Quick answer

If an online lending app or its collector threatens you, publicly shames you, sends your loan information or photo to other people, or uses your phone contacts for collection, preserve the evidence and report the conduct to the proper agency:

Securities and Exchange Commission (SEC): unfair collection by lending or financing companies and their online lending platforms.
National Privacy Commission (NPC): unlawful access, use, sharing, retention, or disclosure of personal data.
Bangko Sentral ng Pilipinas (BSP): only when the lender is a BSP-supervised institution, such as a bank or digital bank.
Police, NBI, or DICT Cyber Hotline: threats of violence, fraud, identity theft, extortion, account compromise, or other possible crimes.

A real unpaid loan does not give a lender permission to harass or shame anyone. Reporting misconduct, however, does not automatically cancel a valid debt. Continue to dispute or settle the account only through verified, documented channels.

What lenders may—and may not—do

A lender may send lawful payment reminders, demand payment, offer restructuring, engage an authorized collection agency, report credit information as permitted by law, or file a proper civil case.

Under the Financial Products and Services Consumer Protection Act, financial service providers must treat clients fairly, protect client data, maintain a free consumer-assistance mechanism, and avoid abusive collection or debt-recovery practices. They are also responsible for their employees and agents and may be solidarily liable with accredited third-party collection providers for covered acts or omissions.

Conduct that may be prohibited includes:

Threatening violence, property damage, arrest, prosecution, or another action that cannot legally be taken.
Using obscenities, insults, degrading language, or deceptive representations to force payment.
Posting or circulating a borrower’s name, photo, identification document, loan details, or alleged delinquency to shame the borrower.
Sending collection messages to relatives, friends, co-workers, employers, social-media contacts, or other persons who are not guarantors.
Falsely telling another person that they must pay the borrower’s debt.
Editing a borrower’s photo into a “wanted,” “scammer,” or similarly humiliating image.
Using information obtained from the borrower’s phone to harass the borrower or other people.
Repeatedly contacting someone in a manner that becomes abusive or intimidating.

SEC Memorandum Circular No. 18, Series of 2019 also generally treats collection contact before 6:00 a.m. or after 10:00 p.m. as unreasonable, subject to the circular’s specific exceptions where the account has been past due for more than 15 days or the borrower gave express, documented consent to those hours. Those exceptions do not authorize threats, deception, public shaming, or other abusive conduct.

The March 2026 joint DICT-NPC-SEC advisory confirms that, for debt collection, lenders may contact the borrower’s guarantor, not everyone in the borrower’s contact list. A character reference is not automatically a guarantor. A guarantor must have expressly consented to assume responsibility if the borrower defaults.

When the conduct is a privacy issue

The Data Privacy Act of 2012 requires personal-data processing to be lawful, transparent, and proportionate to a legitimate purpose. A borrower’s consent to necessary loan processing is not blanket permission to copy, retain, publish, or use every item on the borrower’s phone.

Under NPC Circular No. 2022-02:

An app must not require unnecessary or excessive permissions.
Access to a camera or photo gallery may be allowed for a specified purpose such as identity verification, KYC, fraud prevention, or payment verification, but should stop when that purpose is completed.
A borrower’s photo must not be used to harass or embarrass the borrower.
Unconstrained, excessive, or disproportionate processing of contact lists is prohibited.
An app may provide limited contact-list access so the borrower can select a character reference or guarantor, but it must not freely harvest the list for collection.
A character reference may be contacted for identity or information verification, not treated automatically as a guarantor or used for debt collection.
A character reference must be told how their details were obtained and be given an option to have their data removed as a reference.
Personal data may be retained only while necessary for the original purpose, legal claims, or another period required by law; it must then be securely disposed of.

Not every disclosure is automatically unlawful. A lender may have a lawful basis for disclosures required or authorized by law, including legitimate credit reporting. Whether a particular use is lawful depends on the data involved, the stated purpose, the privacy notice, the loan documents, the recipient, and how the information was used.

