A private customer information leak can feel personal and frightening: your name, phone number, home address, ID numbers, bank details, medical information, order history, or account credentials may suddenly be in the hands of strangers. In the Philippines, customers are not powerless when this happens. The Data Privacy Act of 2012, officially Republic Act No. 10173, gives individuals specific rights over their personal data and gives the National Privacy Commission (NPC) authority to investigate, order corrective action, award indemnity, impose administrative sanctions, and recommend criminal prosecution when warranted. (National Privacy Commission)

This guide explains what legally counts as a private customer information leak, what Philippine law requires from businesses, when you must be notified, what evidence to keep, how to complain to the NPC, and what remedies may be available if your leaked information leads to harassment, identity theft, fraud, discrimination, or financial loss.

What counts as a customer information leak in the Philippines?

A customer information leak usually means that personal data held by a business, app, bank, clinic, online seller, telco, school, hotel, courier, employer, or service provider was accessed, disclosed, lost, shared, posted, sold, or used without proper authority.

Under the Data Privacy Act, personal information means information from which a person’s identity is apparent or can reasonably and directly be identified. A data subject is the individual whose information is being processed. A personal information controller is the person or organization that controls the collection, holding, processing, or use of personal information, while a personal information processor usually processes data on behalf of another party, such as an outsourced IT vendor, cloud provider, payroll processor, call center, or marketing platform. (National Privacy Commission)

A leak can involve obvious data, such as:

Name, mobile number, email address, home address, delivery address
Account usernames and passwords
Credit card, bank, GCash, Maya, or other financial information
Passport, driver’s license, UMID, PhilHealth, SSS, GSIS, TIN, or other ID details
Medical records, insurance claims, prescriptions, lab results
Loan applications, payslips, income information, credit history
CCTV screenshots, visitor logs, hotel guest records
Customer support chats, complaints, order histories, or private messages

The law gives stronger protection to sensitive personal information, which includes data about age, marital status, health, education, government-issued identifiers, tax returns, licenses, offenses, court proceedings, and other information classified by law as sensitive. (National Privacy Commission)

In real life, leaks happen in many ways. A company database may be hacked. A staff member may send an Excel file to the wrong person. A courier label may expose your address and phone number. A lending app may upload your phone contacts. A hospital employee may screenshot a patient record. A hotel may lose a guest registration sheet. A customer service agent may use customer details for personal purposes. A vendor may mishandle data given to it by the main company.

The key legal question is not only “Was the company hacked?” It is also: Did the organization collect, store, use, share, protect, retain, or dispose of customer data in a lawful and secure way?

The main law: Republic Act No. 10173 or the Data Privacy Act of 2012

The Data Privacy Act applies to the processing of personal information in both the government and private sectors. It also has extraterritorial reach in certain situations, including where processing relates to a Philippine citizen or resident, the entity has a link to the Philippines, a contract was entered in the Philippines, or the entity carries on business in the Philippines. (National Privacy Commission)

This matters for:

Filipinos whose data is processed by local companies
OFWs whose Philippine bank, e-wallet, telco, school, or government-related data is compromised
Foreigners who are customers, tenants, patients, employees, hotel guests, investors, or app users dealing with a Philippine business
Businesses outside the Philippines that process data connected to Philippine citizens, residents, contracts, or operations

The law is built around three basic privacy principles:

Principle	What it means in practical terms
Transparency	The company must tell you what data it collects, why, how it will use it, who may receive it, and how long it will keep it.
Legitimate purpose	The company must process your data only for a real, lawful, declared purpose.
Proportionality	The company should collect and use only what is necessary, not excessive data “just in case.”

The Data Privacy Act also requires personal information to be collected for specified and legitimate purposes, processed fairly and lawfully, kept accurate and updated where necessary, retained only as long as needed, and protected through reasonable security measures. (National Privacy Commission)

When is customer data processing legal?

A company cannot simply collect and use customer data because it is convenient. For ordinary personal information, the law requires a lawful basis, such as:

Your consent
Processing necessary for a contract with you
Compliance with a legal obligation
Protection of your life or health
Public authority or public interest grounds
Legitimate interests of the company, provided your rights and freedoms are not overridden

For sensitive personal information, the rules are stricter. Processing is generally prohibited unless a specific exception applies, such as your specific consent, a law or regulation allowing it with safeguards, protection of life and health, medical treatment, legal claims, or other recognized grounds under the Data Privacy Act. (National Privacy Commission)

This is why a business may lawfully ask for your address to deliver goods, but it should not casually publish your address online. A clinic may need your medical history for treatment, but it cannot let staff share patient information in group chats for gossip. A lender may verify identity and assess creditworthiness, but it cannot use your contact list to shame you.

