A ground-up guide to your rights, the laws that apply, how to stop abuse fast, where to file complaints, what evidence to keep, and practical templates you can use—without excusing any legitimate debt.

1) What counts as “harassment” by loan apps

Behavior commonly flagged by regulators and courts as abusive or unfair:

Shaming and doxxing: Text blasts to your contacts, employer, or family; posting on social media; group chats labeling you a “scammer.”
Threats and intimidation: Jail threats for civil debt, threats of deportation, bodily harm, or “police arrest in 24 hours.”
Impersonation and deception: Pretending to be from a court, law firm, prosecutor, NBI/PNP, or bank sheriff; fake “case numbers” or “warrants.”
Obscene/abusive language; excessive calls (e.g., dozens per day; calls at late hours).
Coercive collection: Demands for access to your photos/contacts; forced app permissions; locking your device; blackmail using scraped data.
Unfair pricing or rollovers: Hidden fees, unauthorized extensions, and usurious-like “service charges.”

Reminder: Failure to pay a private loan is generally a civil matter. Jail threats for ordinary debt are empty and themselves unlawful (unless tied to a separate crime like estafa with deceit, which must be proven).

2) The legal backbone (key laws that protect you)

Data Privacy Act of 2012 (R.A. 10173)
- Requires valid consent, purpose limitation, proportionality, and security for personal data.
- Unauthorized processing, access, or disclosure (e.g., scraping contacts, texting third parties about your debt) can trigger administrative sanctions and criminal liability.
- You have data subject rights: to object, to access/correct, to erasure/blocking, and to damages.
Lending Company Regulation Act (R.A. 9474) and Financing Company Act (R.A. 8556)
- Lending/financing companies must be SEC-registered and follow fair collection standards.
- The SEC can issue Show-Cause/CEASE-AND-DESIST ORDERS (CDO), suspend/revoke licenses, and penalize unfair debt collection practices (e.g., harassment, shaming, threats, deception).
Civil Code—Abuse of rights and torts (Arts. 19, 20, 21)
- Harassing collection that violates good customs or public policy can support civil damages (moral, exemplary, actual).
Revised Penal Code / Special Penal laws (depending on conduct)
- Grave threats / grave coercion; unjust vexation; libel (including online); identity/authority usurpation.
- Cybercrime Prevention Act (R.A. 10175) aggravates libel/threats done online.
- Access Device or Anti-Wiretapping may apply in niche scenarios (e.g., device compromise, unauthorized recordings).
- Safe Spaces Act if harassment includes sexualized content or gender-based electronic harassment.
Consumer protection / e-commerce & telecom frameworks
- NTC and telcos can block numbers, deactivate SIMs used for spam/harassment (coordinate with SIM Registration rules).
- BSP standards govern banks (if the collector is bank-related), but most loan apps fall under SEC or are illegal/unregistered.

3) First priorities (stop the bleeding)

Preserve evidence now:
- Screenshots of messages/calls (show number, date, time); audio recordings if lawful; call logs; app permission screens; loan agreement; proof of payments; list of persons contacted by the app.
Harden your device:
- Revoke app permissions (contacts, storage, SMS, camera, mic, location).
- Change passwords; enable 2FA; consider uninstalling the app and clearing cached permissions.
- If the app enforces a device lock/super-admin, have a technician remove malware/admin profiles.
Inform your contacts (preempt shaming):
- Brief them that a loan app may send harassing messages; ask them to block/report the sender. (Template in §10.)
Keep paying what you can (if the debt is valid):
- Harassment does not erase the debt. Continue good-faith payments directly to the lender’s official channels. Note payments in your log.

4) Exercise your Data Privacy rights—sample sequence

Right to Object / Cease-and-Desist (C&D) letter to the lender/collector
- Cite R.A. 10173; withdraw consent to process or disclose your contacts and sensitive data for collection beyond direct communication with you.
- Demand stop to third-party disclosures and abusive calls/texts, deletion/blocking of unlawfully obtained data, and a written response in 10 days.
Data Erasure/Blocking request
- Ask them to erase contact list copies and limit processing to what’s necessary to account servicing (your own number/e-mail).
Data Access request
- Ask what data they hold, where obtained, with whom shared, and what security safeguards exist.
File a complaint with the NPC (if non-compliant or harassment persists)
- Attach your requests, their response (or lack thereof), and your evidence set.

5) Hit unfair collectors where it hurts—regulatory complaints

Securities and Exchange Commission (SEC)
- For registered lending/financing companies AND illegal, unregistered loan apps.
- You can ask for investigation of unfair collection, shaming, threats, impersonation, lack of SEC registration, and usurious-like charges.
- Reliefs: CDO, fines, license suspension/revocation, app takedown coordination.
National Privacy Commission (NPC)
- For Data Privacy Act breaches: scraping and using your contacts/photos for shaming, over-collection, data leakage, and failure to honor data subject rights.
- Reliefs: compliance orders, penalties, recommendation for prosecution, and compensation guidance.
NTC / Your Telco
- For SMS/call harassment and spoofing: request number blocking; submit screenshots and logs.
- If harassment comes via OTT (Messenger, WhatsApp): use in-app reporting + platform takedown.
PNP/ACG or NBI-CCD (criminal angle)
- For threats, libel, identity usurpation, extortion, device tampering: file a criminal complaint with your evidence.