What to do immediately

1. Protect yourself if there is a real-world threat

If a message contains a credible threat of violence, names your home or workplace, shows that someone is nearby, or threatens immediate harm, contact emergency services or go to the nearest police station. Tell trusted family members, building security, or your employer’s security office as appropriate.

Do not meet a collector alone. Do not open your home merely because someone claims to be a collector. Ask for identification and written authority from the lender.

2. Preserve evidence before blocking or uninstalling

Save:

Complete screenshots showing the sender, phone number or account, date, time, and surrounding conversation.
Original SMS, chat, email, voicemail, and social-media notifications.
URLs, usernames, profile links, and screenshots of public posts.
Call logs showing dates, times, duration, and repeated calls.
Copies of messages received by relatives, friends, co-workers, or employers.
The app’s name, developer, download page, version, privacy notice, and requested permissions.
The loan agreement, disclosure statement, promissory note, repayment schedule, receipts, and statement of account.
The lender’s corporate name, SEC registration number, Certificate of Authority number, office address, and collection-agency name, if shown.
Proof of your written complaint to the lender and its response, including delivery or email receipts.
A chronological incident log written while events are fresh.

Keep the original files and make a backup. Avoid cropping away identifying details. If another person received the message, ask that person to preserve it on their own device and prepare a short signed account of what they received.

Electronic evidence must eventually be shown to be authentic and reliable. The Supreme Court Rules on Electronic Evidence recognize electronic documents, but the person presenting them bears the burden of authentication. Preserving originals, metadata, complete conversations, and the device helps.

Do not secretly record private spoken conversations without legal advice. The Anti-Wiretapping Act generally prohibits secretly recording a private communication without authorization from all parties.

3. Cut off unnecessary access

After preserving what you need:

Review the app’s permissions and revoke access to contacts, photos, camera, microphone, location, and storage when no longer necessary.
Remove unknown device-administrator, accessibility, or screen-control permissions.
Uninstall the app if it is no longer needed and doing so will not destroy essential evidence.
Change email, banking, e-wallet, and social-media passwords from a trusted device if compromise is suspected.
Enable multi-factor authentication and review active sessions and linked devices.
Inform your bank or e-wallet provider immediately about unauthorized transactions.

Revoking access does not necessarily require a lender to erase information it may lawfully retain for an outstanding contract, regulatory compliance, or legal claims. It does prevent continued device access where there is no longer a proper basis.

4. Identify the company behind the app

The app’s brand name may differ from the legal lender. Check the loan agreement, privacy notice, receipts, app-store developer page, and payment instructions.

Use the SEC’s Check with SEC service to determine whether the company exists and has a Certificate of Authority to operate as a lending or financing company. Corporate registration alone is not enough; lending and financing require the proper secondary authority.

Include any mismatch in your complaint—for example, where the app names one company but the contract, payment account, or collector names another.

5. Send a written complaint and privacy demand

Write to the lender’s consumer-assistance unit and data protection officer, if identified. Keep the message factual and attach only necessary evidence.

State:

Your name and account or loan reference number.
The app and legal company name.
What happened, with dates and sender details.
Which people were contacted and whether they were guarantors.
What information was accessed, shared, or published.
Whether you dispute the debt, amount, charges, or identity of the lender.
The action you want: stop harassment, remove a post, stop contacting third persons, investigate the collector, provide a statement of account, correct inaccurate data, restrict unlawful processing, or preserve relevant records.
A request for written confirmation and a complaint reference number.

For an NPC complaint, this written notice is especially important. Under the 2021 NPC Rules of Procedure, a complainant generally must first inform the responsible company or entity in writing and allow it to act. The NPC may proceed when the entity takes no timely or appropriate action or gives no response within 15 calendar days from receipt.

The NPC may waive that step for good cause or a serious violation, including grave and irreparable harm, the absence of an adequate remedy, or patently illegal conduct. If urgent harm makes prior notice unsafe or inadequate, explain the circumstances and expressly ask the NPC to waive the requirement.

How to report to the SEC

Use the SEC for unfair debt collection by a lending company, financing company, online lending platform, or its collection agent.

File through SEC iMessage and select the service for complaints involving financing and lending companies. Save the ticket number and every uploaded file. The SEC’s March 2026 advisory also lists hotline 1-4732 (1-4SEC).

