Legal Remedies When Personal Information Is Posted Online Without Consent

Quick answer

If someone posts your personal information online without your consent, Philippine law may give you several remedies: demand removal or blocking of the information, exercise your rights under the Data Privacy Act of 2012, file a complaint with the National Privacy Commission (NPC), seek damages or preventive relief in court, and—when the facts fit a specific offense—pursue criminal charges.

However, lack of consent does not automatically make every online post illegal. For ordinary personal information, consent is only one of several lawful bases for processing under Republic Act No. 10173 (Data Privacy Act or DPA). Processing may also be lawful when, for example, it is necessary for a contract, legal obligation, vital interests, public authority, or a legitimate interest that is not overridden by the data subject's fundamental rights. Sensitive personal information is subject to considerably stricter rules. (National Privacy Commission)

The surrounding facts therefore matter: what information was posted, who posted it, how it was obtained, why it was disclosed, to whom it was made available, whether the information was already public, whether there is a legitimate public-interest or journalistic purpose, and what harm or risk the disclosure creates.

Personal information is protected even when the problem happens online

The DPA defines personal information broadly as information from which a person's identity is apparent, can reasonably and directly be ascertained, or can be identified when the information is combined with other information. Processing includes acts such as collecting, storing, using, modifying, retrieving, and otherwise handling personal data. (National Privacy Commission)

Examples can include:

• your full name together with other identifying information;
• home address or precise location;
• mobile number or personal email address;
• photographs and videos identifying you;
• employment or financial information;
• private messages associated with you;
• government-issued identifiers;
• information about your family; and
• other information capable of identifying you.

The DPA gives additional protection to sensitive personal information, which includes information about race or ethnic origin, marital status, age, religious or political affiliations, health, education, genetic or sexual life, criminal proceedings, and certain government-issued information such as social security numbers, health records, licenses, and tax returns. (National Privacy Commission)

This distinction matters because Section 12 permits ordinary personal information to be processed on several possible lawful bases, while Section 13 generally prohibits processing of sensitive personal information unless one of the specific statutory exceptions applies. (National Privacy Commission)

“It was already public” is not a complete defense

Information appearing on the internet is not automatically free for unrestricted reuse.

In its 2026 Guidelines on Data Scraping of Publicly Available Personal Data, the NPC expressly recognized that information intentionally made public by a data subject can be “publicly available personal data,” while emphasizing that public availability does not itself amount to consent for processing beyond the purposes reasonably expected by the data subject. A person or organization processing such information must still identify a lawful basis and comply with the DPA's requirements. (National Privacy Commission)

Similarly, an earlier NPC advisory involving a photograph taken in a restaurant and posted on social media without consent explained that data privacy rights do not simply disappear because a person was in a public space. Whether the posting constitutes unauthorized processing still depends on the circumstances. (National Privacy Commission)

At the same time, privacy is contextual. In Vivares v. St. Theresa's College, the Supreme Court explained that a person's reasonable expectation of privacy on social media depends partly on what steps the person actually took to restrict access. The mere use of a social-network privacy setting does not automatically decide every case. (Judiciary eLibrary)

The practical rule is therefore: public accessibility can affect the privacy analysis, but it does not create an unlimited license to collect, republish, profile, shame, exploit, or otherwise use personal data for an unrelated purpose.

Consent is important, but it is not the only question

A strong privacy complaint should not simply say, “I never consented.”

For ordinary personal information, ask instead:

1. What lawful basis does the poster or organization claim under Section 12 of the DPA?
2. Was the use of your information necessary for that lawful purpose?
3. Was the disclosure transparent and fair?
4. Was the amount of information disclosed proportionate to the purpose?
5. Was the information used for a purpose different from the one for which it was originally obtained?
6. Are your constitutional privacy interests stronger than the claimed legitimate interest?

The DPA requires processing to observe the principles of transparency, legitimate purpose, and proportionality. It also requires personal information to be relevant and not excessive for its stated purpose. (National Privacy Commission)

For sensitive personal information, the analysis is stricter. Processing is generally prohibited unless one of the limited circumstances in Section 13 applies, such as specific consent, a law expressly allowing the processing, protection of life and health in appropriate circumstances, medical treatment under specified safeguards, or processing necessary for legal claims or submission to government or public authority. (National Privacy Commission)

Who posted the information also matters

The DPA generally applies to natural and juridical persons processing personal data in the government or private sector. But the statute's definition of a personal information controller excludes an individual who collects, holds, processes, or uses personal information in connection with that individual's personal, family, or household affairs. Whether a particular social-media disclosure falls within that exclusion can depend heavily on the facts. (National Privacy Commission)

Accordingly, a privacy case against:

• a company;
• employer;
• school;
• hospital;
• lending company;
• government office;
• online business;
• professional;
• organization; or
• person processing data outside a purely personal or household context

may raise different DPA issues from a dispute involving an individual's purely private household activity.

