If a lending app accessed your contacts, sent embarrassing messages to your family or co-workers, used your photo or ID to shame you, or kept collecting and sharing your personal data after you already asked them to stop, you may have grounds to file a complaint with the National Privacy Commission (NPC). In the Philippines, online lending apps are allowed to collect only the personal data that is necessary and lawful for loan-related purposes. They are not allowed to use your phonebook, photos, character references, or private information as weapons for harassment. This guide explains when an NPC complaint is proper, what evidence to prepare, how to file, what fees and timelines to expect, and when you may also need to report the lending app to the SEC, NBI, PNP, or DICT.

What Counts as a Privacy Violation by a Lending App?

A privacy violation happens when a lending app processes personal data in a way that violates the Data Privacy Act of 2012, or Republic Act No. 10173, its implementing rules, or NPC issuances.

“Processing” is a broad legal term. It includes collecting, recording, storing, using, sharing, disclosing, deleting, or otherwise handling personal information. For lending apps, this may involve your:

Name, phone number, address, email, birthday, and employment details
Government IDs, selfies, signatures, bank details, GCash or Maya information
Contact list, call logs, gallery, camera, device information, or location data
Character references, relatives, employer, co-workers, or social media contacts
Loan application details, payment history, and credit-scoring information

A lending app complaint is usually strongest when the problem is not merely “high interest” or “I cannot pay.” The NPC focuses on privacy and personal data violations. The issue is how the lending app collected, used, shared, retained, or disclosed personal data.

Common examples include:

The app accessed your full contact list even though only one or two references were needed.
Collectors texted your relatives, employer, co-workers, classmates, or neighbors about your debt.
The app called or threatened people who were only character references, not guarantors.
Your photo, ID, or “wanted” poster was sent to group chats or posted online.
The app used your gallery, camera, location, or contacts for debt collection or harassment.
The app refused to explain what data it collected or refused to delete data no longer needed.
You were added as a character reference without your consent and then harassed.
The app continued processing your information after the loan was denied, cancelled, or fully paid without a lawful reason.

An unpaid loan does not erase your privacy rights. A creditor may pursue lawful collection, but it cannot use unlawful or excessive data processing to pressure, shame, threaten, or expose you.

Legal Basis: Your Privacy Rights Against Lending Apps

The Data Privacy Act protects borrowers and affected third persons

The Data Privacy Act of 2012 applies to personal information controllers and processors that handle personal data in the Philippines. A lending company or financing company that decides what borrower data to collect and how to use it is generally a personal information controller.

Under the law, personal data processing must follow core principles, especially:

Transparency — you should be told what data is collected, why, how it will be used, who will receive it, and how long it will be kept.
Legitimate purpose — the processing must be for a declared, lawful, and specific purpose.
Proportionality — the data collected must be adequate, relevant, suitable, necessary, and not excessive.

Section 16 of the Data Privacy Act gives data subjects important rights, including the right to be informed, the right to access personal data, the right to correct inaccurate data, the right to object, the right to blocking or removal in proper cases, and the right to indemnity for damages when privacy rights are violated.

The Supreme Court has also recognized informational privacy as a person’s ability to control information about themselves. In Vivares v. St. Theresa’s College, G.R. No. 202666, the Court discussed informational privacy especially in situations where information is collected or used in improper ways.

NPC rules specifically cover online lending apps

The NPC issued NPC Circular No. 20-01, the Guidelines on the Processing of Personal Data for Loan-Related Transactions, after many complaints against online lending apps that accessed contacts, cameras, locations, and storage.

The circular applies to lending companies, financing companies, and persons acting as such, including online lending apps and their service providers. It covers activities such as:

Know-your-customer checks
Creditworthiness assessment
Loan approval
Loan servicing
Repayment and collection
Remedial measures for unpaid loans

The NPC later amended these rules through NPC Circular No. 2022-02. The amendments made the rules clearer for app permissions, contact lists, character references, and guarantors.