Your complaint should identify:

The app and company behind it.
The company’s Certificate of Authority details, if available.
The collector’s name, number, account, or agency.
The loan date, amount received, due date, payments, and disputed charges.
Each abusive act in chronological order.
People contacted who were not guarantors.
Any public post or disclosure of personal information.
The remedy requested and whether the conduct is continuing.

Report an apparently unregistered or unrecorded app even if you cannot identify its legal operator. Provide the app-store link, website, advertisements, payment account, phone numbers, and all names used.

How to file a privacy complaint with the NPC

A formal privacy complaint is appropriate when your personal data—or the data of a contacted relative, friend, co-worker, or character reference—was unlawfully collected, accessed, copied, retained, used, or disclosed.

Follow the NPC’s formal complaint instructions:

Download and complete the NPC Complaints-Assisted Form.
Use one complaint form

Quick answer

Report unfair collection by an online lending app to the Securities and Exchange Commission (SEC) through the SEC iMessage portal. Report misuse of contacts, photos, IDs, loan details, or other personal data to the National Privacy Commission (NPC). If the lender is a bank, digital bank, e-money issuer, or another BSP-supervised institution, first complain to that institution and then escalate an unresolved complaint to the Bangko Sentral ng Pilipinas (BSP).

Threats of violence, fraud, identity theft, doxxing, or other possible crimes should also be reported promptly to the police, NBI Cybercrime Division, or DICT Cyber Hotline. If someone is in immediate danger, contact emergency services or the nearest police station without waiting for a regulator to respond.

A lender may lawfully demand payment and pursue legitimate remedies. It may not use threats, deception, public shaming, abusive language, or unlawful processing of personal data. Reporting misconduct does not cancel a valid debt, but owing money does not surrender your rights.

What conduct should be reported?

Unfair or abusive debt collection

Under SEC rules and the Financial Products and Services Consumer Protection Act, prohibited or potentially actionable conduct includes:

Threatening violence, damage to property, or harm to you, your family, reputation, or employment.
Threatening arrest, imprisonment, criminal prosecution, or another action that cannot legally be taken on the stated facts.
Using obscenities, degrading insults, or abusive language.
Pretending to be a lawyer, court, police officer, government employee, or another person.
Sending fake subpoenas, fabricated court documents, false “warrants,” or misleading legal notices.
Publishing or threatening to publish your name, photo, ID, loan information, or alleged nonpayment to shame you.
Telling other people false information about the debt or concealing that the debt is disputed.
Using deceptive means to collect or to obtain information about you.
Contacting people from your phone, email, or social-media contact lists for debt collection when they are not guarantors.
Repeatedly messaging relatives, co-workers, employers, neighbors, or friends to expose or pressure you over the debt.
Using your borrower photo, selfie, or ID to embarrass or harass you.

SEC Memorandum Circular No. 18, series of 2019 generally treats contact before 6:00 a.m. or after 10:00 p.m. as unreasonable, subject to its specific exceptions when the account is over 15 days past due or the borrower has given recorded, written, or electronic consent to those hours. Those exceptions do not authorize threats, deception, shaming, or privacy violations.

The lender remains responsible for its employees and agents. Outsourcing collection to a call center, collection agency, or individual collector does not make abusive conduct permissible. Under Republic Act No. 11765, a financial service provider may also be solidarily liable with an accredited third-party service provider for acts or omissions in debt collection.

Privacy violations

The Data Privacy Act and NPC rules require personal-data processing to be lawful, transparent, for a legitimate purpose, and proportionate. Report conduct such as:

Copying or using an entire contact list to pressure a borrower.
Messaging contacts who were never chosen as guarantors.
Treating a character reference as responsible for the debt.
Accessing photos, files, location, microphone, camera, or contacts when access is unnecessary or excessive.
Keeping app permissions active after their stated purpose has been completed.
Sending loan details, IDs, selfies, or personal information to unauthorized people.
Using a borrower’s photo for a shaming post, altered image, or threatening message.
Continuing to use inaccurate, unlawfully obtained, or unnecessary data after a valid objection or request for correction, blocking, or erasure, where no other lawful ground for retention applies.
Obtaining consent through misleading interfaces, pre-ticked boxes, or designs that conceal the privacy-protective choice.