Even when the DPA does not provide the best cause of action, Civil Code privacy rights and other special laws may still apply.

Journalistic, artistic, literary, public-authority, and public-interest uses are different

The DPA contains special cases in which certain information or processing falls outside its ordinary application, including personal information processed for journalistic, artistic, or literary purposes and information necessary for specified public-authority functions. The DPA's IRR clarifies that these special cases operate only to the minimum extent necessary for the particular purpose, function, or activity concerned. (National Privacy Commission)

This means a demand to remove personal information is not automatically superior to:

• freedom of speech;
• freedom of the press;
• legitimate reporting;
• legitimate public records;
• legal obligations;
• court proceedings;
• regulatory functions; or
• genuine matters of overriding public concern.

The NPC's current guidance on the right to erasure expressly recognizes that erasure may be refused where processing remains necessary for legal obligations, legal claims, legitimate business purposes, or an overriding public interest or concern, taking into account constitutional freedoms and whether the data subject is a public figure. (National Privacy Commission)

What to do immediately after discovering the post

1. Preserve the evidence before asking anyone to delete it

Save enough evidence to prove what actually appeared online.

Preserve:

• screenshots showing the entire post;
• the account name and profile;
• the post's URL or permalink;
• the date and time you discovered it;
• comments, captions, hashtags, shares, reposts, and reactions relevant to the case;
• messages showing how the poster obtained the information, if available;
• the original image, video, document, or message involved;
• emails or platform notifications relating to the post;
• any threats, demands, extortion attempts, harassment, or impersonation connected with it; and
• evidence of actual consequences such as threatening messages, employment problems, fraudulent transactions, unwanted visitors, or financial loss.

Where possible, retain uncropped originals as well as annotated copies. A screenshot that removes the username, date, URL, or surrounding context can become much harder to authenticate later.

Do this before blocking the poster or causing the content to disappear.

2. Protect yourself against secondary harm

If the disclosure contains passwords, authentication codes, bank information, government identification numbers, security answers, or information useful for account recovery, assume that the problem is more than reputational.

Change compromised credentials, activate multifactor authentication, contact affected banks or service providers where appropriate, and watch for impersonation or fraudulent transactions.

If your exact residence, real-time location, children's information, or other safety-sensitive information has been exposed together with threats or stalking, treat the matter as an immediate safety issue rather than only as a privacy complaint.

3. Send a written privacy demand

If the DPA route may apply, send the person or organization responsible a written notice identifying:

• the specific personal information involved;
• where it was posted;
• why you contend the processing or disclosure is unlawful;
• the harm or risk being created;
• the relief you want;
• your request for removal, blocking, correction, or cessation of further disclosure;
• where appropriate, your request to identify the source of the information and the lawful basis for processing; and
• a reasonable method for responding.

Keep proof showing when the respondent received the notice.

This step is especially important because the NPC's current Rules of Procedure ordinarily require a complainant first to notify the PIC, PIP, or concerned entity in writing and give it an opportunity to act. If no timely or appropriate action is taken, or there is no response within 15 calendar days from receipt, the exhaustion requirement is ordinarily satisfied.

4. Report the content to the platform

Use the platform's privacy, impersonation, harassment, intimate-image, or personal-information reporting mechanism as applicable.

A platform report is not a substitute for preserving evidence or pursuing legal remedies, but it may be the quickest way to reduce continuing exposure.

Do not delete your evidence simply because the platform removes the post.

Your rights under the Data Privacy Act

Depending on the circumstances, the DPA and its IRR give data subjects several useful rights.

Right to object

A data subject generally has the right to object to processing, including certain forms of direct marketing, profiling, and automated processing. Where a valid objection is made, processing ordinarily must cease unless an applicable lawful exception exists. (National Privacy Commission)

Right to access

You may be entitled to ask what information about you was processed, where it came from, how it was processed, who received it, why it was disclosed, and who controls the processing. (National Privacy Commission)

This can be particularly important when personal information appeared online but you do not know how the poster acquired it.

