If a lending app has been calling, texting, or messaging your relatives, parents, friends, or even your employer about your loan without their consent, this is more than just aggressive collection — it is often a clear violation of Philippine privacy law. Many borrowers, especially overseas Filipino workers whose families back home receive these calls, experience embarrassment, stress, and damaged relationships because of “contact blasting” or debt-shaming tactics. The good news is that you have strong legal protections and concrete steps you can take to stop it.

This article explains exactly why these practices are illegal, which laws apply, how to gather the right evidence, and the practical process for filing a complaint with the National Privacy Commission (NPC) — the primary agency that handles these cases. It also covers parallel options with the Securities and Exchange Commission (SEC) and law enforcement when needed, along with common challenges and real-world considerations for ordinary Filipinos and those abroad.

Why Lending Apps Contacting Your Relatives Without Consent Is Usually Illegal

Lending apps frequently require access to your phone’s contacts during installation or loan application. They then use that information — or the contact details you provided as “references” — to reach out to people who never agreed to be contacted and who have no connection to the debt. These messages often disclose your name, loan amount, due date, or even shaming language to pressure repayment.

Under Philippine law, your personal information (including details about your financial obligations) and the personal information of your relatives (their phone numbers and relationship to you) are protected. Processing or disclosing this data without a lawful basis, such as specific consent or strict necessity, violates the Data Privacy Act of 2012 (Republic Act No. 10173).

The NPC has repeatedly ruled against online lending apps for exactly this behavior: harvesting contact lists and using them to message or call third parties, then discussing the borrower’s debt with them. In several decisions, the Commission found companies liable for unauthorized processing and malicious disclosure, leading to cease-and-desist orders, data deletion directives, administrative penalties, and referrals for criminal prosecution of responsible officers.

In addition, SEC Memorandum Circular No. 18, Series of 2019 (Prohibition on Unfair Debt Collection Practices of Financing Companies and Lending Companies) explicitly bans harassing tactics, public shaming, and the unauthorized disclosure of borrower information to third parties to pressure payment. Legitimate collection must remain professional, confidential where required, and limited to reasonable means. NPC Circular No. 20-01 (Guidelines on the Processing of Personal Data for Loan-Related Transactions), as amended by NPC Circular No. 2022-02, further clarifies that lenders may only contact the borrower and any guarantors or references the borrower specifically designated with informed consent. Broad scraping or blasting of an entire contact list is prohibited.

These rules exist because your relatives never entered into any loan agreement with the app. Their privacy rights cannot be waived by you simply installing the app or granting broad permissions.

Your Rights Under Philippine Law

You have the right to:

Control how your personal information is collected, used, and shared.
Expect that sensitive details about your debt will not be disclosed to third parties without a clear lawful basis.
Demand that companies stop processing data unlawfully and delete information they obtained improperly.
Seek remedies including orders to cease the practice, deletion of data, and accountability for responsible officers.

The Data Privacy Act gives the NPC broad powers to investigate, issue binding orders, impose fines, and recommend criminal charges. Criminal violations (such as unauthorized processing under Section 25 or malicious disclosure under Section 31) can carry imprisonment of one to six years or more and fines ranging from hundreds of thousands to several million pesos, depending on the specific provision violated. Responsible directors, officers, or employees can be held personally accountable.

You also have rights under the Civil Code (abuse of rights and privacy protections) and, in cases involving threats or severe harassment, the Revised Penal Code (e.g., unjust vexation) or the Cybercrime Prevention Act (RA 10175). Many people successfully combine an NPC complaint with other reports for stronger protection.

Step-by-Step Practical Guide to Stopping the Unauthorized Contacts

1. Preserve and Gather Strong Evidence Immediately

Evidence is the foundation of a successful complaint. The most powerful proof usually comes from your relatives themselves.

Ask every person contacted to take clear screenshots of the full message or call log, showing the sender’s number or app name, exact date and time, and the complete content (especially any mention of your name, loan amount, or shaming language).
Have them write a short signed statement describing what they received, how it made them feel, and confirming they never consented to be contacted about your loan or to act as a guarantor/reference.
Screenshot your own phone showing the app’s permission requests or granted access to Contacts, plus any relevant parts of the privacy policy or loan agreement.
Keep records of all communications you received from the app and any prior demands you made.
Organize everything with clear labels (e.g., “Annex A – Message received by mother on [date]”).