File both SEC and NPC complaints if there is harassment and personal-data misuse. They target different violations.

6) Civil and criminal actions you can bring

Civil suit for damages (Arts. 19/20/21, DPA damages)
- Claim moral, exemplary, actual damages for shaming, anxiety, reputational harm; include attorney’s fees.
- If your claim is ≤ ₱1,000,000 (principal damages), consider Small Claims for speed (pure money claims).
Criminal complaints (with prosecutors)
- Grave threats, grave coercion, unjust vexation, libel (or cyber-libel), usurpation of authority, DPA crimes (unauthorized processing, access, or disclosure).
- Attach screenshots, SIM details, and identity proof of the sender (if available). Anonymity is common—still file; agencies can trace.

7) If the app/lender is illegal/unregistered

You may question enforceability of the “contract” and disclaim abusive charges, but courts still recognize unjust enrichment and principal sums advanced.
Strategy: Tender the principal (with a computation sheet) and dispute illegal fees; keep receipts. Simultaneously report to SEC (illegal lending) and NPC (privacy violations).
Avoid cash pick-ups with unknown collectors; pay to traceable channels only.

8) Negotiating a humane repayment (without feeding abuse)

Write a payment plan proposal: fixed amount per payday, fees waived/condoned, no third-party contact.
State you will communicate only in writing/e-mail and during business hours.
Ask for a ledger (principal, interest, fees) and a no-harassment undertaking.
Maintain a communication log (date/time, who called, what was said).

9) What not to do

Don’t send ID photos or selfies to random numbers “to stop the case.”
Don’t click malicious links or install secondary “verification apps.”
Don’t pay via personal e-wallets of collectors—use official accounts.
Don’t sign blank waivers authorizing contact of your phonebook.

10) Plug-and-play templates

A) Cease-and-Desist + Data Privacy Objection (send to the lender and the collector)

Subject: Cease-and-Desist from Harassing Collection / Data Privacy Objection I am [Name, Mobile, Loan/App]. Effective immediately, I WITHDRAW CONSENT to the collection and processing of my contacts, photos, and other data for any purpose other than direct account servicing and lawful billing to me. You are ORDERED TO CEASE (1) contacting my relatives, employer, or phonebook; (2) threatening arrest or legal action for civil debt; and (3) using obscene or abusive language. Pursuant to the Data Privacy Act, I demand within 10 calendar days:

Confirmation of what data you hold and from where obtained;

Erasure/blocking of third-party data scraped from my device;

Your lawful basis for processing and security measures in place. Non-compliance will be reported to the NPC and SEC, with a claim for damages.

B) Notice to Contacts (preempt harassment)

If you receive messages about me from [Loan App], please ignore, block, and report. Those messages violate privacy and consumer laws. I’m addressing the account directly with the lender and regulators.

C) Regulatory Complaint Outline (SEC / NPC)

Complainant: [Name, Address, ID] Respondent: [App/Company Name, numbers used] Facts: Dates of loan; screenshots of harassment; list of contacts texted; proof of app permissions demanded. Violations Alleged: Unfair collection/harassment; unauthorized processing and disclosure of personal data; impersonation of authorities. Relief Sought: CDO; penalties; deletion of unlawfully processed data; confirmation of compliance; coordination for number/app takedown.

D) Payment Plan Proposal

I propose to pay ₱[amount] every [schedule] starting [date] until the principal plus lawful interest is cleared. Please waive abusive fees, stop third-party contacts, and confirm an official account for payment.

11) Evidence checklist (print this)

Screenshots of messages/calls (with numbers, timestamps)
Audio/voicemail (if any) and threat scripts used
App permission screenshots and settings
Loan agreement, ledger, and payment proofs
List of contacts harassed (names/numbers, date/time)
Copies of C&D and data-rights letters (with proof of sending)
Regulatory complaints filed and reference numbers

12) Quick answers

Do I still owe if they violated my privacy? Yes. Harassment ≠ condonation. You can pay what is lawfully due and pursue sanctions and damages for the violations.

Can they send sheriffs or arrest me? No, not for ordinary unpaid consumer debt. Sheriffs act on court writs after a case and judgment. Arrest requires a criminal case with probable cause—not a collector’s threat.

They texted my boss—what can I do? Send C&D; file NPC (privacy breach) and SEC (unfair collection) complaints; consider civil damages for reputational harm; ask HR to document receipt.

The app is clearly illegal—should I stop paying? Avoid windfalls. Tender principal (and reasonable interest if agreed) to traceable channels, dispute illegal charges, and report the app. Courts look for fairness on both sides.

13) Pathways in one view

Stabilize & document → revoke permissions → C&D + data-rights letters
Pay what you can via official channels; propose a plan
File with SEC + NPC (and NTC/telco); PNP/ACG or NBI if threats/libel
Civil damages if harm is significant (consider Small Claims if ≤ ₱1,000,000 principal)
Follow through: keep a log, escalate non-compliance, and—if needed—change numbers/e-mail after filings

Final notes

You can fight harassment and privacy abuse without dodging legitimate debt. Use privacy rights, regulatory enforcement, and civil/criminal remedies in parallel.
The fastest relief often comes from NPC/SEC complaints paired with a realistic payment plan—it shows good faith while cutting off abusive tactics.