Quick answer

Posting another person’s identifiable information online without consent may violate Philippine law, but the absence of consent does not automatically make every post unlawful.

Under the Data Privacy Act of 2012, disclosure or online publication is a form of personal-data processing. It generally requires a lawful basis and must remain transparent, for a legitimate purpose, and proportionate. Consent is one lawful basis, but it is not the only one. Processing may sometimes be justified by a contract, legal obligation, vital interests, a public-authority function, or a legitimate interest that is not overridden by the person’s fundamental rights.

A stronger case for removal or legal action usually exists when the post exposes private contact or location details, identification records, medical or educational information, intimate material, private messages, information obtained through unauthorized access, or data used to threaten, shame, impersonate, defraud, stalk, or endanger someone.

The available remedies may include:

A written demand for removal, blocking, correction, and disclosure of the source and lawful basis;
A privacy complaint before the National Privacy Commission (NPC);
A request for a temporary or permanent ban on further processing;
A civil action for damages, prevention, and other appropriate relief;
A criminal complaint when the facts constitute unauthorized processing or disclosure, cybercrime, voyeurism, harassment, identity theft, defamation, violence against women or children, or another offense; and
In exceptional cases involving a threat to life, liberty, or security, a petition for a writ of habeas data.

Preserve the evidence before requesting takedown. If the post reveals a home address, real-time location, intimate material, a child’s sexual content, or accompanies threats, stalking, impersonation, or extortion, seek police or legal assistance immediately.

What counts as protected personal information?

“Personal information” includes information from which a person is apparent or can reasonably and directly be identified, or which—when combined with other information—would directly and certainly identify that person. Examples include:

Name, photograph, voice, signature, username, and contact details;
Home, work, or school address and real-time or habitual location;
Birth date, age, marital status, and family information;
Identification numbers, identification-card images, and account details;
Private messages, transaction records, and employment information; and
A combination of details that identifies a person even if the name is omitted.

“Sensitive personal information” receives stricter protection. It includes information about a person’s health, education, sexual life, race or ethnic origin, religious or political affiliations, legal proceedings, alleged or actual offenses, and certain government-issued records or identifiers.

A photograph is ordinarily personal information when the person is identifiable. Its context may make it sensitive—for example, when it reveals a medical condition, school record, religious affiliation, sexual life, or involvement in legal proceedings. The NPC has expressly reminded the public that sharing identifiable photos and videos must have a lawful basis and comply with transparency, legitimate purpose, and proportionality. See the NPC’s Reminder on Sharing Photos and Videos Containing Personal Data.

Lack of consent is important, but it is not the only legal test

When consent may not be necessary

For ordinary personal information, Section 12 of the Data Privacy Act allows processing without consent when another statutory basis applies, such as:

Necessity for a contract with the data subject;
Compliance with a legal obligation;
Protection of vitally important interests, including life and health;
Response to a national emergency or performance of a public-authority function; or
A legitimate interest of the controller or a third party, unless overridden by the data subject’s fundamental rights and freedoms.

Even then, the person or organization posting the information must still comply with the general privacy principles. A lawful purpose does not justify posting information that is irrelevant, excessive, misleading, unfairly obtained, or retained longer than necessary.

Sensitive personal information is subject to the narrower exceptions in Section 13. “Legitimate interest” is not listed as a general basis for processing sensitive personal information.

Publicly available does not mean free for every use

Posting information publicly yourself does not give everyone blanket permission to reuse, compile, republish, or exploit it for unrelated purposes. The NPC’s Guidelines on Consent state that publicly available information still requires a lawful basis under the Data Privacy Act. Its 2026 Guidelines on Data Scraping of Publicly Available Personal Data likewise clarify that public availability is not consent to processing beyond purposes reasonably contemplated when the information was provided.

Consent to send a photograph privately is not necessarily consent to post it publicly. Consent for one purpose also does not automatically cover a materially different purpose.

Important exclusions and competing rights

The Data Privacy Act contains exclusions for specified government-employment and government-contract information, certain discretionary government benefits, processing for journalistic, artistic, literary, or research purposes, and information necessary for public authorities to perform their legal mandates.