Your legal rights after a private customer information leak

If your personal data was leaked or mishandled, you may exercise several rights under the Data Privacy Act.

1. Right to be informed

You have the right to know that your personal data is being collected and processed. This includes the purpose, scope, method, recipients, identity of the personal information controller, retention period, and your rights as a data subject. (National Privacy Commission)

For example, a company should not quietly collect customer IDs for “verification” and later use them for unrelated marketing, profiling, or sharing with third parties without a proper lawful basis.

2. Right to access your data

You may request reasonable access to information about what data the company has about you, where it came from, how it was processed, who received it, why it was disclosed, how long it is stored, and the identity and contact details of the controller. (National Privacy Commission)

In practice, this is useful when you need to know:

What exact information was exposed
Whether your ID number, address, password, or financial data was included
Whether the data was shared with vendors, collection agencies, marketers, or affiliates
Whether your records were accessed by an employee or outside attacker

3. Right to correct inaccurate data

You may dispute and correct inaccurate or outdated personal information. The NPC’s advisory on data subject rights states that a controller should act on rectification within a reasonable period and inform recipients where appropriate.

This matters when a leaked or shared record wrongly identifies you as a borrower, debtor, patient, employee, owner, accused person, or account holder.

4. Right to block, remove, or destroy data

You may ask for blocking, removal, or destruction of data when it is incomplete, outdated, false, unlawfully obtained, used for an unauthorized purpose, or no longer necessary for the purpose for which it was collected. The law also recognizes this right where data processing violates your rights as a data subject. (National Privacy Commission)

This is often relevant when:

An online seller keeps old customer address lists without need
A lending app keeps phone contacts after a loan is settled
A gym, condo, hotel, or school keeps ID scans indefinitely
A company refuses to delete an account that no longer has a lawful retention purpose

5. Right to data portability

You may have the right to obtain your data in a structured, commonly used format where processing is based on consent or contract and is done electronically. The NPC advisory mentions formats such as XML, JSON, or CSV.

This is more common for digital platforms, apps, e-commerce accounts, and services that maintain structured customer data.

6. Right to damages or indemnity

The Data Privacy Act gives data subjects the right to be indemnified for damages suffered due to inaccurate, incomplete, outdated, false, unlawfully obtained, or unauthorized use of personal data. The NPC may award indemnity based on Civil Code principles. (National Privacy Commission)

Damages may be relevant if the leak caused:

Unauthorized bank or e-wallet transactions
Identity theft or fraudulent loans
Harassment or threats
Loss of job or business opportunity
Public humiliation
Emotional distress supported by evidence
Costs for replacement IDs, account recovery, notarization, or fraud remediation

When must a company notify you and the National Privacy Commission?

Not every data incident automatically requires formal breach notification. The NPC’s breach notification guidance states that notification is mandatory when all these elements are present:

The breach involves sensitive personal information or information that may enable identity fraud.
There is reason to believe the information was acquired by an unauthorized person.
The breach is likely to give rise to a real risk of serious harm to affected data subjects. (National Privacy Commission)

The NPC specifically treats certain information as potentially enabling identity fraud, including financial or economic data, usernames and passwords, login data, biometric data, and copies of IDs or unique identifiers such as PhilHealth, SSS, GSIS, and TIN numbers. (National Privacy Commission)

If mandatory notification is required, the personal information controller must notify the NPC and affected data subjects within 72 hours from knowledge of, or reasonable belief that, a qualifying personal data breach occurred. Reports to the NPC must be made through the official Data Breach Notification Management System; the NPC states that submissions outside that system are invalid for this purpose. (National Privacy Commission)

The notice to affected customers should be individual, written or electronic, and should give meaningful information, including what happened, what data was affected, the likely consequences, what the company is doing, and what you can do to reduce risk. (National Privacy Commission)

If the company cannot complete all details immediately, it should still submit the information available and may request an exemption, postponement, extension, or alternative notice where allowed. The NPC guidance also states that a full report should be submitted within five days unless an extension is granted. (National Privacy Commission)