Right to correct inaccurate information

If the information is inaccurate or erroneous, you may require correction, subject to the statutory limits. In appropriate circumstances, prior recipients can also be informed of the correction. (National Privacy Commission)

Right to erasure or blocking

You may seek suspension, withdrawal, blocking, removal, or destruction of personal data upon substantial proof that it is, among other things:

• incomplete;
• outdated;
• false;
• unlawfully obtained;
• being used for an unauthorized purpose; or
• no longer necessary for the purpose for which it was collected. (National Privacy Commission)

The NPC also recognizes that even personal data already available online may be the subject of an erasure request. Its current guidance contemplates communications to other controllers and third-party indexes for deletion or de-listing where appropriate. The right is not absolute, particularly where continued processing is required by law, necessary for legal claims, or justified by overriding public interest. (National Privacy Commission)

Right to damages

Section 16 of the DPA recognizes the right to be indemnified for damage caused by inaccurate, incomplete, outdated, false, unlawfully obtained, or unauthorized use of personal information. (National Privacy Commission)

Filing a complaint with the National Privacy Commission

If the matter is not satisfactorily resolved, an affected data subject may file a complaint with the NPC.

The normal 15-day exhaustion rule

Under the NPC's Rules of Procedure, you ordinarily must show that:

1. you notified the respondent in writing of the privacy violation or personal data breach; and
2. the respondent failed to take timely or appropriate action, or did not respond within 15 calendar days after receiving the written notice.

Do not confuse this with a rule that you must wait 15 days while serious harm continues.

The NPC may waive exhaustion for good cause or in serious cases, including circumstances involving grave and irreparable damage that only NPC action can prevent or mitigate, absence of a plain, speedy, or adequate remedy from the respondent, or patently illegal conduct.

What the complaint must contain

The current NPC Rules require a written and verified complaint. Among other things, it should identify the complainant and respondent, narrate the material facts, identify the privacy violation or breach, state the relief requested, and attach supporting evidence. Correspondence showing compliance with the exhaustion requirement must ordinarily be attached. Witness affidavits should also accompany the complaint where relevant.

A certification against forum shopping is also required. If a similar action later becomes known to the complainant, the Rules require the fact to be reported to the NPC within five calendar days.

Applicable filing fees must generally be paid unless an exemption or waiver applies.

How the complaint may be filed

The amended Rules allow filing:

• personally;
• by registered mail;
• by courier; or
• by electronic mail when authorized by the Commission.

The NPC's own complaint guidance presently provides complaint forms and filing instructions, including electronic filing information. Because addresses, fees, and electronic filing arrangements can change, use the NPC's current complaint page rather than an old downloaded form. (National Privacy Commission)

Under the amended Rules, the Investigating Officer has 30 calendar days from receipt of the complaint to give it due course or dismiss it without prejudice on specified preliminary grounds, including insufficient form, failure to exhaust remedies without justification, insufficient information, or a matter that does not involve the DPA or a privacy violation or breach.

An urgent NPC remedy: temporary ban on processing

When continued processing is causing serious harm, a complainant may seek a temporary ban on processing personal data.

Under Rule IX of the NPC Rules, an application may be made upon filing the complaint or before the NPC decision becomes final and executory. A temporary ban requires, among other things, facts supporting the requested relief, necessity to protect applicable rights or interests, a summary hearing, and—unless exempted—a bond in an amount fixed by the investigating officer. (National Privacy Commission)

The NPC also has statutory and regulatory authority to issue compliance and enforcement orders, cease-and-desist orders, temporary or permanent bans on processing, administrative fines, and—in appropriate cases—indemnity, and it may recommend prosecution of DPA crimes to the Department of Justice. (National Privacy Commission)

This remedy can be particularly important when information is still actively being circulated rather than when the dispute concerns only a completed historical disclosure.

Civil action for invasion of privacy and damages

The DPA is not the only source of protection.

Article 26 of the Civil Code requires every person to respect the dignity, personality, privacy, and peace of mind of others. It provides that specified privacy invasions and similar acts may create a cause of action for damages, prevention, and other relief even when the conduct does not constitute a criminal offense. (Lawphil)

Depending on the facts, Articles 19, 20, and 21 of the Civil Code may also support liability where a person's rights are exercised abusively, a legal duty is violated causing damage, or another person is willfully injured in a manner contrary to morals, good customs, or public policy. (Lawphil)

A civil case can therefore be relevant where, for example, private information is deliberately exposed to humiliate someone even though a particular DPA offense is difficult to establish.