Important rules include:

Lending apps must not request unnecessary app permissions.
Permissions should begin only when the information is actually necessary.
Once the purpose is fulfilled, the app must prompt the user to turn off or revoke the permission.
Borrower photos must not be used to harass, embarrass, or shame the borrower.
Unbridled access to a contact list is prohibited.
Contacting people in a borrower’s contact list for debt collection is prohibited unless the person is a true guarantor.
A character reference is not automatically a guarantor.
A guarantor must separately and expressly agree to be bound for the debt.

This is important because many lending apps blur the line between a “reference” and a “guarantor.” Under the Civil Code concept of guaranty, particularly Article 2047 of the Civil Code of the Philippines, Republic Act No. 386, a guarantor binds themselves to answer for another person’s obligation. Merely being named as a reference does not automatically make someone liable for the loan.

The 2026 DICT-NPC-SEC advisory confirms the government focus on abusive lending apps

In the 2026 DICT-NPC-SEC Public Advisory on Online Lending Platforms, the government warned the public about online lending platforms involved in harassment, intimidation, public shaming, and unlawful use of personal data.

The advisory emphasized that:

Unnecessary app permissions are prohibited.
Excessive or disproportionate contact list processing is prohibited.
Contacting non-guarantors for debt collection is prohibited.
Character references may be contacted only for verification, not collection.
Borrower data should be retained only as long as necessary.
Deceptive consent practices, such as pre-ticked boxes or designs that make withdrawal difficult, may invalidate consent.

Before Filing: Do You Need to Contact the Lending App First?

Usually, yes.

Under the 2021 NPC Rules of Procedure, as amended, the NPC generally requires the complainant to first inform the personal information controller, processor, or concerned entity in writing and give it an opportunity to act. If the entity does not respond or take timely and appropriate action within 15 calendar days from receipt, you may proceed with the NPC complaint.

This is called exhaustion of remedies. In simple terms, the NPC wants to see that you first tried to raise the privacy issue directly with the lending app, unless there is a good reason not to.

What to send to the lending app before filing

Your written notice does not need to be complicated. It should clearly state:

Your name and contact details
The app name and loan account, if any
The privacy violation complained of
The date and time of the incident
What personal data was used or disclosed
Who received the messages, calls, posts, or threats
What you are asking the app to do

You may ask the lending app to:

Stop accessing or using your contact list
Stop contacting non-guarantors
Stop using your photo, ID, or private information for collection
Delete personal data that is no longer necessary
Remove posts, messages, or public shaming materials
Identify its data protection officer or privacy contact
Provide a copy of its privacy notice and explanation of processing
Preserve records, logs, call recordings, and collector identities

Send this through a channel you can prove later, such as email, in-app support ticket, registered mail, or a screenshot-confirmed customer service chat. Keep proof of sending and proof of receipt if available.

The NPC may waive the prior notice requirement for good cause or serious violations. For example, if collectors are actively threatening you, spreading your photo, or contacting your employer in a way that worsens every hour, explain in your complaint why immediate NPC action is needed.

Step-by-Step Guide: How to File an NPC Complaint Against a Lending App

1. Identify the lending app and the responsible company

Start by gathering every identifying detail you can find. Many abusive apps use different app names, business names, collector names, and payment channels.

Look for:

App name and app store link
Developer name on Google Play, Apple App Store, or APK source
Company name in the loan agreement, privacy policy, SMS, email, or payment instruction
SEC registration name, if shown
Customer service email, hotline, Viber, WhatsApp, Telegram, or Facebook page
Data protection officer contact, if available
Collector names, numbers, or accounts
Payment account names, bank accounts, e-wallet numbers, or remittance names

If you cannot identify the legal company, do not leave the respondent section vague. State the app name and include all available clues. Attach screenshots of the app store page, privacy policy, loan contract, messages, and payment instructions.

2. Preserve evidence before deleting the app

Evidence is the heart of an NPC complaint. Do not rely only on memory. Capture proof while the messages, posts, permissions, and app pages are still available.

