90 calendar days for mediation if mediation is approved. Actual duration depends on complexity, evidence, service of notices, respondent participation, and NPC caseload.

Can the NPC order the lending app to stop contacting my contacts?

The NPC can issue orders enforcing the Data Privacy Act, including bans on processing and compliance orders. In urgent cases, a temporary ban on processing may be requested if the requirements are met.

What if the app used different numbers or fake collector names?

List all numbers, names, usernames, payment channels, and screenshots. Explain why you believe they are connected to the lending app. If the legal entity is unknown, state the circumstances that may lead to identification.

Can my relatives or friends file their own NPC complaints?

Yes, if their own personal data was processed or they were directly affected. They may also execute affidavits supporting your complaint. Multiple affected data subjects may sometimes be joined in one complaint if the facts and issues are connected.

Should I file with both NPC and SEC?

Often, yes. File with the NPC for privacy violations and with the SEC for lending company issues, abusive collection practices, unauthorized online lending activity, unfair terms, or financial consumer protection concerns. Be truthful in the NPC certification against forum shopping and disclose related complaints if required.

What if the lending app deletes the messages?

That is why evidence preservation is urgent. Save screenshots, screen recordings, phone logs, app notifications, and third-party screenshots as soon as possible. Ask contacted persons to preserve their own copies before deleting anything.

Key Takeaways

A lending app may violate Philippine privacy law if it uses your contacts, photos, employer details, or loan information for harassment, public shaming, or debt collection outside lawful limits.
The main legal basis is the Data Privacy Act of 2012, supported by NPC Circular No. 20-01 as amended by NPC Circular No. 2022-02.
Before filing with the NPC, you generally need to inform the lending app or its Data Protection Officer in writing and wait 15 calendar days, unless the NPC waives this requirement for serious or urgent reasons.
Strong evidence includes screenshots, full message threads, witness affidavits, loan documents, privacy notices, app permissions, and proof that third persons were contacted.
The complaint must be written, signed, verified or notarized, supported by documents, and accompanied by a certification against forum shopping.
The NPC can order privacy-related relief, including bans on processing, compliance measures, indemnity, fines, and possible DOJ referral, but it does not automatically cancel the loan.
Many online lending cases also justify a separate SEC complaint for unfair debt collection, unauthorized lending activity, or financial consumer protection issues.