Where continued publication is causing substantial harm, the injured party may also discuss with counsel whether preventive or injunctive relief is appropriate. The availability of an injunction or temporary restraining order depends on the particular cause of action, evidence, parties, and requirements of the Rules of Court; it is not automatically granted merely because the information is embarrassing or unwanted.

Writ of habeas data: powerful, but much narrower

A writ of habeas data should not be treated as a general-purpose “delete this post” remedy.

Under A.M. No. 08-1-16-SC, the writ is available to a person whose right to privacy in life, liberty, or security is violated or threatened by an unlawful act or omission of a public official or employee, or by a private individual or entity engaged in gathering, collecting, or storing information regarding the aggrieved person's person, family, home, or correspondence. (Lawphil)

The petition may seek relief including updating, rectification, suppression, or destruction of the information or database. It may generally be filed with the RTC where the petitioner or respondent resides or where the data is gathered, collected, or stored; additional courts have jurisdiction where public data files of government offices are involved. (Lawphil)

Supreme Court jurisprudence emphasizes that the petitioner must show more than a generalized privacy grievance: the unlawful gathering or use must affect the petitioner's life, liberty, or security, and the factual requirements must be proven. (Lawphil)

The rule expressly allows separate civil, criminal, or administrative actions, although if a criminal action has already been commenced, the habeas-data relief is ordinarily sought by motion in that criminal case rather than through a new separate petition. (Lawphil)

When posting personal information can become a crime

Not every privacy violation is criminal. Criminal liability requires the elements of a particular penal law to be proven beyond reasonable doubt.

Data Privacy Act offenses

Depending on who processed the data and how the information was obtained or disclosed, the DPA includes offenses such as:

Possible offense	Statutory penalty
Unauthorized processing of ordinary personal information	1 to 3 years' imprisonment and ₱500,000 to ₱2 million fine
Unauthorized processing of sensitive personal information	3 to 6 years and ₱500,000 to ₱4 million
Processing ordinary personal information for an unauthorized purpose	1 year and 6 months to 5 years and ₱500,000 to ₱1 million
Processing sensitive personal information for an unauthorized purpose	2 to 7 years and ₱500,000 to ₱2 million
Malicious disclosure by a PIC/PIP or its responsible personnel	1 year and 6 months to 5 years and ₱500,000 to ₱1 million
Unauthorized disclosure of ordinary personal information by a PIC/PIP or its responsible personnel	1 to 3 years and ₱500,000 to ₱1 million
Unauthorized disclosure of sensitive personal information by a PIC/PIP or its responsible personnel	3 to 5 years and ₱500,000 to ₱2 million

These are statutory ranges, not automatic consequences of every social-media post. The prosecution must prove the elements of the particular offense and overcome any applicable lawful basis, exception, or scope issue. (National Privacy Commission)

The amended NPC Rules state that prescription of DPA penal provisions follows Act No. 3326 and its amendments. Act No. 3326 uses different prescriptive periods according to the imprisonment prescribed for the particular special-law offense and contains its own rules on commencement and interruption. Because the applicable period therefore depends on the precise offense, do not delay a criminal consultation based on an assumed deadline.

Intimate photographs or videos

Republic Act No. 9995, the Anti-Photo and Video Voyeurism Act, can apply where the material depicts a sexual act or similar activity, or certain private areas of a person, and the statutory circumstances are present.

Importantly, the law separately prohibits copying, distributing, publishing, broadcasting, showing, or exhibiting covered intimate material without the required consent. For those distribution offenses, consent to the original recording does not necessarily authorize later publication or sharing. (Lawphil)

An ordinary non-intimate photograph does not become a violation of RA 9995 merely because it was posted without permission.

Gender-based online sexual harassment

The Safe Spaces Act, Republic Act No. 11313, criminalizes qualifying gender-based online sexual harassment. Its statutory definition and prohibited acts include certain unauthorized sharing of photographs, videos, recordings, or information online, cyberstalking, online impersonation, and harmful online conduct when the requirements of gender-based online sexual harassment are present. (Lawphil)

The statute should therefore not be invoked merely because any photo or information was posted without consent; the conduct must fall within the Act's gender-based online harassment provisions.