The current government position is clear: for debt collection, lending and financing companies may contact the guarantor, not everyone in the borrower’s contact list. A guarantor must have separately and expressly agreed to guarantee the debt. A character reference is not automatically a guarantor and should be contacted only for identity or information verification—not to demand payment.

Not every disclosure or retention is automatically illegal. A lender may have a lawful basis to keep limited records for an existing contract, regulatory obligations, or the establishment, exercise, or defense of legal claims. Whether particular processing is lawful depends on the data, purpose, notices, consent or other legal basis, and actual use.

What to do immediately

1. Deal with immediate safety risks

If a message threatens physical harm, identifies your location, threatens your child or family, or suggests an imminent visit or attack:

Move to a safe place.
Tell a trusted person.
Contact the nearest police station or emergency services.
Do not meet a collector alone.
Do not click links, install another app, or send an OTP, password, PIN, or additional ID.

A regulatory complaint is not a substitute for urgent police assistance.

2. Preserve evidence before blocking or uninstalling

Save the evidence in its original context as far as possible:

Full screenshots showing the sender, phone number or account, date, time, and complete message thread.
Screen recordings of scrolling conversations, app pages, permission screens, privacy notices, and collection posts.
Original SMS, emails, chat exports, voice messages, and call logs.
URLs and screenshots of social-media posts, including the profile or page that published them.
App name, developer name, app-store listing, download link, version, and requested permissions.
Loan agreement, disclosure statement, payment schedule, statement of account, receipts, and proof of disbursement.
Names, numbers, aliases, payment accounts, and claimed employer of each collector.
Messages received by relatives, co-workers, or other contacts.
Your written complaint to the lender and proof it was received.
Any response, ticket number, promise to investigate, or refusal to act.

Keep unedited originals and make at least one backup. Create a short timeline listing each incident, date, sender, recipient, and attachment filename. Ask affected contacts to preserve their own messages and, if willing, provide a signed statement describing what they received.

Electronic evidence must later be authenticated. Keeping originals, intact message threads, metadata, and a clear account of how the evidence was obtained makes that easier. Be careful about secretly recording private spoken conversations: the Anti-Wiretapping Act generally requires authorization from all parties. Preserve existing voicemails and written messages, and obtain legal advice before making covert audio recordings.

3. Reduce further access

After preserving what you need:

Revoke the app’s access to contacts, photos, camera, microphone, location, and storage.
Review permissions for other unfamiliar apps.
Change important passwords from a trusted device, especially email, banking, e-wallet, and social-media passwords.
Enable multi-factor authentication.
Tell your bank or e-wallet provider immediately if an account, OTP, PIN, or transaction may have been compromised.
Uninstall the lending app if it is no longer needed or appears unsafe.

Revoking access or uninstalling the app does not necessarily erase copies already obtained. Include a written demand that the company stop unlawful processing and identify what information it holds, where it came from, whom it was shared with, and its retention basis.

4. Identify the company behind the app

The app name may differ from the registered corporate name. Look for the company name in the loan agreement, disclosure statement, privacy notice, app-store developer details, payment instructions, or collection messages.

Use the SEC’s Check with SEC service to determine whether the company is registered and has a Certificate of Authority to operate as a lending or financing company. Corporate registration alone is not enough; offering loans requires the appropriate authority.

Record any mismatch between:

The app and corporate names.
The named lender and the payment-account holder.
The company and collection agency.
The registration or Certificate of Authority claimed and what SEC records show.

Report the app even if you cannot identify its operator. Provide every available lead, including URLs, numbers, account names, screenshots, and payment destinations.

Send a written demand to the lender

A written complaint creates evidence and is generally required before a formal NPC complaint. Send it to the lender’s customer-assistance unit and data protection officer, if listed.