Useful evidence includes:

Screenshots of threatening or shaming messages
Screenshots showing the sender’s phone number, profile, email, or account
Call logs showing repeated collection calls
Screen recordings of the app permissions requested
Screenshots of the app’s privacy notice and consent screens
Copies of the loan agreement, payment schedule, and disclosure statements
Messages sent to your contacts, relatives, employer, or co-workers
Affidavits or written statements from people who received messages or calls
Posts, group chat messages, “wanted” posters, edited photos, or public accusations
Proof that you asked the lending app to stop
The app’s reply, refusal, or failure to respond after 15 calendar days
Proof of payment, full settlement, denied application, or account closure if relevant
Screenshots of the app store listing and developer information

For screenshots, include the full screen when possible, not just cropped messages. The date, time, sender, recipient, phone number, URL, account name, or group chat name can matter.

3. Download the current NPC Complaint-Affidavit form

The NPC requires a specific complaint format. Use the current form from the NPC filing a complaint page or the current NPC Complaint-Affidavit with Q&A.

The form asks for:

Complainant information
Respondent information
The personal information involved
The alleged privacy violations
The date, time, and place of the incident
A narration of facts
Evidence attached
Reliefs requested
Verification and certification against forum shopping

Use the updated form. Old forms may be rejected or may cause delay.

4. Write the facts in chronological order

The NPC does not need dramatic language. It needs a clear timeline.

A practical format is:

When you downloaded the app
What permissions the app requested
What personal data you submitted
Whether the loan was approved, denied, paid, overdue, or disputed
What the app or collectors did
Who received calls or messages
What personal data was disclosed
When you asked the app to stop
Whether the app responded within 15 calendar days
What harm or damage happened

For example:

On 10 May 2026, I downloaded the ABC Loan app from Google Play. The app required access to my contacts and camera before I could submit my loan application. On 15 May 2026, after I missed the payment deadline, collectors using mobile numbers 09xx and 09xx sent messages to my employer and relatives stating that I was a scammer and attaching my profile photo. These persons were not guarantors. On 16 May 2026, I emailed the app requesting them to stop contacting my contacts and delete unnecessary data. No response was received after 15 calendar days.

5. Match the facts to possible Data Privacy Act violations

You do not need to sound like a lawyer, but it helps to connect the facts to the law.

Possible violations may include:

Possible violation	What it may look like in a lending app case
Unauthorized processing	Accessing contacts, photos, gallery, or location without valid consent or lawful basis
Processing for unauthorized purposes	Using KYC photos, IDs, or contact data for harassment or public shaming
Malicious disclosure	Sharing personal data to shame, embarrass, or pressure the borrower
Unauthorized disclosure	Revealing loan details to relatives, employers, co-workers, or group chats
Violation of data subject rights	Refusing access, correction, deletion, blocking, or information requests
Violation of proportionality	Collecting a whole contact list when only specific references were needed
Failure to implement security measures	Allowing collectors or third parties to misuse borrower data

The NPC form includes references to specific Data Privacy Act offenses, such as unauthorized processing, accessing due to negligence, improper disposal, processing for unauthorized purposes, malicious disclosure, and unauthorized disclosure. Choose the items that honestly match your facts.

6. Notarize the complaint and prepare your ID

The complaint must be verified and notarized. Bring a valid government-issued ID when signing before a notary public.

The NPC form recognizes common IDs such as:

Philippine passport
Driver’s license
PRC ID
Postal ID
Voter’s ID
GSIS card
SSS card
TIN card
Student ID

If you are abroad, notarization or authentication may require extra steps. The NPC Rules allow a non-resident Filipino citizen with no Philippine representative to submit a complaint notarized by a Philippine embassy or consulate, or apostilled in the country of origin when applicable.

If someone will file for you, prepare a Special Power of Attorney (SPA). For a company or juridical entity, the representative generally needs an SPA and corporate authority, such as a board resolution or secretary’s certificate.

7. File the complaint with the NPC

According to the NPC’s official filing instructions, a complaint may be submitted:

Personally at the NPC
By courier or registered mail
By scanning and emailing the notarized complaint and attachments to complaints@privacy.gov.ph

The NPC’s listed office is at The Upper Class Tower, Quezon Avenue corner Scout Reyes Street, Quezon City, based on the NPC contact page. Check the official page before visiting because government office locations and receiving arrangements may change.