Computer-related identity theft

If another person uses your identifying information to impersonate you, create fraudulent accounts, carry out scams, or otherwise use your identity without right for an illegitimate purpose, Section 4(b)(3) of the Cybercrime Prevention Act may be relevant.

The law covers intentional acquisition, use, misuse, transfer, possession, alteration, or deletion of another's identifying information without right. (Lawphil)

In Disini v. Secretary of Justice, the Supreme Court upheld the computer-related identity-theft provision. The Court also emphasized that the offense is directed at wrongful use of identity information and that simply acquiring or disseminating information the user himself made public does not automatically amount to identity theft. (Lawphil)

Cyber libel

If the online publication also contains a defamatory imputation rather than merely disclosing private information, cyber libel may present a separate issue under Article 353 of the Revised Penal Code in relation to the Cybercrime Prevention Act.

Privacy and defamation are different concepts. True information can potentially invade privacy; false or defamatory information raises a different legal inquiry.

The Supreme Court in Disini sustained the constitutionality of online libel as applied to the original author of the online publication while striking down its application to persons who merely receive and react to the post in the circumstances addressed by that case. (Lawphil)

A practical way to evaluate common situations

Someone posts your home address and phone number to encourage strangers to contact you

Possible issues include DPA liability, Civil Code privacy remedies, harassment-related laws, and potentially criminal statutes if the disclosure accompanies threats, stalking, impersonation, or other unlawful conduct.

Preserve the post immediately and treat the matter urgently if physical safety is affected.

An employee leaks your medical record online

Health information is sensitive personal information. The organization that controlled the record may face questions concerning lawful processing, disclosure, confidentiality, and security safeguards, while the individual employee's conduct may create separate liability. (National Privacy Commission)

Someone posts a photo you previously uploaded publicly

Your own public posting matters, but it does not necessarily authorize every later use. Ask what purpose the republisher is pursuing and whether the subsequent processing has an appropriate lawful basis. The NPC's 2026 guidance specifically rejects the assumption that public availability is consent to unrestricted further processing. (National Privacy Commission)

A news organization publishes information about a matter of genuine public concern

The DPA contains protections for journalistic processing, and constitutional free-speech and press interests may be substantial. Privacy rights do not automatically override legitimate reporting. Other laws, professional duties, accuracy, proportionality, and the actual public interest still matter. (National Privacy Commission)

A person posts an intimate recording

Preserve evidence before requesting deletion. Depending on the content and circumstances, RA 9995, the Safe Spaces Act, the DPA, Civil Code remedies, and other criminal laws may overlap. Immediate legal and law-enforcement assistance may be warranted. (Lawphil)

Common mistakes to avoid

Assuming that “no consent” ends the legal analysis. Consent is one lawful basis, not the only one, for ordinary personal information.

Assuming that anything visible online is fair game. Current NPC guidance expressly rejects unrestricted reuse merely because personal data is publicly available. (National Privacy Commission)

Deleting your own evidence too early. Take complete screenshots and preserve URLs, dates, account information, messages, and original files before seeking takedown.

Filing an NPC complaint without first sending written notice. Unless an exception applies, the 15-calendar-day exhaustion requirement can affect whether the complaint is given due course.

Sending only an angry demand. A useful privacy notice identifies the exact information, explains the objection, asks for specific relief, and creates proof that the respondent received it.

Calling every unauthorized post “identity theft.” Identity theft has distinct statutory elements. An embarrassing disclosure is not automatically identity theft.

Retaliating by publishing the other person's private information. That can create a new privacy, harassment, or defamation problem and weaken your position.

Assuming deletion eliminates the case. A deleted post can still have caused compensable injury or other legal consequences, and copies may remain elsewhere.

Ignoring public-interest and free-speech defenses. A privacy claim becomes harder when the disputed information is genuinely necessary to legitimate reporting, legal proceedings, public functions, or another protected purpose.

When legal help is urgent

Seek immediate legal assistance rather than waiting for an ordinary takedown process when:

• your home address or real-time location has been exposed together with threats;
• the offender is stalking you or encouraging others to approach you;
• intimate or sexually explicit material is circulating;
• a child is involved;
• government IDs, financial credentials, passwords, or authentication information have been exposed;
• someone is impersonating you to obtain money or commit fraud;
• highly sensitive health, sexual, educational, criminal-case, or government information has been leaked;
• the disclosure is spreading rapidly across multiple accounts or platforms;
• an employer, hospital, bank, school, lending company, government office, or other organization appears to be the source of the leak; or
• continuing publication creates grave or irreparable harm requiring consideration of an NPC temporary ban, court injunction, or another urgent remedy.