State:

Your name and account or loan reference, without sending unnecessary sensitive data.
The incidents, dates, sender numbers, and people contacted.
The specific personal data accessed, used, or disclosed.
That you dispute any inaccurate amount or representation, if applicable.
The relief you want, such as:
- Stop contacting non-guarantors.
- Stop threats, abusive messages, and public disclosure.
- Remove unlawful posts.
- Correct an inaccurate balance or record.
- Identify the company and collection agency.
- Provide the agreement, disclosure statement, statement of account, and itemized computation.
- Explain the lawful basis, source, recipients, and retention period for your data.
- Block, erase, or stop processing data that is unlawfully obtained, used for an unauthorized purpose, or no longer necessary, subject to lawful retention obligations.
A request for a written response and complaint reference number.

For an NPC complaint, the general rule is that the lender or other responsible entity must first be informed in writing and given an opportunity to act. If it takes no timely or appropriate action, or does not respond within 15 calendar days after receiving the written notice, the complaint may be filed with the NPC. The NPC may waive this requirement for good cause or a serious violation, including grave and irreparable harm, lack of an adequate remedy, or patently illegal conduct. Explain and document why a waiver is necessary if waiting would create serious risk.

Where and how to report

Problem	Primary channel	Important point
Harassment or unfair collection by a lending or financing company or its online platform	SEC iMessage	Save the ticket number and uploads.
Unlawful access, use, retention, or disclosure of personal data	NPC complaint process	Formal complaints generally require prior written notice, supporting evidence, notarization, and fees.
Complaint against a bank, digital bank, e-money issuer, or other BSP-supervised institution	Institution’s complaints unit, then BSP Consumer Assistance Mechanism	Complaining first to the institution is a condition for BSP escalation.
Threats, fraud, identity theft, fake documents, account compromise, or other possible crimes	Police, NBI Cybercrime Division, or DICT Cyber Hotline	Do not wait for an SEC or NPC result if safety or evidence is at risk.

Filing with one agency does not necessarily prevent filing with another. SEC, NPC, BSP, and law-enforcement authorities have different powers and may address different parts of the same conduct. Disclose related complaints accurately in each filing.

Filing with the SEC

Use SEC iMessage and select the service for complaints involving financing and lending companies. The SEC’s March 2026 joint advisory also lists hotline 1-4732 (1-4SEC).

Include:

App name and exact corporate name, if known.
SEC registration and Certificate of Authority details, if found.
Loan and account reference.
Chronological statement of events.
Collector and collection-agency details.
Names or descriptions of third persons contacted.
Copies of threats, abusive messages, public posts, and disclosures.
Agreement, disclosure statement, statement of account, and payment records.
Your written complaint to the lender and its response.
The action requested from the SEC.

Describe facts rather than making unsupported accusations. For example: “On 2 August 2026, this number sent my loan balance and ID photo to three co-workers who were not guarantors,” followed by the corresponding attachments.

The SEC can investigate regulatory violations and impose sanctions within its authority. A complaint does not automatically produce damages, cancel the loan, or decide every contractual dispute.

Filing with the NPC

Use the current Complaints-Assisted Form and filing instructions. The NPC’s official process requires the complainant to:

Complete the complaint form accurately.
File one complaint form per respondent.
Identify the complainant and respondent, or provide facts that may lead to the respondent’s identity.
Describe the data processed and the alleged violation.
Attach correspondence showing prior written notice to the respondent, unless seeking a justified waiver.
Attach documentary evidence and witness affidavits, if any.
State the relief requested.
Include verification and a certification against forum shopping.
Attach an accepted government-issued ID.
Have the complaint notarized.

The notarized complaint may be submitted in person, by courier, or as a scanned filing to complaints@privacy.gov.ph, following the NPC’s current instructions.

Under the published NPC fee schedule, the basic complaint filing fee is ₱500, plus a legal research fee of 1% of the filing fee but not less than ₱10. Additional fees apply when damages are claimed. Qualified indigent complainants may seek exemption by submitting the prescribed proof. Follow the NPC’s assessment and payment instructions rather than sending money to an unofficial account.