Freedom of speech, freedom of the press, access to information on matters of public concern, fair reporting, legal claims, and compliance with court or government processes may also affect the result. These are not blanket excuses to expose unnecessary private details. The status of the person, source of the information, public interest involved, truth or falsity of

Quick answer

Posting someone’s personal information online without consent may violate Philippine law, but lack of consent alone does not automatically make every post unlawful.

The result depends on:

what information was posted;
how it was obtained;
who posted it and for what purpose;
whether another lawful basis allowed the disclosure;
whether the post was excessive, malicious, defamatory, sexual, threatening, or harmful; and
whether a special law applies.

Names, photographs, addresses, phone numbers, identification details, messages, school records, medical information, financial data, location information, and similar details may be protected personal data. Their online disclosure is a form of “processing” under the Data Privacy Act of 2012.

A person affected by an apparently unlawful post should preserve evidence, report the content to the platform, send a written removal or privacy-rights request, secure exposed accounts, and consider a complaint before the National Privacy Commission (NPC). Police, prosecutorial, civil-court, or protective remedies may also be available when the post involves intimate images, harassment, threats, identity theft, defamation, domestic abuse, or a child.

When a post may violate the Data Privacy Act

The Data Privacy Act requires personal-data processing to be fair and lawful and to observe transparency, legitimate purpose, and proportionality.

Consent is one lawful basis, but it is not the only one. For ordinary personal information, processing may also be justified when necessary for a contract, compliance with a legal obligation, protection of vital interests, performance of a public function, or a legitimate interest that is not overridden by the data subject’s fundamental rights and freedoms.

Therefore, a post made without consent is more likely to be unlawful when:

there is no other lawful basis for disclosing the information;
the information was obtained through deception, unauthorized access, breach of confidence, or misuse of an organization’s records;
the disclosure is unrelated to the purpose for which the information was collected;
more information was disclosed than reasonably necessary;
the post exposes the person to fraud, stalking, harassment, discrimination, or physical danger;
the poster uses the information to shame, intimidate, pressure, or retaliate against the person;
sensitive personal information is involved; or
the organization ignores a valid request to correct, block, or remove unlawfully processed data.

Consent, when relied upon, must be freely given, specific, informed, and evidenced by written, electronic, or recorded means. Consent to one use does not necessarily authorize public posting or a later, incompatible use. The NPC’s Guidelines on Consent also clarify that information placed on a publicly accessible platform is not covered by blanket consent for every possible purpose.

Similarly, the fact that information is already public does not place it outside data-protection law. The NPC’s 2026 guidance states that public availability does not by itself authorize processing beyond purposes reasonably contemplated when the information was provided, and identifies doxxing intended to harass or intimidate as a harmful use of publicly available data. See NPC Advisory No. 2026-01.

What information receives stronger protection

“Personal information” covers information from which an individual is apparent or can reasonably and directly be identified, including information that becomes identifying when combined with other data.

Examples include:

a person’s name together with a photograph, workplace, school, or account name;
home or work address;
phone number or email address;
live or habitual location;
private messages or correspondence;
signatures, account details, and identification numbers; and
photographs, voice recordings, or videos showing an identifiable person.

“Sensitive personal information” is subject to stricter rules. It includes information concerning a person’s age, marital status, race, ethnic origin, religious or political affiliations, health, education, genetic or sexual life, alleged or proven offenses, and certain government-issued records and identifiers.

A photograph is not always sensitive by itself, but its context may reveal sensitive information—for example, a medical condition, school record, religious affiliation, sexual life, or involvement in a criminal proceeding.

Important exceptions and competing rights

A removal request is not automatically valid merely because the person objects to the post.

The Data Privacy Act contains exclusions for specified government-employment and government-contract information, discretionary government benefits, processing for journalistic, artistic, literary, or research purposes, and information necessary for lawful public-authority functions. Evidence may also be submitted to courts or public authorities when necessary to establish, exercise, or defend legal claims.

Freedom of speech, freedom of the press, public accountability, and the public’s right to information may be relevant, particularly where the material concerns official conduct or a genuine matter of public interest. These rights do not create a general license to publish unrelated private details, false claims, intimate material, or excessive identifying information.

Coverage can also be disputed when a natural person processes information solely in connection with personal, family, or household affairs. Public dissemination, organized shaming, or use beyond a genuinely private household context must be assessed on its actual facts and should not be assumed to be exempt.