For electronic filing, prepare the complaint and attachments in PDF when practicable. Use clear file names, such as:

Complaint-Affidavit_JuanDelaCruz.pdf
Annex A_App Store Page.pdf
Annex B_Threatening Messages.pdf
Annex C_Messages to Employer.pdf
Annex D_Written Notice to Lending App.pdf
Annex E_Proof of Non-Response.pdf

Make the evidence easy to follow. A well-organized complaint is easier to evaluate than a folder of random screenshots.

What to Put in the NPC Complaint-Affidavit

Use simple, factual language. The table below shows what the NPC usually needs to understand in a lending app privacy complaint.

Part of complaint	What to include
Complainant	Your complete name, address, email, mobile number, and valid ID
Respondent	App name, company name, developer, email, numbers, website, app store link, collector accounts
Personal data involved	Name, phone number, contacts, photos, ID, address, employer, loan details, messages, location, device data
Violation	Contact list harvesting, public shaming, unauthorized disclosure, excessive permissions, refusal to delete data
Date, time, place	Exact dates and times when possible; if continuing, state the period
Narration	A chronological story of what happened
Evidence	Screenshots, call logs, affidavits, privacy policy, app permissions, demand letter, proof of receipt
Prior notice	Copy of your written complaint to the app and proof of non-response or inadequate response
Reliefs requested	Stop processing, delete data, takedown, damages, administrative fines, recognition of rights violated

Sample reliefs you may ask for

Depending on your facts, you may request that the NPC:

Order the lending app to stop contacting non-guarantors
Order deletion, blocking, or destruction of unnecessary personal data
Order removal of posts, images, or public shaming materials
Declare that the app violated your rights under the Data Privacy Act
Impose administrative fines or other appropriate penalties
Award indemnity or damages when supported by evidence
Issue appropriate orders to prevent continued unlawful processing

Do not ask for relief that has nothing to do with privacy. For example, the NPC is not the usual forum to recompute interest, declare a loan void, or settle the amount of debt. Those issues may belong to the SEC, courts, or another agency depending on the facts.

Fees, Documents, and Timelines

The NPC has a Schedule of Fees and Charges. Fees may change, so always check the latest NPC issuance before paying.

Item	Current practical detail
Filing fee for complaint	₱500
Additional fee if claiming damages	Depends on the amount claimed
Motion for reconsideration	₱500
Application for cease and desist order	₱1,000
Temporary ban bond	Computed under NPC rules, with a stated maximum under the fee circular
Mediation fee	₱500, shared equally by parties applying for mediation
Legal research fee	Generally 1% of filing fee, but not less than ₱10
Indigent complainants	May be exempt if they meet income and property requirements and submit required proof

Typical documents include:

Notarized NPC Complaint-Affidavit
Valid government-issued ID
Evidence and annexes
Proof of written notice to the lending app
Proof of receipt or proof of no response after 15 calendar days
Witness affidavits, if available
SPA, if filing through a representative
Consular notarization or apostille, if applicable for overseas filing

Practical timeline

Stage	Usual timing
Written notice to lending app	Wait 15 calendar days from receipt, unless waiver is justified
NPC initial evaluation	The investigating officer generally has 30 calendar days from receipt to give due course or dismiss without prejudice
Mediation, if approved	May run up to 60 days from preliminary mediation conference, extendible by 30 days, not exceeding 90 days
Temporary ban application	Can add a separate process and may suspend the main complaint while resolved
Full process up to final adjudication	NPC public guidance estimates around 10 to 12 months, depending on complexity

Delays often happen because of incomplete addresses, missing notarization, unclear evidence, failure to show prior written notice, or difficulty identifying the real operator behind the app.

What Happens After Filing

After you file, the NPC’s Complaints and Investigation Division reviews whether the complaint is sufficient in form and substance.

Possible outcomes at the early stage include:

The complaint is given due course.
The complaint is dismissed without prejudice because it is incomplete or premature.
The NPC asks for clarification or additional documents.
The matter may proceed to mediation, investigation, or adjudication depending on the rules and circumstances.

If the case proceeds, the respondent may be required to answer. The NPC may conduct conferences, mediation, investigation, or further proceedings. If the matter is resolved through mediation, the settlement may include deletion of data, takedown of posts, an agreement to stop contacting third parties, payment, apology, or other terms acceptable under the rules.

