Quick answer

Generally, no. A lending app may not use a borrower’s phone contacts to call or message relatives, an employer, a former partner, friends, co-workers, or other third parties in order to pressure the borrower into paying.

The National Privacy Commission’s rules are unusually specific on this point. For debt collection, a lending or financing company may contact the borrower and, as far as third persons are concerned, may contact a person who was actually named as a guarantor. Contacting other people found in the borrower’s contact list for collection is prohibited. The NPC’s 2022 amendments also make clear that a character reference is not automatically a guarantor.

This rule was expressly reiterated by the SEC, NPC, and Department of Information and Communications Technology in a joint government advisory issued in March 2026: online lending platforms are prohibited from contacting persons in a borrower’s contact list other than those named as guarantors for purposes of collecting the debt. (National Privacy Commission)

Accordingly:

A relative cannot ordinarily be contacted to demand payment merely because the relative appears in the borrower’s phone.
An employer or co-worker cannot ordinarily be used as a collection channel or told about the loan merely to embarrass or pressure the borrower.
A former boyfriend, girlfriend, spouse, or partner has no special status that permits collection calls. Unless that person independently became a guarantor, the lender generally cannot use that person to collect the borrower’s debt.
A character reference may be contacted for the limited verification purposes allowed by NPC rules, but being a reference does not make that person responsible for the debt.
A genuine guarantor may be contacted regarding collection because the guarantor expressly undertook an obligation connected with the borrower’s default.

Whether a particular communication is lawful can still depend on why the third person was contacted, what information was disclosed, how the lender obtained the information, and whether that person actually agreed to be a guarantor.

The rule on accessing a borrower's contacts

NPC Circular No. 20-01, as amended by NPC Circular No. 2022-02, regulates how lending companies, financing companies, online lending applications, and persons acting for them process personal data in loan transactions.

The amended rules prohibit unnecessary or excessive processing of personal data. An app may obtain access to protected resources only when the access is suitable, necessary, and not excessive for a legitimate purpose.

For contact lists specifically, the NPC describes prohibited “unbridled processing” as processing that is unconstrained, excessive, or disproportionate. The prohibited examples expressly include:

processing that leads to harassment;
processing for collection of debt outside the guarantors provided by the borrower; and
processing that results in unfair collection practices.

A “contact list” is not limited to the phonebook saved on a cellphone. The Circular expressly includes phone contacts, email lists, and social-media contacts.

This means a lending app generally cannot download or exploit hundreds of contacts and then message selected people with statements such as “Tell X to pay the loan,” “X is delinquent,” or similar collection messages designed to expose the borrower’s debt.

The March 2026 joint SEC-NPC-DICT advisory again warned online lending platforms against unauthorized, excessive, or disproportionate processing of borrowers’ contact lists and specifically stated that, for debt collection, persons in the contact list other than named guarantors must not be contacted. (National Privacy Commission)

What if the borrower allowed the app to access contacts?

Granting an app technical permission to access a phone's contacts does not give the lender unlimited authority to use every contact for collection.

The Data Privacy Act requires personal-data processing to comply with the principles of transparency, legitimate purpose, and proportionality. Personal information must be relevant and not excessive in relation to the purpose for which it is processed. (Lawphil)

NPC Circular No. 2022-02 goes further for lending applications. Access to app permissions must be limited to what is necessary, and unnecessary or excessive processing remains prohibited. The Circular specifically restricts the use of contact lists for debt collection.

Therefore, a borrower clicking “Allow Contacts” is not a blanket waiver allowing a lender to shame the borrower before family members, officemates, former romantic partners, or other people in the phonebook.

The app is also required to use separate mechanisms allowing borrowers to choose their own character references and guarantors rather than treating the entire phonebook as a pool of potential collection targets.

When can a character reference be contacted?

A character reference is different from a guarantor.

Under the amended NPC rules, a character reference is someone whose contact information is provided for purposes of verifying the borrower’s identity and the truthfulness of information supplied for the loan application.

The lender must adequately inform the person that:

the person was named as a character reference;
the person's contact information was obtained for that reason; and
the person has the option to have his or her personal data removed as a character reference.

Most importantly, a character reference is not automatically a guarantor.

The NPC allows character references to be contacted for verification of the borrower’s identity and the veracity of information submitted for the loan. The lender cannot simply turn that reference into a collection target after the borrower misses a payment.

So if a borrower listed a sister, officemate, employer, or former partner as a reference, that fact alone does not make the person liable for the loan or authorize repeated collection demands against that person.

When can a guarantor be contacted?

The situation is different when the third person actually agreed to become a guarantor.

Article 2047 of the Civil Code describes a guarantor as a person who binds himself or herself to the creditor to fulfill the principal debtor’s obligation if the debtor fails to do so. (Lawphil)

NPC Circular No. 2022-02 likewise requires the guarantor to have consented to being a guarantor and requires the lending or financing company to obtain the guarantor’s separate consent, consistent with data-privacy requirements.