Do this quickly — apps and collectors sometimes delete or alter messages later.

2. Revoke App Permissions Right Away

Go to your phone’s Settings > Apps > [Lending App Name] > Permissions. Turn off access to Contacts, Phone, SMS, Storage/Photos, Location, Camera, and any other sensitive permissions. Consider uninstalling the app after you have documented everything. This limits further data harvesting even if you cannot immediately delete your account.

3. Send a Formal Written Demand to the Company (The 15-Day Rule)

Before the NPC will fully process many complaints, you should first give the company a chance to fix the problem. Send a clear, professional demand letter or email to the Data Protection Officer (DPO). You can usually find the DPO’s contact in the app’s privacy policy or on their website. If none is listed, send it to the general support email listed in the app or on Google Play/App Store.

In the letter:

Identify yourself and any loan reference number.
Describe the specific unauthorized contacts (dates, who was contacted, what was said).
State that this violates the Data Privacy Act, NPC Circular 20-01, and SEC MC 18 s. 2019.
Demand: immediate cessation of all contact with third parties regarding your account; written confirmation that their data has been deleted or will not be further processed; and a response within 15 days.
Keep proof of sending (email read receipts or registered mail) and a copy of everything.

Many companies respond or stop once they receive a formal demand. If they ignore it or continue, this strengthens your later complaint.

4. File a Formal Complaint with the National Privacy Commission

If the company does not adequately resolve the issue within 15 days (or if the violations are ongoing and causing serious harm), file with the NPC.

How to file:

The most practical way for most people is to email a sworn Affidavit-Complaint to complaints@privacy.gov.ph.
You can also use the NPC’s e-Complaint System on privacy.gov.ph or file in person at the NPC office (PICC Delegation Building, Roxas Boulevard, Pasay City).
There is no filing fee.

Your complaint should include:

Your complete personal details and contact information.
Details of the respondent (app name, company name if known, DPO or registered address).
A clear, chronological narrative of what happened.
Specific legal violations (cite RA 10173, NPC Circular 20-01 as amended, and SEC MC 18 s. 2019).
A numbered list of attached evidence (Annexes).
The relief you are seeking (e.g., cease-and-desist order on all third-party contacts, deletion of harvested data, damages for distress, referral for criminal prosecution).

You can prepare this yourself. Many people use a detailed letter format sworn before a notary public. For urgent cases involving ongoing severe harassment, you can request interim relief such as a temporary ban or cease-and-desist order.

The NPC will review for completeness (usually within 15 days), investigate, and may conduct mediation or formal proceedings. Decisions typically come within several months, though strong cases with clear evidence can move faster, especially when interim orders are warranted.

5. Consider Parallel Reports to Other Agencies

Securities and Exchange Commission (SEC): File for unfair debt collection practices under MC 18 s. 2019. Email complaints@sec.gov.ph or the appropriate department. The SEC can sanction or revoke the authority of registered lending or financing companies.
Law enforcement: If there are threats, extortion, repeated harassment at unreasonable hours, or public shaming that amounts to defamation, file a blotter at your local barangay or PNP station and report to the PNP Anti-Cybercrime Group (acg@pnp.gov.ph) or NBI Cybercrime Division. This can lead to criminal investigation under the Revised Penal Code or Cybercrime Prevention Act.
Report the app on Google Play or the Apple App Store for violating platform policies on harassment and privacy.

You can pursue these simultaneously with your NPC complaint.

Common Challenges and How to Handle Them

Many borrowers worry that the company will claim “you consented when you installed the app.” NPC and SEC rules are clear that blanket permissions and vague privacy policies do not authorize disclosing your debt details to non-parties or processing your relatives’ data for collection purposes. Purpose limitation and data minimization principles apply strictly.

Identifying the exact company can be difficult with fly-by-night or offshore-operated apps. Use the phone number or sender ID from the messages your relatives received; the NPC and SEC have investigative powers and have acted against many such platforms in the past.