If the case goes to adjudication, the NPC may issue orders, impose administrative sanctions, award indemnity when proper, or refer matters for possible criminal prosecution when the facts support it.

Temporary ban or urgent relief

If the lending app is actively spreading your data, contacting your employer, posting your photo, or continuing unlawful processing, you may ask for urgent relief such as a temporary ban or cease-and-desist-type remedy when supported by the rules and facts.

This is not automatic. You must clearly show why immediate action is needed, what processing should be stopped, and what harm may continue if the NPC waits for the full case to finish.

Common Mistakes That Delay or Weaken NPC Complaints

Filing without proof of prior notice

The NPC usually requires proof that you informed the lending app first and waited 15 calendar days. If you did not do this, explain why the case involves serious violations or urgent circumstances.

Submitting screenshots without context

A screenshot of a rude message helps, but it is stronger if it shows the sender, date, time, phone number, recipient, and connection to the lending app.

Deleting the app too early

Before uninstalling, record the app name, permissions, privacy policy, consent screens, loan account details, and messages. Once deleted, some information may be hard to recover.

Treating a collection dispute as a privacy complaint

The NPC is not mainly a debt-restructuring agency. Focus on the misuse of personal data: contact harvesting, disclosure, harassment, public shaming, excessive permissions, and refusal to honor data rights.

Naming only the app but not the operator

Many lending apps change names or use third-party collectors. Include all identifying details: developer, company name, payment accounts, phone numbers, email addresses, privacy policy, app store links, and collector accounts.

Using an old form or unsigned complaint

The NPC requires the proper complaint format. A complaint that is not signed, verified, notarized, or supported by required documents may be dismissed or delayed.

Overstating facts

Do not exaggerate. A calm, date-based, evidence-backed complaint is more persuasive than an emotional narrative with unsupported accusations.

Special Situations: Borrowers, References, Guarantors, OFWs, and Foreigners

If you are the borrower

You can file if your own personal data was misused. Even if you owe money, the lending app must still follow the Data Privacy Act and NPC lending app rules. The debt may still be collected through lawful means, but collectors cannot use unlawful disclosure, threats, or public shaming.

If you are only a character reference

You may also be a data subject if your name, number, messages, or other personal information was processed. A character reference may be contacted for verification, but not automatically for collection. You are not automatically liable for the borrower’s debt.

If collectors repeatedly call or text you, disclose the borrower’s debt, pressure you to pay, or threaten you, preserve the messages and consider filing your own NPC complaint as an affected data subject.

If you are a guarantor

A true guarantor is different from a character reference. A guarantor must expressly agree to answer for the borrower’s obligation. Even then, the lending app must still process personal data lawfully and proportionately. Threats, public shaming, excessive disclosure, or harassment may still create privacy and collection issues.

If you are an OFW or Filipino abroad

You may file even if you are outside the Philippines. If you have no Philippine representative, prepare for consular notarization or apostille requirements. If a relative will file for you, execute an SPA and include clear authority to file, sign, receive notices, and act in the NPC case.

If you are a foreigner

The Data Privacy Act can protect foreign nationals when the processing has a Philippine connection, such as when the lending company operates in the Philippines, uses equipment in the Philippines, maintains a Philippine office or agent, or processes data involving Philippine residents or transactions.

In your complaint, explain the Philippine link clearly. Attach evidence that the app operates in the Philippines, targets Philippine borrowers, uses Philippine payment channels, has a Philippine address, or is connected to a Philippine lending or financing company.

NPC Complaint vs SEC Complaint vs NBI, PNP, or DICT Report

Some lending app cases involve more than one legal issue. An NPC complaint is for privacy violations, but other agencies may handle lending regulation, cybercrime, threats, or scams.

