Quick answer

Posting another person’s personal information online without consent may violate Philippine law, but lack of consent alone does not automatically make every post unlawful. Consent is only one possible lawful basis for processing personal data. The result depends on what was posted, why and how it was posted, who posted it, the audience reached, whether another lawful basis or statutory exception applies, and the harm or risk created.

If the disclosure appears unlawful, you may:

Preserve the post and related evidence.
Report it to the platform and request urgent removal.
Send a written demand to the poster, page owner, organization, and any relevant data protection officer.
Exercise your rights to access, object, rectify, erase, or block the data.
File a complaint with the National Privacy Commission (NPC), generally after allowing the concerned entity 15 calendar days to respond.
Pursue civil, criminal, workplace, school, or protective remedies when the facts support them.

Threats, stalking, extortion, exposed home addresses or live locations, intimate images, and content involving children require immediate action rather than waiting for an ordinary takedown process.

When an online post may violate the Data Privacy Act

The Data Privacy Act of 2012 covers the “processing” of personal information, a broad term that includes collecting, using, disclosing, sharing, and otherwise handling it. A name, photograph, address, telephone number, email address, location, identifying document, account information, or combination of details capable of identifying a person can be personal information.

Stricter rules apply to sensitive personal information, including information about a person’s health, education, sexual life, marital status, age, religious or political affiliations, legal proceedings, government-issued identifiers, and information specifically classified by law.

For posting to be lawful under the Data Privacy Act, it must have an applicable legal basis and comply with the principles of:

Transparency: the person should ordinarily know who is processing the information, why, and on what basis;
Legitimate purpose: the purpose must be specific, lawful, and compatible with the reason the information was obtained; and
Proportionality: the disclosure must be relevant, necessary, and not excessive.

Ordinary personal information may sometimes be processed without consent for a contract, legal obligation, vital interest, public-authority function, or legitimate interest that is not overridden by the data subject’s constitutional rights. Legitimate interest, however, is not a lawful basis for processing sensitive personal information. The rules are set out in Sections 11 to 13 of the Act and the NPC’s guidelines on legitimate interest.

A disclosure is more likely to be unlawful when, for example:

private records, contact details, identification numbers, medical information, school records, financial data, or private messages are posted without a valid reason;
information collected for one purpose is published for a different and unexpected purpose;
the post exposes far more information than reasonably necessary;
an employer, business, school, lender, association, government employee, or service provider publishes information obtained through its records;
the information is false, outdated, unlawfully obtained, or used to shame, threaten, discriminate against, or endanger the person; or
the poster continues publishing after consent has been withdrawn and cannot identify another lawful basis.

Important exceptions and limits

Consent is not the only lawful basis

A person cannot demand deletion solely by saying, “I did not consent,” if the disclosure is required by law, necessary for a legal claim, authorized by a court, part of a lawful government function, or otherwise supported by Sections 12 or 13 of the Data Privacy Act. Even then, the disclosure must remain proportionate and comply with other applicable laws.

Publicly available does not mean free for every use

Information does not lose all protection merely because it appeared somewhere online or in a public record. In its 2026 guidance on publicly available personal data, the NPC emphasized that public availability does not itself amount to consent for processing beyond the purpose for which the information was made public.

Still, privacy settings, the original audience, the source of the information, the poster’s purpose, and any public-interest justification will affect the legal assessment.

Personal or household activity may be outside the Act

A natural person handling information in connection with personal, family, or household affairs may not be treated as a personal information controller. This is not an unlimited exemption. The NPC has explained that transmitting screenshots of private conversations to third parties may fall outside ordinary household activity, depending on the surrounding facts, and may amount to unauthorized processing if there is no lawful basis. See NPC Advisory Opinion No. 2020-043.

Journalism, art, literature, and research receive special treatment

The Data Privacy Act does not apply in the ordinary way to personal information processed for journalistic, artistic, literary, or research purposes. That exception is not blanket immunity from defamation, harassment, intellectual-property rules, court confidentiality, the Civil Code, or laws protecting children and intimate material.

Government-related information may be disclosable

Certain information connected with a public officer’s position, official functions, government contract, or discretionary financial benefit is excluded from the Act’s ordinary coverage. Private addresses, family details, health records, personal contact numbers, and unrelated identifiers do not automatically become public merely because the person works for government.