What companies are expected to do after a leak

A responsible company should not simply say, “We are investigating,” and stop there. Under the Data Privacy Act, personal information controllers must implement reasonable organizational, physical, and technical security measures. They must also have security policies, safeguards against natural and human dangers, processes for vulnerabilities and incidents, monitoring systems, and confidentiality obligations for employees and agents, even after they leave the organization. (National Privacy Commission)

In practical terms, after a serious leak, a company should usually:

Contain the incident Disable compromised accounts, revoke access, isolate affected systems, stop unauthorized sharing, and prevent further downloads or reposting.
Investigate the scope Determine what data was affected, when it happened, who accessed it, how many customers were affected, and whether the information was copied or exfiltrated.
Preserve logs and evidence Keep system logs, access records, email headers, CCTV, file transfer records, database activity, vendor reports, and communications.
Assess whether notification is mandatory Apply the NPC’s three-part test on sensitive data, unauthorized acquisition, and real risk of serious harm.
Notify the NPC and affected customers when required Give clear, timely, useful information—not vague public relations language.
Help affected customers reduce harm This may include password resets, card replacement, account monitoring, fraud reporting assistance, ID replacement guidance, or direct coordination with banks and platforms.
Fix the weakness Patch systems, limit employee access, strengthen authentication, train staff, terminate abusive access, review vendor contracts, and update retention practices.

What you should do immediately if your customer information was leaked

1. Secure your accounts first

If passwords, usernames, OTP channels, bank details, or e-wallet information may be involved:

Change passwords immediately.
Turn on multi-factor authentication.
Do not reuse the leaked password anywhere else.
Contact your bank, credit card provider, e-wallet, or platform to block or monitor transactions.
Save ticket numbers and reference numbers.
Watch for SIM swap attempts, phishing calls, fake delivery messages, and loan applications using your name.

For banks, e-wallets, and other BSP-supervised financial institutions, unresolved consumer concerns may be escalated through the Bangko Sentral ng Pilipinas’ consumer assistance channels, including BSP Online Buddy and the Consumer Assistance Management System. (Bureau of the Treasury)

2. Preserve evidence before it disappears

Take screenshots and save copies of:

The leaked post, message, email, spreadsheet, or website
The URL, username, group name, page name, or platform where it appeared
Date and time you discovered the leak
Messages from scammers, collectors, strangers, or employees
Unauthorized transactions or account alerts
Your complaint emails and company replies
Privacy notices, terms, consent forms, or account settings
Proof that the company held your data, such as receipts, forms, contracts, booking confirmations, or chat history

For online posts, capture the full screen showing the date, profile, link, and context. If the leak involves a serious threat, fraud, or identity theft, avoid deleting messages too quickly because law enforcement or the NPC may need to examine them.

3. Write to the company or its Data Protection Officer

Most organizations covered by the Data Privacy Act should have a privacy notice or Data Protection Officer contact. Send a clear written request asking:

What personal data of yours was affected
When the incident happened and when it was discovered
Whether your sensitive personal information, ID numbers, financial data, login credentials, or address were included
Whether the data was accessed by an unauthorized person
Whether the NPC was notified
What measures were taken to protect you
What steps the company will take to correct, delete, block, or secure your data
What compensation or assistance will be provided if you suffered loss

Keep your message factual. Avoid insults or threats. You want a record that shows you raised the issue properly and gave the organization a chance to respond.

4. Exercise your data subject rights

The NPC’s data subject rights advisory says controllers should generally act on requests without undue delay and not beyond 30 working days after receiving the request and supporting documents. For complex or numerous requests, the period may be extended by another 15 working days, with notice of the reason for the extension.

A practical request may say:

I am exercising my rights as a data subject under the Data Privacy Act. Please provide access to the personal data you hold about me, identify what data was affected by the incident, correct any inaccurate information, and block, remove, or destroy data that is no longer necessary or was unlawfully processed.

A company may verify your identity before acting, but it should not demand excessive documents unrelated to confirming who you are. The NPC advisory allows reasonable identity verification and supporting documents, especially where a representative is acting for the data subject.