Problem	Possible forum
Contact list harvesting, unauthorized disclosure, public shaming, misuse of photos or IDs	NPC
Unfair debt collection by lending or financing company	SEC, especially through SEC iMessage
Violation of SEC collection rules	SEC under issuances such as SEC Memorandum Circular No. 18, Series of 2019
Threats, extortion, identity misuse, cyber harassment, fake posts, scams	NBI Cybercrime Division, PNP Anti-Cybercrime Group, or DICT Cyber Hotline
Pure dispute over loan amount, interest, or payment	SEC, courts, or other proper forum depending on the facts
Defamation, threats, coercion, or harassment	Possible criminal, civil, or cybercrime remedies depending on the act

Some acts may fall under the Revised Penal Code, such as grave threats, unjust vexation, coercion, libel, or slander, and may become cyber-related when committed through information and communications technology under the Cybercrime Prevention Act of 2012, or RA 10175. Privacy complaints and criminal complaints are separate. Filing one does not automatically resolve the other.

Frequently Asked Questions

Can I file an NPC complaint even if I still owe the lending app money?

Yes. Owing money does not waive your privacy rights. The lending app may pursue lawful collection, but it cannot unlawfully access your contacts, shame you publicly, disclose your debt to non-guarantors, misuse your photos, or process excessive personal data.

Can a lending app message my contacts?

A lending app cannot use your entire contact list for debt collection. Under NPC rules, character references are generally for verification. For collection, the app may contact a true guarantor, but a character reference is not automatically a guarantor.

What if I clicked “Allow Contacts” or agreed to the app’s terms?

Consent must be freely given, specific, informed, and limited to a lawful purpose. A broad “allow contacts” button does not automatically justify unbridled harvesting, harassment, public shaming, or contacting non-guarantors. Deceptive or excessive consent practices may also be questioned.

Do I need a lawyer to file with the NPC?

The NPC complaint process is designed so individuals can file using the official Complaint-Affidavit form. A lawyer is not strictly required for a basic complaint, but legal help can be useful if the case involves large damages, multiple respondents, criminal issues, foreign documents, or complex evidence.

Can a character reference file a complaint?

Yes, if the character reference’s own personal data was processed or misused. For example, if collectors repeatedly contacted you, disclosed the borrower’s debt, threatened you, or used your number beyond verification, you may be an affected data subject.

Where do I email an NPC complaint?

The NPC’s official complaint email is complaints@privacy.gov.ph. Attach the notarized complaint-affidavit, valid ID, and evidence. Check the NPC complaint filing page for the current form and latest instructions before submitting.

How long does an NPC complaint take?

Initial evaluation generally happens within 30 calendar days from receipt, but the full process can take months. NPC public guidance estimates around 10 to 12 months up to final adjudication, depending on complexity, mediation, temporary relief applications, and the parties’ submissions.

Can I ask the NPC to make the lending app delete my data?

Yes, if the facts support it. You may request blocking, removal, destruction, takedown, or cessation of unlawful processing. The NPC will evaluate whether the data is still necessary, whether there is a lawful basis to retain it, and whether your rights under the Data Privacy Act were violated.

What if the lending app is not registered or I cannot find the company name?

Still gather and submit all identifying evidence: app name, app store link, developer name, screenshots, payment accounts, collector numbers, privacy policy, loan documents, and messages. You may also report lending or financing violations to the SEC and cyber-related threats or scams to the proper cybercrime authorities.

Should I uninstall the lending app immediately?

Preserve evidence first. Take screenshots or recordings of the app permissions, account page, privacy notice, loan details, messages, and settings. After preserving evidence, you may revoke unnecessary permissions through your phone settings and uninstall the app if needed for your safety and privacy.

Key Takeaways

The NPC handles privacy violations by lending apps, especially unauthorized processing, excessive app permissions, contact list misuse, public shaming, and unlawful disclosure.
A lending app cannot treat your entire phonebook as a collection tool.
A character reference is not automatically a guarantor.
Before filing, you usually need to notify the lending app in writing and wait 15 calendar days, unless serious or urgent circumstances justify waiver.
Use the current NPC Complaint-Affidavit form, notarize it, attach a valid ID, and organize your evidence clearly.
The basic NPC complaint filing fee is currently ₱500, with possible additional fees depending on damages and other applications.
NPC cases can take months, but urgent relief may be available when unlawful processing is ongoing.
Privacy complaints may be filed separately from SEC complaints, cybercrime reports, or other remedies when the facts involve unfair collection, threats, scams, or harassment.