What to do immediately

1. Address any safety or financial risk

If the post exposes your home address, current location, passwords, government identification, banking information, or children’s details:

change compromised passwords and enable multi-factor authentication;
contact the bank, e-wallet provider, or account issuer if financial details were exposed;
notify household members, school security, building security, or your employer when there is a credible safety risk;
ask the issuing agency whether an exposed credential should be replaced or monitored; and
contact law enforcement immediately if there are threats, stalking, extortion, impersonation, or an imminent risk of harm.

Do not meet or confront a threatening poster alone.

2. Preserve the evidence before requesting removal

Capture the content while it remains available. Preserve:

full-page screenshots showing the post, account name, date, time, and surrounding context;
the complete URL or direct link;
a screen recording showing how the post is reached;
the poster’s profile URL and visible account identifiers;
comments, shares, reposts, threats, and direct messages;
the original photo, video, email, or message where available;
notices sent to the poster, organization, host, and platform;
platform acknowledgment or case numbers;
names and affidavits of people who personally saw the post; and
proof of harm, such as fraudulent transactions, threatening messages, medical records, counselling expenses, lost work, or security costs.

Keep original files unchanged. Make working copies for annotation and store the originals securely. Do not crop away identifying details from the only copy. Electronic evidence may need to be authenticated under the Rules on Electronic Evidence.

For intimate or child sexual material, avoid creating or circulating unnecessary copies. Preserve only what authorities or counsel advise is necessary and report it promptly.

3. Use the platform’s reporting procedure

Report the content under the most accurate category, such as privacy violation, disclosure of personal information, impersonation, harassment, non-consensual intimate imagery, threats, or child sexual exploitation.

Identify each post or URL separately. Save confirmation emails and report numbers. If copies appear on search engines, request removal from the source site and use the search engine’s applicable privacy or outdated-content procedure. Removal from search results does not necessarily delete the original page.

4. Send a written demand or data-subject request

Write to the poster and, where applicable, the organization’s Data Protection Officer or privacy contact. A useful request should:

identify the exact information and URLs;
explain briefly why the disclosure is unlawful, inaccurate, excessive, or unauthorized;
request removal, blocking, correction, or restriction of further disclosure;
object to continued processing where appropriate;
ask for the source of the data, recipients, purpose, and lawful basis for disclosure;
ask that recipients or reposting parties be notified of any correction or removal where legally appropriate;
request preservation of account, access, disclosure, and complaint-handling records; and
require written confirmation of the action taken.

Send it through a method that proves delivery. Do not include more sensitive information than is necessary to establish your identity and claim.

This written notice is especially important because an NPC complaint ordinarily will not be given due course unless the complainant first informs the controller, processor, or concerned entity in writing and allows it to act. If it takes no timely and appropriate action—or gives no response within 15 calendar days from receipt—the exhaustion requirement is generally satisfied. The NPC may waive it for proven good cause or serious cases involving grave and irreparable harm, an inadequate remedy, or patently illegal conduct.

Filing a complaint with the National Privacy Commission

An affected data subject may complain to the NPC about a privacy violation or personal-data breach. A representative generally needs a special power of attorney, subject to the special rules for parents, guardians, minors, and persons alleged to be incompetent.

Use the NPC’s current Complaint-Affidavit form. The complaint should be complete, verified, and notarized and should include:

the complainant’s and respondent’s identifying and contact information, if known;
a clear chronological narration;
the personal data involved;
the alleged violations and relief requested;
copies of the posts and other supporting evidence;
correspondence showing the prior written notice and the response or lack of response;
witness affidavits, if any; and
the required verification and certification against forum shopping.

If the poster is unknown, state the available circumstances and technical or account details that may lead to identification. A complaint may be dismissed if the responsible parties cannot be identified or traced despite diligence.

The NPC accepts complaints personally, by registered mail, by courier, or by authorized electronic filing. Its current filing page directs scanned complaints to complaints@privacy.gov.ph. Confirm the latest address, form, and payment instructions on the NPC’s complaint page before filing.

The current base filing fee is ₱500, with a legal research fee and possible additional fees for damages claims or interim relief. Qualified indigent complainants may seek exemption. See NPC Circular No. 2023-01.