What to do immediately

1. Address any safety or account risk

If the post exposes passwords, one-time codes, bank or e-wallet information, identification documents, security answers, or SIM details:

change affected passwords using a trusted device;
enable multi-factor authentication;
sign out unknown sessions;
alert the bank, e-wallet provider, telecommunications company, or government agency that issued the compromised account or document;
review transactions and account-recovery settings; and
warn close contacts if an impersonator may approach them.

If your address, present location, workplace, children’s school, or travel route has been posted together with threats or stalking, move to a safe place and contact the police. For an immediate emergency, call the nationwide 911 hotline.

2. Preserve evidence before seeking removal

Capture the material in a way that shows context and origin:

full-page screenshots showing the account name, date, time, captions, comments, and visible URL;
a screen recording showing how the post is reached from the account or page;
the exact post, profile, group, channel, or file URL;
the account username, numeric account ID if visible, and profile link;
copies of images, messages, emails, notifications, and attachments in their original format;
the number of reactions, shares, views, or recipients, if visible;
platform report numbers and acknowledgment emails;
correspondence with the poster, organization, or data protection officer;
evidence showing where the information came from, who originally possessed it, and what permission—if any—was given;
records of resulting threats, financial loss, medical treatment, counseling, missed work, reputational injury, or other harm; and
names and contact details of witnesses.

Keep an untouched copy. Do not crop, annotate, rename, or edit your only copy. Record when and how each item was obtained.

For intimate material involving a child, do not download, duplicate, or forward it merely to collect evidence. Record the URL and account details and report it immediately to the platform and law enforcement.

3. Report the content through the platform

Use the category that most accurately fits the conduct, such as privacy violation, sharing personal information, impersonation, harassment, threats, non-consensual intimate imagery, or child sexual exploitation.

Report each copy separately when possible. Ask trusted people to monitor for reposts, but do not encourage them to comment, argue with the poster, or recirculate the material.

A platform report may remove content quickly, but it is not a substitute for an NPC, police, prosecutor, or court filing. Do not assume it stops any legal deadline.

4. Send a clear written demand

Send the notice to the poster or page owner and, when relevant, the company, school, employer, association, website operator, platform, or data protection officer. Identify:

the exact URLs and account names;
the particular personal data involved;
why the disclosure is inaccurate, excessive, unlawfully obtained, unauthorized, or dangerous;
whether consent was never given or has been withdrawn;
the privacy right being exercised;
the harm or immediate risk; and
the action requested.

Depending on the facts, request:

removal or blocking of the post and cached copies under the respondent’s control;
suspension of further disclosure;
correction of inaccurate information;
identification of the source, purpose, lawful basis, and recipients;
notice to previous recipients that the information is inaccurate or should no longer be processed;
preservation of relevant account records and logs for lawful investigation;
confirmation of the action taken; and
contact details of the organization’s data protection officer.

Keep proof that the notice was received. This written notice is normally important before an NPC complaint.

Exercising your data-subject rights

Under the Data Privacy Act and its Implementing Rules and Regulations, you may have the right to:

be informed about the processing;
access the data, its source, recipients, manner of processing, and reason for disclosure;
object to processing based on consent or legitimate interest;
correct inaccurate or incomplete information;
request erasure, removal, blocking, suspension, or destruction;
file an NPC complaint; and
claim indemnity for proven damage.

Erasure or blocking requires substantial proof of a recognized ground, such as information that is false, outdated, unlawfully obtained, used for an unauthorized purpose, no longer necessary, prejudicial private information without sufficient justification, or otherwise processed unlawfully.

The right is not absolute. A request may be denied where another legal ground remains, an overriding legitimate interest applies, the information is needed for a legal claim, or a statutory limitation covers research or an investigation into criminal, administrative, or tax liability.

How to file a complaint with the National Privacy Commission

Under the 2021 NPC Rules of Procedure, as amended in 2024, an affected data subject may file a complaint personally or through a properly authorized representative.

Observe the 15-day prior-notice rule

Before filing, ordinarily:

Inform the personal information controller, processor, or concerned entity in writing about the violation or breach; and
Allow it to take appropriate action.

You may proceed if it fails to take timely and appropriate action or does not respond within 15 calendar days from receiving your written notice.

The NPC may waive this requirement for properly shown good cause or a serious violation, including circumstances involving grave and irreparable harm, lack of an adequate remedy from the respondent, or patently illegal conduct. Explain and document the urgency rather than simply omitting the prior notice.