For overseas Filipinos: You can file entirely by email with scanned or photographed evidence and a sworn statement. If you need someone in the Philippines to follow up or appear, execute a Special Power of Attorney (notarized and apostilled if signed abroad). NPC accepts electronic submissions from anywhere.

Filing a privacy complaint does not cancel or forgive a legitimate debt. It targets only the illegal collection method. If you dispute the debt itself (e.g., unauthorized loan, usurious interest, or identity theft), address that separately, possibly with legal advice or through proper channels.

Evidence quality matters enormously. Generic descriptions without screenshots or relative statements are much weaker than specific, timestamped proof showing exactly what was disclosed and to whom.

Frequently Asked Questions

Can lending apps legally access and use my entire phone contact list to collect debt?
No. NPC Circular No. 20-01 (as amended) and the Data Privacy Act prohibit harvesting contact lists for debt collection or harassment. Lenders may only contact the borrower and any guarantors or references the borrower specifically designated with informed consent. Contacting other relatives or friends without their consent violates the law.

Do I still have to pay the loan if I file this complaint?
Yes, if the debt is legitimate and you actually borrowed the money. The complaint addresses the unlawful collection tactics, not the underlying obligation. If you believe the loan was fraudulent, the terms are illegal, or you never received the funds, consult a lawyer or the appropriate regulator about disputing the debt separately.

How long does an NPC complaint usually take?
Acknowledgment is often quick. Full investigation and decision typically take several months, though this varies with case complexity and evidence strength. In cases of ongoing serious harm, you can request faster interim relief such as a cease-and-desist order.

What if the lending app is unregistered or operating illegally?
You can and should still file with the NPC for the privacy violation. Additionally report to the SEC for operating without proper authority. The NPC has taken action against numerous unregistered or abusive apps in the past.

Can my relatives file their own complaint with the NPC?
Yes. Your relatives whose personal data (phone numbers, relationship details) was processed without consent, or who suffered distress from the disclosure of your financial information, have their own rights as data subjects and can file separately or jointly.

Do I need a lawyer to file with the NPC?
No. You can prepare and file the complaint yourself with a sworn statement. For more complex cases or if you want to claim significant damages, consulting a lawyer or availing of free legal assistance from the Public Attorney’s Office (if you qualify) can be helpful.

As an OFW or someone living abroad, can I still file a complaint?
Absolutely. Submit everything by email to complaints@privacy.gov.ph with clear digital copies of evidence and a sworn affidavit. You may appoint a representative in the Philippines through a Special Power of Attorney if needed for follow-up.

What remedies or outcomes are possible?
The NPC can issue a cease-and-desist order stopping all third-party contacts, order deletion of improperly obtained or disclosed data, impose administrative fines, and recommend criminal prosecution of responsible officers. You may also pursue civil damages for emotional distress through appropriate court proceedings. The SEC can impose sanctions on registered companies.

Will the company find out I filed a complaint?
During the NPC’s investigation, the company will likely be asked to explain or respond. This is normal and often leads to faster compliance once they realize regulators are involved.

Key Takeaways

Contacting your relatives about your debt without their consent (and without proper lawful basis) violates the Data Privacy Act of 2012, NPC Circular No. 20-01 as amended, and SEC fair collection rules.
The strongest cases rest on clear evidence — especially detailed screenshots and statements from the people who were actually contacted.
Start by revoking app permissions, then send a formal demand letter giving the company 15 days to stop and confirm compliance.
If unresolved, file a sworn complaint with the National Privacy Commission via email (complaints@privacy.gov.ph), the e-Complaint System, or in person — there is no filing fee.
You can also report to the SEC for unfair collection practices and to law enforcement if threats or severe harassment are involved.
Filing protects your and your family’s privacy rights; it does not erase legitimate debts but stops illegal pressure tactics.
Act promptly to preserve evidence and consider seeking legal advice for your specific situation, especially if the debt itself is disputed or the harassment is severe.

Philippine regulators have successfully acted against abusive lending apps before. With proper documentation and the right filings, you can hold companies accountable and regain peace of mind for yourself and your loved ones.