Under the 2021 NPC Rules of Procedure, as amended in 2024, the NPC may ultimately award indemnity under Civil Code standards, impose administrative fines, order compliance, impose a permanent ban on processing, or recommend prosecution to the Department of Justice. A complainant may also move for a temporary ban on processing while the case is pending, subject to the required factual showing, hearing, and bond unless exempt.

Civil remedies for invasion of privacy

Articles 19, 20, 21, and 26 of the Civil Code may support a civil action when a person’s privacy, dignity, or peace of mind is wrongfully invaded.

Article 26 expressly recognizes causes of action for damages, prevention, and other relief for acts such as meddling with another’s private life or family relations and vexing or humiliating a person because of a personal condition. Depending on the facts, a court may award proven damages and grant preventive relief. A lawyer may also assess whether an injunction or temporary restraining order is legally and practically available.

Do not delay. Civil actions based on injury to rights or quasi-delict are generally subject to a four-year period, while defamation actions generally have a one-year period. The correct period and starting date depend on how the claim is legally classified and whether another law supplies a different rule.

When criminal or protective laws may apply

The same post may fall under more than one law, but criminal liability is never automatic. Authorities must prove every element of the particular offense.

Non-consensual intimate images

The Anti-Photo and Video Voyeurism Act applies to specified images of sexual activity or private body areas taken under circumstances involving a reasonable expectation of privacy. It also prohibits copying, distributing, publishing, or broadcasting covered material.

Consent to the original recording is not consent to later publication. Written consent to the sharing is required for the acts covered by the law. A conviction may carry imprisonment of three to seven years, a fine of ₱100,000 to ₱500,000, or both.

Gender-based online sexual harassment

Section 12 of the Safe Spaces Act covers gender-based online conduct such as sexual threats, cyberstalking, impersonation, posting lies to harm a victim’s reputation, and unauthorized recording or sharing of photos, videos, voice recordings, or information in the circumstances defined by the law.

The penalty for gender-based online sexual harassment is prision correccional in its medium period, a fine of ₱100,000 to ₱500,000, or both. Section 12 offenses are imprescriptible under the Act. The PNP Anti-Cybercrime Group is designated to receive these complaints.

Identity theft, illegal access, and online fraud

The Cybercrime Prevention Act may apply if the information was obtained through illegal access or used in computer-related identity theft, forgery, or fraud. Computer-related identity theft includes the intentional acquisition, use, misuse, transfer, possession, alteration, or deletion—without right—of identifying information belonging to another.

False and defamatory posts

A false or malicious online imputation that tends to dishonor, discredit, or expose an identifiable person to contempt may constitute cyber libel if all legal elements are present. Truth or falsity is not the only issue; publication, identification, malice, privilege, public-interest rules, and the exact words and context matter.

The Supreme Court held in Causing v. People that cyber libel prescribes in one year from discovery by the offended party, the authorities, or their agents. Anyone considering this remedy should obtain legal advice promptly.

Abuse by a current or former intimate partner

If the victim is a woman and the poster is her husband or former husband, a person with whom she has or had a sexual or dating relationship, or a person with whom she has a common child, the Anti-Violence Against Women and Their Children Act may apply.

Online exposure, harassment, public humiliation, or threats may be relevant when they cause the mental or emotional anguish required by the law. Barangay, temporary, and permanent protection orders may be available, depending on the conduct and requested protection.

Sexual content involving a child

Sexual images or exploitation involving anyone under 18 may fall under the Anti-OSAEC and Anti-CSAEM Act, even when someone claims the child agreed to create or send the material. Report the matter immediately to the PNP, NBI, or other competent child-protection authority. Do not repost the material to “raise awareness” or investigate the offender yourself.

The writ of habeas data is a narrow remedy

A writ of habeas data is not a general-purpose remedy for every unwanted online post.

Under the Rule on the Writ of Habeas Data, it protects a person whose privacy in life, liberty, or security is violated or threatened by unlawful data gathering, collection, or storage. Relief may include updating, rectifying, suppressing, or destroying data and, in threat cases, an order enjoining the challenged act.

The Supreme Court has emphasized that the applicant must show a sufficient connection between informational privacy and an actual or threatened violation of life, liberty, or security. Mere unauthorized access or ordinary embarrassment is not necessarily enough. See Vivares v. St. Theresa’s College.