5. Report cybercrime if there is hacking, fraud, or identity theft

If someone used leaked information to hack accounts, create fake profiles, apply for loans, open e-wallets, commit scams, or impersonate you, the Cybercrime Prevention Act of 2012, or RA 10175, may also apply. It covers offenses such as illegal access, illegal interception, data interference, system interference, misuse of devices, computer-related fraud, forgery, and computer-related identity theft. (Supreme Court E-Library)

RA 10175 identifies the National Bureau of Investigation and the Philippine National Police as enforcement authorities responsible for cybercrime investigation units. (Supreme Court E-Library)

For cybercrime reporting, prepare:

Screenshots and links
Account names, phone numbers, email addresses, wallet numbers, or bank details used by the offender
Transaction records
Chat logs
Police blotter, if already obtained
Government IDs for identity verification
Company replies confirming or denying the breach

How to file a complaint with the National Privacy Commission

The NPC is the primary government agency for Data Privacy Act complaints. It can receive complaints, investigate, use alternative dispute resolution, adjudicate, award indemnity, issue compliance orders, impose bans or cease-and-desist orders, and recommend prosecution to the Department of Justice. (National Privacy Commission)

Step 1: First complain to the company in writing

Under the NPC Rules of Procedure, a complaint generally will not be given due course unless the complainant first informed the personal information controller, processor, or concerned entity in writing and allowed it to act. The rules refer to situations where there is no timely or appropriate action, or no response within 15 calendar days from receipt. The NPC may waive this requirement for good cause, including serious violations, grave or irreparable damage, lack of a plain, speedy, and adequate remedy, or patently illegal action.

This first written complaint is important. It shows that you tried to resolve the issue and gives the NPC a clear timeline.

Step 2: Prepare a verified complaint

The NPC complaint must generally be in writing, signed, and verified. It should identify the complainant, contact details, respondent company and responsible officers if known, facts, supporting evidence, reliefs sought, prior correspondence, and certification against forum shopping.

The NPC’s complaint page states that a formal complaint should use the prescribed form, be printed, filled out, notarized, and submitted to the NPC in person, by courier, or by scanned copy through email. (National Privacy Commission)

Step 3: Attach strong evidence

A good NPC complaint is organized. Attach only relevant documents, but make them easy to understand.

Document or evidence	Why it matters
Government ID	Verifies your identity as the data subject
Proof of customer relationship	Shows the company had or processed your data
Screenshot of leak	Shows what was exposed and where
Company privacy notice or consent form	Helps show what the company promised or declared
Complaint email to the company	Shows exhaustion of remedy
Company reply or lack of reply	Shows whether the company acted within 15 calendar days
Fraud reports or bank dispute forms	Supports actual harm
Medical, loan, employment, or transaction records	Supports sensitive data exposure or damages
Notarized Special Power of Attorney	Needed if someone else files for you

A representative may file for a data subject only when properly authorized, usually through a Special Power of Attorney. The NPC rules expressly recognize representative filing where the representative is authorized by SPA.

For OFWs or Filipinos abroad, the practical bottleneck is often execution of the SPA. Depending on where it is signed and where it will be used, Philippine consular notarization or an apostilled document may be required by the receiving office. DFA materials recognize documents such as Special Powers of Attorney among documents commonly processed for authentication or apostille-related purposes. (Apostille.gov.ph)

Step 4: Pay filing fees or request exemption if qualified

NPC Circular No. 2023-01 sets a ₱500 filing fee for complaints, with additional fees where damages are claimed. The circular also provides exemptions for government agencies and indigent litigants, subject to requirements such as a barangay certificate of indigency, notarized affidavit, and related supporting documents.

Fees can be a practical issue for ordinary complainants, especially if they are also paying for notarization, printing, courier costs, replacement IDs, or bank documents. Keep receipts because they may help prove actual expenses caused by the incident.

Step 5: Wait for NPC action and cooperate with requests

The NPC Rules of Procedure state that complaints may be filed at any NPC office and that, within five calendar days from receipt, the complaint should be raffled or assigned to an investigating officer. The rules also allow filing personally, by registered mail, by private courier, or by email as authorized.

During pre-investigation, the investigating officer may give due course to the complaint or dismiss it without prejudice on grounds such as insufficient form, failure to give the respondent an opportunity to act, lack of apparent Data Privacy Act violation, insufficient information, or unidentifiable parties.