Where there is an immediate threat to physical safety, contact appropriate law-enforcement authorities in addition to pursuing privacy remedies.

Frequently asked questions

Can I complain even if the information posted about me is true?

Yes. Truth does not automatically defeat a privacy claim. Defamation generally focuses on defamatory imputations and related elements, while privacy law can protect against unlawful or disproportionate processing or disclosure of true personal information.

Whether you have a viable case still depends on lawful basis, public interest, the nature of the information, who disclosed it, and the surrounding circumstances.

Can I demand deletion if I originally posted the information myself?

Potentially. Making personal data public does not necessarily amount to consent to every later collection, reuse, republication, profiling, or disclosure. Current NPC guidance expressly states that publicly available personal data still requires an appropriate lawful basis for further processing. (National Privacy Commission)

Your original privacy settings and the purpose for which you made the information available can nevertheless affect the analysis.

Is a screenshot of a private conversation automatically illegal?

No automatic rule applies. A private conversation can contain personal or sensitive personal information, and its disclosure may implicate the DPA, Civil Code privacy rights, contractual or professional confidentiality, or other statutes depending on how the conversation was obtained and disclosed.

Secret recordings may raise additional issues under laws governing interception or recording of communications.

Can I file an NPC complaint against an anonymous account?

A respondent should ordinarily be identified, but the current NPC Rules allow the complaint to state circumstances that may lead to identifying the respondent when the identity is unknown. Evidence connecting an anonymous account to the responsible person will substantially affect the case.

Where criminal conduct is involved, lawful identification of an anonymous user may require investigative processes or judicially authorized access to information held by service providers.

Do I always have to wait 15 days before going to the NPC?

No. Fifteen calendar days is the ordinary exhaustion period after the respondent receives your written notice. The NPC may waive the requirement for good cause or serious circumstances, including grave and irreparable damage, lack of a plain, speedy, or adequate remedy, or patently illegal conduct.

Can I pursue an NPC case and a civil or criminal case?

Potentially, yes, because different proceedings may address different forms of liability and relief. But procedural rules—including the NPC's certification-against-forum-shopping requirement and rules affecting habeas-data proceedings when a criminal case already exists—must be considered carefully.

Do I need a lawyer to send a takedown demand?

Not necessarily. A data subject can personally assert privacy rights and communicate with a respondent.

Legal assistance becomes particularly valuable where the respondent invokes public interest or press freedom, sensitive information is involved, damages are substantial, the poster is anonymous, an injunction or habeas-data petition is contemplated, or criminal liability may be involved.

Official sources

• National Privacy Commission — Data Privacy Act of 2012: Republic Act No. 10173
• National Privacy Commission — Implementing Rules and Regulations: DPA Implementing Rules and Regulations
• National Privacy Commission — amended 2021 Rules of Procedure: 2021 NPC Rules of Procedure, as amended
• National Privacy Commission — complaint guidance: File a Privacy Complaint
• National Privacy Commission — 2026 Guidelines on Data Scraping of Publicly Available Personal Data: NPC Advisory No. 2026-01
• Supreme Court — Vivares v. St. Theresa's College, G.R. No. 202666: Supreme Court E-Library decision
• Supreme Court — Rule on the Writ of Habeas Data, A.M. No. 08-1-16-SC: Rule on the Writ of Habeas Data
• Republic Act No. 9995 — Anti-Photo and Video Voyeurism Act: RA 9995
• Republic Act No. 10175 — Cybercrime Prevention Act: RA 10175
• Republic Act No. 11313 — Safe Spaces Act: RA 11313

General-information disclaimer

This article provides general Philippine legal information, not legal advice for a particular case. Whether an online disclosure is unlawful depends on the nature of the information, the identity and role of the person processing it, how it was obtained, the purpose and audience of the disclosure, applicable lawful bases and statutory exceptions, available evidence, and any competing constitutional or public-interest considerations. Procedures, filing arrangements, and limitation periods should be checked against the rules applicable when action is taken.

Law and official-source check: August 23, 2026.