Consequently, a lender cannot make someone a guarantor merely because:

the person is the borrower’s parent or spouse;
the number appeared in the borrower’s phone;
the borrower identified the person as an emergency contact;
the person was a character reference;
the person once lived with the borrower; or
the lender simply labels the person a “co-maker” during a collection call.

Whether a person is legally bound depends on the documents and the actual undertaking made. Guaranty is not something that should be assumed merely from a personal relationship with the borrower.

Can a lending app contact the borrower's employer?

For debt-collection pressure, generally no, unless the employer or the particular person contacted independently became a guarantor or another lawful basis genuinely applies.

A lender may have a legitimate reason during the loan-application process to verify employment or information supplied by an applicant, provided the processing is lawful, transparent, necessary, and proportionate. That is different from calling the human-resources department, supervisor, receptionist, or co-workers after default and announcing that the employee owes money.

The borrower’s employment relationship does not automatically entitle a private lender to disclose the borrower’s debt to the workplace. The Data Privacy Act requires a lawful basis for processing and disclosure and requires personal information to be handled only for legitimate and proportionate purposes. (Lawphil)

A different analysis may apply where an employer becomes involved through lawful judicial process, such as a valid court order or other legally authorized proceeding. That should not be confused with an app collector independently calling an office to humiliate or pressure a borrower.

Can the lender contact relatives?

A relative is not responsible for another adult’s loan merely because of blood relationship.

A parent, sibling, adult child, cousin, aunt, uncle, or other relative who did not undertake the obligation does not become liable simply because the borrower defaults.

For debt collection, the current NPC rules prohibit contacting persons taken from the borrower's contact list other than named guarantors.

Accordingly, repeatedly calling relatives and telling them to force the borrower to pay may raise both unfair-collection and data-privacy issues, particularly where the lender reveals the borrower’s debt, balance, alleged delinquency, photographs, identification information, or other personal data.

What about a spouse or former partner?

Marriage or a romantic relationship by itself does not turn a person into the borrower’s guarantor.

The same is true for an ex-spouse, former live-in partner, former boyfriend, or former girlfriend. If the person merely remains saved in the borrower’s contacts, the lender does not acquire a right to use that relationship for collection.

If, however, the person separately signed as a guarantor, surety, co-borrower, or other obligor, the legal position may be different. The actual loan and security documents should be examined rather than relying on labels used by a collection agent.

Debt collection is allowed, but harassment is not

A legitimate lender is entitled to seek payment of a valid and enforceable debt. What the law restricts is how collection is carried out.

Republic Act No. 11765, the Financial Products and Services Consumer Protection Act, recognizes the right of financial consumers to fair and respectful treatment and prohibits financial service providers from employing abusive collection or debt-recovery practices. It also requires respect for the privacy and protection of client data. (Lawphil)

For SEC-regulated financing and lending companies, SEC Memorandum Circular No. 18, Series of 2019 specifically prohibits unfair debt-collection practices. The SEC continues to list this Circular among the governing issuances for financing and lending companies. (SEC Appointment System)

The 2026 SEC-NPC-DICT advisory specifically reiterated that unlawful processing includes practices involving threats of violence or other criminal means to harm a person, reputation, or property, as well as threats to take action that legally cannot be taken. (National Privacy Commission)

Using relatives, co-workers, employers, or former partners as instruments of public shaming may therefore involve more than an unpleasant collection call. Depending on the evidence and circumstances, it may implicate regulatory rules on unfair collection as well as the Data Privacy Act.

What to do if a lending app contacts other people about your debt

Take action while the evidence still exists.

Preserve the messages. Screenshot text messages, chat messages, emails, app notifications, social-media messages, and collection notices. Include the sender, date, time, and number or account whenever possible.
Ask the third person to preserve what they received. If your parent, employer, co-worker, or former partner was contacted, ask that person not to delete the message or call log. A written account or affidavit may later be useful.
Document exactly what was disclosed. There is an important difference between a neutral attempt to verify information and a collector announcing your debt, threatening you, circulating your photograph, or demanding that another person make you pay.
Preserve the loan records. Save the loan agreement, disclosure statement, repayment schedule, privacy notice, terms and conditions, screenshots of app permissions, receipts, and your communications with the lender.
Identify the actual lending company. The app's brand name may be different from the corporation operating it. Check the app, loan agreement, privacy notice, and SEC records for the legal entity behind the platform. The SEC maintains information on financing and lending companies and recorded online lending platforms. (Securities and Exchange Commission)
Send a written complaint to the company and its data-protection contact. State which third persons were contacted, when it occurred, what was disclosed, and what remedy you want—for example, stopping third-party contact, identifying the source of the contact information, deleting improperly processed contact data, and preserving collection records.
Revoke unnecessary app permissions. If the app still has access to contacts, photographs, or other resources that are no longer necessary, review your phone's permissions. NPC rules expressly contemplate revoking permissions once their purpose has been completed.
Escalate to the appropriate regulator if necessary. Privacy violations may be brought to the NPC; unfair collection by SEC-regulated lending or financing companies may also be reported to the SEC.

Filing a privacy complaint with the NPC

A borrower—or a relative, employer, former partner, or other person whose own personal data was improperly processed—may potentially be a data subject entitled to complain to the National Privacy Commission.