If the NPC investigates a breach, it may require more information, documents, or witnesses, and may conduct on-site examination or technical investigation. (National Privacy Commission)

Possible legal consequences for the company or wrongdoer

Administrative fines and NPC orders

NPC Circular No. 2022-01 allows administrative fines for data privacy infractions. Major infractions may be fined at 0.25% to 2% of annual gross income, while grave infractions may be fined at 0.5% to 3%, subject to rules and caps under the circular. Factors include the nature, gravity, and duration of the violation; negligence or intent; categories of personal data affected; number of data subjects; damage suffered; mitigation; prior violations; and cooperation. (National Privacy Commission)

The NPC may also order the company to comply, stop unlawful processing, improve security measures, or take corrective action. (National Privacy Commission)

Criminal liability under the Data Privacy Act

The Data Privacy Act includes criminal penalties for offenses such as unauthorized processing, negligent access, improper disposal, processing for unauthorized purposes, intentional breach, concealment of a security breach involving sensitive personal information, malicious disclosure, and unauthorized disclosure. Penalties vary depending on the offense and whether ordinary personal information or sensitive personal information is involved. (National Privacy Commission)

For example, unauthorized processing of personal information may carry imprisonment and fines, with heavier penalties where sensitive personal information is involved. Concealment of a security breach involving sensitive personal information may also be penalized. (National Privacy Commission)

Cybercrime liability

If the leak involves hacking, account takeover, phishing, malware, computer-related fraud, or identity theft, RA 10175 may apply in addition to the Data Privacy Act. Computer-related identity theft includes the intentional acquisition, use, misuse, transfer, possession, alteration, or deletion of identifying information belonging to another without right. (Supreme Court E-Library)

Certain cybercrime offenses may be punished by imprisonment and fines, including fines of at least ₱200,000 up to an amount commensurate with the damage caused, depending on the offense. (Supreme Court E-Library)

Civil damages

Apart from administrative and criminal remedies, a privacy victim may rely on civil law principles. Article 26 of the Civil Code protects the dignity, personality, privacy, and peace of mind of individuals and recognizes that acts such as prying into another’s private life, meddling with private affairs, or humiliating another person may give rise to damages and other relief. (Lawphil)

Philippine constitutional privacy doctrine is also well established. In Ople v. Torres, the Supreme Court recognized the constitutional dimension of privacy and struck down a government identification system that created serious privacy risks. (Supreme Court E-Library)

Common scenarios involving private customer information leaks

My online order details were posted publicly. Is that a data privacy violation?

It can be. Names, addresses, phone numbers, order details, and delivery instructions are personal information. Whether the incident requires formal breach notification depends on the NPC’s mandatory notification test: sensitive personal information or identity-fraud-enabling data, unauthorized acquisition, and real risk of serious harm. (National Privacy Commission)

Even if mandatory notification is disputed, the seller or platform still has duties to process data lawfully, proportionately, and securely.

A bank or e-wallet leak led to unauthorized transactions. What should I do first?

Secure the account and report to the bank or e-wallet immediately. Ask for a case number, block compromised cards or wallets, dispute unauthorized transactions, and request written confirmation. If the institution is BSP-supervised and the complaint is unresolved, BSP consumer assistance channels may be used. (Bureau of the Treasury)

You may also consider an NPC complaint if the incident involved improper processing or poor protection of personal data, and a cybercrime report if there was hacking, phishing, identity theft, or fraud.

A clinic, hospital, or insurance company leaked my medical information. Is that serious?

Yes. Health information is sensitive personal information. Leaks involving diagnosis, prescriptions, lab results, insurance claims, disability information, pregnancy status, mental health, or treatment records can create serious harm, including stigma, discrimination, employment problems, and emotional distress. Sensitive personal information receives stricter protection under the Data Privacy Act. (National Privacy Commission)

A lending app contacted my phone contacts. Is that allowed?

A lender cannot freely use your contact list for harassment, shaming, threats, or unauthorized disclosure. The legality depends on what data was collected, what consent or lawful basis was used, whether the processing was proportionate, and whether the company used the data for a declared legitimate purpose. The Data Privacy Act’s principles of transparency, legitimate purpose, and proportionality are especially important in these cases. (National Privacy Commission)

Save screenshots, call logs, messages, app permission screenshots, privacy notices, and collection messages. These details are often more useful than general statements like “they violated my privacy.”

A company says only my name and phone number were leaked. Do I still have rights?

Yes. Name and phone number are still personal information if they identify you or can reasonably identify you. The level of risk may be lower than a leak involving IDs, passwords, or bank details, but the company must still process and protect the information properly. (National Privacy Commission)

I am a foreigner. Can I complain to the NPC?

Yes, if your personal data was processed in a way covered by Philippine law. The Data Privacy Act is not limited only to Filipino citizens in every situation. It may apply where the processing is done by entities in the Philippines, relates to Philippine operations, or falls within the law’s territorial or extraterritorial scope. (National Privacy Commission)

Foreigners commonly affected include tourists, tenants, hotel guests, patients, employees, investors, online customers, and app users dealing with Philippine businesses.