Prepare a complete complaint

The complaint must generally be written, signed, verified under oath, and accompanied by:

your identity and contact details;
the respondent’s identity and service details, if known;
facts identifying an anonymous respondent as far as possible;
a chronological statement of material facts;
the Data Privacy Act, IRR, or NPC rights allegedly violated;
the relief requested;
screenshots, URLs, affidavits, and other supporting evidence;
all correspondence with the respondent;
proof of the respondent’s action or failure to respond; and
a sworn certification against forum shopping.

If a related case is already pending elsewhere, disclose its complete status. If you later learn of a similar action, the NPC rules require reporting it within five calendar days.

The NPC provides a Complaints-Assisted Form and Service Request and Assessment Form. A complaint may be filed at an NPC office, personally, by registered mail or courier, or by email when authorized by the Commission. The NPC’s current payment guidance directs complainants using email to submit the notarized complaint and assessment form to complaints@privacy.gov.ph, wait for the assessed amount, and follow the official payment instructions.

The base complaint filing fee under NPC Circular No. 2023-01 is ₱500, with additional fees for a damages claim or special relief. Qualified indigent complainants may seek exemption by submitting the required proof.

Relief the NPC may grant

Depending on the evidence, the NPC may:

award indemnity based on the Civil Code;
impose a permanent ban on processing;
order an entity or government agency to take action;
impose administrative fines;
issue other compliance orders; and
recommend prosecution to the Department of Justice.

A complainant may also move for a temporary ban on processing while the complaint is pending. This is a special remedy requiring stated grounds, a summary hearing, and ordinarily a bond. It is worth discussing with counsel when continued posting threatens serious or irreparable harm.

Other remedies that may apply

Situation	Possible remedy
A business, school, employer, lender, government office, association, or its personnel disclosed information from its records	Data-subject request, internal DPO complaint, and NPC complaint under the Data Privacy Act
The post contains a false and reputation-damaging accusation	Civil damages and, when all elements are present, a cyberlibel complaint under the Revised Penal Code and the Cybercrime Prevention Act
A fake account uses your identity or identifying information	Computer-related identity theft under Republic Act No. 10175, plus platform impersonation reporting
Information was obtained by hacking or unauthorized access	Illegal-access or related cybercrime investigation, in addition to possible privacy remedies
Sexual images, recordings, or images of private areas were shared	The Anti-Photo and Video Voyeurism Act, when its specific elements apply; consent to recording does not by itself authorize copying, distribution, or publication
Photos, recordings, personal information, impersonation, or lies are used as gender-based online sexual harassment	Complaint under the Safe Spaces Act; the PNP Anti-Cybercrime Group is the primary implementing body
Sexual material involves anyone below 18	Immediate report under the Anti-OSAEC and Anti-CSAEM Act; do not forward the material
An intimate partner or former partner uses disclosure, humiliation, threats, or stalking against a woman or her child	Criminal and protection-order remedies under Republic Act No. 9262, when the required relationship and harm are present
The disclosure threatens privacy in a way connected to life, liberty, or security	A petition for a writ of habeas data, if its strict requirements are met
The conduct occurs in a workplace or school and is gender-based sexual harassment	Report to the employer’s or school’s independent internal mechanism or Committee on Decorum and Investigation, without giving up external remedies

Civil damages and preventive relief

Articles 19, 20, 21, and 26 of the Civil Code may support damages, prevention, and other relief when a person willfully or wrongfully harms another, meddles with private life or family relations, humiliates another because of a personal condition, or violates dignity, privacy, and peace of mind.

A lawyer may also assess whether a temporary restraining order or injunction is legally and practically available. Courts require proof of the applicable legal elements; a request for removal is not granted automatically merely because a post is unwanted or embarrassing.

Cyberlibel deadlines can be short

Online accusations may constitute cyberlibel only when all elements of libel are present, including a defamatory imputation, publication to another person, identification, and malice as required by law. Defenses and privileged communications are fact-dependent.

The Supreme Court has held that cyberlibel prescribes in one year, counted from discovery of the allegedly defamatory publication by the offended party, authorities, or their agents. See Causing v. People and the Court’s 2026 resolution affirming the one-year rule. Consult counsel promptly because the effect of a complaint, later repost, or republication on prescription depends on the record and applicable procedure.