Under the NPC’s current procedure, a complainant generally must first comply with exhaustion of remedies: inform the respondent in writing of the alleged privacy violation and give the respondent an opportunity to address it. A complaint may proceed where the respondent does not take timely or appropriate action or where there is no response within 15 calendar days from receipt of the written notice, subject to the Rules' exceptions. Proof of compliance should accompany the complaint. (National Privacy Commission)

The NPC currently requires a notarized complaint-assisted form or verified complaint, together with supporting evidence and applicable witness affidavits. The NPC announced that a revised Complaint-Affidavit template took effect on July 1, 2025, so complainants should use the current form available from the NPC rather than an old downloaded copy. (National Privacy Commission)

The NPC's official complaint information is available here:

National Privacy Commission — File a Complaint

Filing a complaint with the SEC

Complaints involving financing companies, lending companies, and their online lending platforms may also fall within SEC jurisdiction.

The SEC's current lending-and-financing-company page lists a complaint mechanism, and its current iMessage system includes the service category “Complaints on Financing and Lending Companies.” (Securities and Exchange Commission)

Official resources:

SEC — Lending Companies and Financing Companies

SEC iMessage Portal

If the app is operated by a bank or another institution supervised by a different financial regulator, the proper regulator may differ. Identify the legal entity behind the app before filing.

Important distinction: illegal collection does not automatically erase the loan

Borrowers should not assume that harassment, unauthorized third-party contact, or a privacy violation automatically cancels an otherwise valid debt.

The lender’s right to demand payment and the lender’s obligation to use lawful collection methods are separate issues.

A borrower may still owe the principal, lawful interest, or other enforceable amounts even though the collector violated privacy or consumer-protection rules. Conversely, owing money does not give a lender permission to disregard privacy law or engage in abusive collection.

If the amount demanded is disputed, preserve the loan documents and request a written accounting rather than ignoring the issue solely because the collection method was improper.

Common mistakes to avoid

Deleting the evidence too early. Block abusive numbers if necessary, but first preserve screenshots, call logs, messages, app details, and the identities of people contacted.

Assuming every reference is a guarantor. NPC rules expressly say a character reference is not automatically a guarantor.

Assuming contact permission means unlimited consent. Access to a phonebook does not override the NPC's restrictions on using contacts for debt collection.

Arguing only by telephone. For regulatory complaints, a written paper trail is much more useful.

Ignoring the underlying loan. Challenge abusive collection separately from any legitimate issue concerning the amount, interest, fees, maturity, or repayment.

Paying an unfamiliar personal account simply to stop harassment. Verify payment instructions through the lender’s legitimate channels and keep proof of every payment.

When legal help is urgent

Seek immediate assistance if collection communications involve credible threats of physical violence, extortion, impersonation of courts or law-enforcement authorities, publication of private photographs, identity theft, large-scale dissemination of your personal information, or threats directed at children, family members, or the workplace.

Urgent advice may also be appropriate where the lender claims that a relative or former partner signed as guarantor or co-borrower but that person denies signing or consenting. The actual documents, electronic records, authentication process, and identity-verification records may need to be examined.

If a genuine summons, subpoena, court order, or other official legal document has been received, do not treat it as an ordinary collection message. Verify it independently and observe any applicable deadline.

Frequently asked questions

Can a lending app call my mother or father because I have not paid?

Generally not for debt collection merely because your parent's number appears in your contacts. If the parent separately and validly agreed to become your guarantor, the situation is different.

Can the collector call my office and tell HR that I owe money?

Ordinary debt-shaming or collection through your employer is generally inconsistent with the restrictions on third-party collection and may raise serious privacy issues. Legitimate employment verification during a loan application is a different purpose and must still comply with data-privacy requirements.

I listed my sister as a character reference. Can collectors demand payment from her?

A character reference is not automatically a guarantor. Under NPC rules, a character reference is principally for verification of identity and the truthfulness of information provided for the loan application.

Can they call my ex because the number is still saved in my phone?

Not for debt collection merely because the number remains in your contact list. A former partner is treated like any other third person unless that person independently undertook a legally relevant obligation, such as becoming a guarantor.

What if I clicked “Allow Contacts” when I installed the app?

That does not authorize indiscriminate collection calls. NPC rules prohibit excessive contact-list processing and expressly restrict debt collection involving persons other than guarantors.

Can a relative complain even though the loan is not theirs?

Potentially yes. If the lender collected or used the relative’s own personal information improperly, that relative may independently be a data subject affected by the alleged privacy violation. The facts and evidence will determine whether an NPC complaint is appropriate. (National Privacy Commission)

Does reporting the lender mean I no longer have to pay?

No. A regulatory or privacy violation does not, by itself, extinguish a valid loan obligation. Questions concerning the debt and questions concerning unlawful collection should be assessed separately.

Official legal sources

This article provides general legal information about Philippine law and is not a substitute for legal advice based on the particular loan documents, communications, parties, and evidence involved. Laws, regulations, administrative procedures, and online filing channels may change. Sources and current government guidance were checked as of August 23, 2026.