Practical timelines to remember

Issue	Usual legal or practical timeline
Company notification to NPC and data subjects for qualifying breach	Within 72 hours from knowledge or reasonable belief
Full breach report if initial report is incomplete	Generally within 5 days unless extension is granted
Company response to data subject rights request	Without undue delay, generally not beyond 30 working days
Extension for complex or numerous rights requests	Additional 15 working days with notice
Written complaint to company before NPC complaint	Usually allow 15 calendar days for response or action
NPC assignment after complaint receipt	Within 5 calendar days under the NPC Rules of Procedure
NPC pre-investigation action	May occur within the period provided in the rules, depending on sufficiency and circumstances

Frequently Asked Questions

What is the first thing I should do after a data leak in the Philippines?

Secure your accounts first, especially if passwords, bank details, e-wallets, OTP channels, IDs, or phone numbers were exposed. Then preserve evidence, write to the company or its Data Protection Officer, and ask what exact data was affected.

Can I demand compensation for leaked customer information?

You can claim damages or indemnity if you suffered harm because of inaccurate, incomplete, outdated, false, unlawfully obtained, or unauthorized use of your personal data. The strength of the claim depends heavily on evidence of the leak, the company’s fault or violation, and the harm suffered. (National Privacy Commission)

Does the company always have to notify me of a data breach?

Not always. Mandatory notification applies when the breach involves sensitive personal information or identity-fraud-enabling information, there is reason to believe it was acquired by an unauthorized person, and there is a real risk of serious harm. (National Privacy Commission)

What if the company refuses to answer my data privacy request?

Keep proof of your request and any follow-ups. If there is no timely or appropriate action, or no response within 15 calendar days from receipt in the context of filing an NPC complaint, you may proceed with the NPC complaint process, unless the NPC waives the requirement for good cause.

Do I need a lawyer to file a complaint with the NPC?

The NPC process is designed so individuals can file complaints using the prescribed form, supporting documents, verification, and notarization. A lawyer may help in complex cases involving large financial loss, corporate respondents, cybercrime, or civil damages, but the basic complaint process can be started by the data subject.

Can I file for someone else whose data was leaked?

Yes, but you must be properly authorized. The NPC Rules of Procedure allow a representative to file when authorized by a Special Power of Attorney.

What if the leak happened because of an outsourced vendor?

The main company may still have responsibility. The Data Privacy Act requires controllers to ensure that third-party processors implement proper security measures. The obligation to notify the NPC also remains with the personal information controller even where processing is outsourced. (National Privacy Commission)

Is posting someone’s customer details on Facebook illegal?

It may violate the Data Privacy Act, Civil Code privacy protections, platform rules, or even cybercrime laws depending on the facts. If the post includes addresses, IDs, medical details, financial information, threats, or fraudulent use, the risk and possible liability are more serious.

Can leaked personal data become a cybercrime case?

Yes, especially where there is hacking, phishing, identity theft, computer-related fraud, account takeover, or unauthorized access. RA 10175 covers several cybercrime offenses and identifies the NBI and PNP as cybercrime enforcement authorities. (Supreme Court E-Library)

What evidence is most important for an NPC complaint?

The most useful evidence usually includes screenshots of the leak, proof that the company held your data, your written complaint to the company, the company’s response or non-response, proof of harm, and documents showing unauthorized transactions, harassment, identity theft, or misuse of your information.

Key Takeaways

The Data Privacy Act protects customer personal information held by private companies and government entities in the Philippines.
A data leak may involve names, phone numbers, addresses, IDs, financial data, medical records, passwords, account details, or other information that identifies a person.
Companies must follow the principles of transparency, legitimate purpose, and proportionality.
Mandatory breach notification is required when the NPC’s three-part test is met, and notice must generally be made within 72 hours.
You have rights to be informed, access your data, correct inaccurate records, request blocking or erasure, obtain data portability where applicable, and seek damages.
Before filing an NPC complaint, you generally need to complain to the company in writing and allow action or response, unless the NPC waives this requirement for good cause.
Strong evidence matters: screenshots, emails, transaction records, privacy notices, ticket numbers, and proof of harm can make or break a complaint.
If leaked data is used for hacking, fraud, or identity theft, the Cybercrime Prevention Act may also apply.
Banks and e-wallet issues may involve both privacy remedies and BSP consumer assistance procedures.
Foreigners and OFWs may also be protected when the processing falls within the Data Privacy Act’s Philippine scope.