Writ of habeas data

The Rule on the Writ of Habeas Data allows a court to order updating, rectification, suppression, destruction, or protection of information. It is not a general-purpose takedown remedy.

The petitioner must show an actual or threatened unlawful violation of informational privacy connected to life, liberty, or security. The Supreme Court emphasized this requirement in Vivares v. St. Theresa’s College. A mere claim of unauthorized access, embarrassment, or ordinary reputational injury may be insufficient.

When police or legal help is urgent

Seek immediate assistance when:

the post includes credible threats of violence;
a home address, live location, workplace, or child’s school is exposed;
the poster is stalking or approaching you offline;
money, sex, or another concession is demanded in exchange for removal;
an account, device, bank, or e-wallet has been compromised;
intimate material is being circulated or threatened;
a child is involved;
evidence may disappear because the account is anonymous or rapidly deleting posts; or
a cyberlibel deadline may be approaching.

For urgent danger, call 911 or go to the nearest police station. Cybercrime victims may also approach the PNP Anti-Cybercrime Group or request investigative assistance through the NBI Cybercrime Division and the NBI Online Complaint portal.

Prompt reporting may be important when platform subscriber information, access logs, or traffic data will require lawful preservation and disclosure. An ordinary user generally cannot compel a platform to identify an anonymous account; that may require action by law enforcement, the NPC, a prosecutor, or a court.

Common mistakes to avoid

Arguing publicly with the poster. This may amplify the post and complicate evidence preservation.
Reposting the material to “expose” the offender. Republication can further injure the victim and may create separate legal issues.
Deleting your only evidence after the platform removes the post.
Editing or heavily cropping screenshots without keeping originals.
Assuming public information can be used for any purpose.
Assuming lack of consent automatically proves a crime. Other lawful bases and exceptions must be considered.
Using privacy law to suppress a lawful complaint, investigation, court filing, or legitimate public-interest disclosure.
Filing an NPC complaint without the required written notice, proof of receipt, verified allegations, or certification against forum shopping.
Waiting for the platform’s final decision before consulting counsel. Platform processes do not control statutory deadlines.
Paying an extortionist or agreeing to meet without police guidance.
Sending intimate or child sexual material to friends, employers, or barangay groups as “proof.”

Frequently asked questions

Can I force Facebook, TikTok, X, YouTube, or a website to delete the post?

You may report the content and invoke applicable privacy or safety rules, but removal is not automatic. A binding takedown may require an NPC order, court order, or action under a specific law. The platform’s role and possible liability must be assessed separately from the liability of the person who uploaded the material.

Is a photograph personal information?

Usually, yes, if the person can be identified directly or by combining the photograph with other information. Whether posting it is unlawful still depends on purpose, lawful basis, context, audience, proportionality, and any applicable exception.

What if I originally gave the photo or information to the poster?

Giving someone information does not necessarily authorize public posting. Consent must be specific to the purpose, and later use must stay within the authorized scope or have another lawful basis. For intimate recordings covered by Republic Act No. 9995, consent to being recorded does not authorize later copying, distribution, or publication.

Can I demand deletion of a truthful post?

Truth does not automatically resolve a privacy claim, especially where private, sensitive, excessive, or unlawfully obtained information is disclosed. On the other hand, public interest, freedom of expression, legal claims, journalism, and other lawful grounds may justify retention or publication. The complete context matters.

Can I complain if the poster is anonymous?

Yes. Identify the account, URLs, dates, platform, and circumstances that may lead to the person’s identity. Preserve evidence promptly. Identifying the account holder may require lawful process directed to the platform or service provider.

Should I file with the NPC or the police?

The NPC addresses violations of the Data Privacy Act and data-subject rights. Police, the NBI, and prosecutors investigate crimes such as threats, extortion, cyberlibel, identity theft, illegal access, online sexual harassment, and prohibited intimate-image distribution. The same incident may justify more than one remedy, but all filings must truthfully disclose related proceedings where required.

Can I claim damages?

Potentially. The NPC may award indemnity in a privacy case, and courts may award damages under the Data Privacy Act, Civil Code, defamation law, Republic Act No. 9262, or another applicable statute. The claimant must prove the legal basis, the respondent’s responsibility, the injury, and the connection between the conduct and the damage.

This article provides general Philippine legal information, not advice for a specific case. Facts, documents, parties, and deadlines can change the proper remedy. Controlling laws, NPC procedures, and Supreme Court authorities were checked as of 3 August 2026.