Because the remedy has technical pleading and evidentiary requirements, obtain counsel before relying on it.

Common mistakes to avoid

Assuming that “no consent” decides the entire case. Another lawful basis or statutory exclusion may apply.
Waiting for the content to disappear before preserving it. A deleted post can be difficult to prove.
Saving only a cropped screenshot. Preserve the URL, account identity, time, context, and original file.
Reposting the harmful content. This may increase the damage and may itself create legal risk.
Threatening or publicly shaming the poster in return. Retaliation can complicate the case and expose the victim to a counterclaim.
Hacking an account to obtain proof. Evidence should be gathered lawfully.
Filing an incomplete NPC complaint. Missing evidence, verification, prior correspondence, or forum-shopping certification can result in dismissal.
Using “data breach,” “doxxing,” or “cybercrime” as automatic legal conclusions. The facts must satisfy the elements of an actual cause of action or offense.
Missing short deadlines. Cyber libel and civil defamation generally carry one-year periods, while other remedies follow different rules.
Paying an extortionist for deletion without contacting authorities. Payment does not guarantee permanent removal and may encourage further demands.

When legal help is urgent

Seek immediate help from a lawyer or law-enforcement authority when:

an intimate image has been posted or threatened with release;
a child is involved;
the post reveals a home address or live location alongside threats;
the poster is stalking, blackmailing, impersonating, or extorting the victim;
exposed credentials are being used for loans, purchases, account takeovers, or fraud;
the content is spreading rapidly across several accounts or platforms;
a school, employer, bank, hospital, government office, or other organization disclosed sensitive records;
protection from a current or former intimate partner is needed;
a court injunction, protection order, or temporary NPC ban may be necessary; or
a one-year defamation or cyber-libel period may be running.

Cybercrime victims may use the NBI’s online complaint facility or seek assistance from its Cybercrime Division. Victims of gender-based online sexual harassment may also follow the reporting guidance of the Philippine Commission on Women.

Frequently asked questions

Can I demand deletion even if the information is true?

Yes, you may request it. Truth does not by itself establish a lawful basis for public disclosure. However, removal is not automatic: lawful reporting, public-interest considerations, legal obligations, public records, or another valid processing basis may justify continued publication.

What if I originally posted the information myself?

Making information public does not give everyone blanket consent to reuse it for unrelated purposes. The later user must still have an applicable lawful basis and observe fairness, legitimate purpose, and proportionality.

Can I withdraw consent after the post is made?

You may withdraw consent when consent is the processing basis. Withdrawal generally does not make earlier lawful processing retroactively unlawful, but continued processing must stop unless another lawful basis independently applies. You may also exercise the right to object or request erasure or blocking where the legal conditions are met.

Does the right to erasure guarantee complete removal from the internet?

No. It can support removal or blocking from a controller’s systems, but copies, lawful archives, search caches, reposts, legal-retention requirements, and protected expression may affect the result. Separate requests may be needed for each controller, platform, or reposter.

Is a screenshot enough to prove the post?

It is useful but may not be enough by itself. Preserve the original URL, account details, timestamps, context, files, witnesses, and information showing how the screenshot was created. Authenticity and authorship may be disputed.

Can the NPC order compensation?

Yes. Under its current procedural rules, an NPC decision may award indemnity on personal-data matters using Civil Code standards. The amount depends on the evidence and proven harm; filing a complaint does not guarantee an award.

Is the poster automatically imprisoned if the NPC finds a violation?

No. The NPC may impose administrative remedies and recommend prosecution, but criminal penalties require the proper criminal process and proof beyond reasonable doubt. The exact offense, responsible person, defenses, and evidence must be established.

Must I wait 15 days before asking the platform to remove the post?

No. Report the post and take safety measures immediately. The 15-day rule concerns the ordinary exhaustion requirement before the NPC gives a formal complaint due course. The NPC may waive that requirement in serious or urgent cases.

Official legal texts and guidance

This article provides general legal information, not legal advice or a prediction of any case’s outcome. Rights, offenses, deadlines, jurisdiction, and available relief depend on the documents and specific facts. Sources and procedures were checked as of 3 August 2026.