If the same or a similar claim is already pending before a court, tribunal, or quasi-judicial agency, disclose it in the certification. If you later learn of such a case, the NPC rules require notice to the Commission within five calendar days.

File promptly even when no short filing deadline is stated on the current complaint page. Delay can cause evidence to disappear and may affect prescriptive periods or available relief.

Complaints involving BSP-supervised institutions

Some digital loans are issued by banks, digital banks, or other BSP-supervised institutions rather than SEC-regulated lending companies. The presence of a bank account or e-wallet as a payment channel does not, by itself, make the lender BSP-supervised.

For a BSP-supervised institution:

File first with the institution’s Financial Consumer Protection Assistance Mechanism or customer-service channel.
Keep the complaint reference, proof of submission, and final response.
If unresolved or unsatisfactory, escalate through the BSP Online Buddy on the BSP website or its official Facebook page.
If you cannot use the chatbot, complete the BSP Complaint/Inquiry/Reply form and send it with proof of the first-level complaint to consumeraffairs@bsp.gov.ph.

The BSP Consumer Assistance Mechanism is second-level recourse. A complaint to the institution is generally a condition precedent to BSP escalation.

Reporting threats, fraud, or cybercrime

The March 2026 DICT-NPC-SEC advisory lists these channels:

DICT Cyber Hotline: 1326@dict.gov.ph
NBI Cybercrime Division: ccd@nbi.gov.ph; telephone (02) 8523-8231 to 38
PNP Anti-Cybercrime Group: acg@pnp.gov.ph; telephone (02) 8723-0401 local 7491

Possible offenses depend on the actual evidence. Threats, unauthorized use of identifying information, fake digital documents, account intrusion, or defamatory online publication may implicate the Revised Penal Code, Data Privacy Act, Cybercrime Prevention Act, or other laws. A regulator or investigating authority—not the collector or borrower—determines whether the facts support a criminal case.

Ask investigators whether an urgent preservation request to a platform or telecommunications provider is appropriate. Do not delete the device, reset it, or surrender it to an unofficial “investigator.”

Common mistakes to avoid

Paying a personal or unfamiliar account under pressure. Verify the lender, balance, and official payment channel first.
Deleting the app or messages before preserving evidence.
Submitting cropped screenshots that omit the sender, date, or surrounding conversation.
Posting your own ID, contract, phone number, or complete complaint publicly. Redact unnecessary personal data.
Assuming a character reference owes the debt. Only a person who separately agreed to be a guarantor may be treated as one.
Using only the app’s brand name. Identify the corporation and collection agency when possible.
Treating an app-store report as a government complaint. Report to the platform if useful, but also file with the proper Philippine authority.
Ignoring the underlying loan. Continue requesting an accurate statement and propose payment arrangements through verified channels if the debt is valid.
Secretly recording calls without legal advice. Philippine anti-wiretapping rules can apply even when the person recording participates in the private conversation.
Exaggerating or altering evidence. A clear factual timeline is stronger than conclusions unsupported by documents.
Waiting for the harassment to become worse. Report urgent threats immediately and start the NPC’s written-notice process promptly.

When legal help is urgent

Consult a Philippine lawyer, the Public Attorney’s Office if you qualify, or another appropriate legal-aid provider promptly when:

There is a credible threat to life, safety, home, employment, or a child.
Intimate images, government IDs, or account credentials were published or threatened.
Money was taken through an unauthorized transaction.
A summons, subpoena, prosecutor’s notice, or court pleading appears genuine.
The lender filed a case or you need to respond within a stated deadline.
The app used your identity to create another account or loan.
You want damages, an injunction, a temporary ban on data processing, or another remedy requiring formal proceedings.
Several agencies or cases involve the same facts and the certification against forum shopping may be affected.
The lender or collector is outside the Philippines or cannot be identified.

Do not ignore a real court document merely because collectors previously sent fake ones. Verify it directly with the issuing court, prosecutor’s office, or agency.

Frequently asked questions

Can I be jailed simply because I did not pay an online loan?

No. Article III, Section 20 of the Constitution states that no person shall be imprisoned for debt. This does not prevent a creditor from filing a lawful civil action, and it does not immunize separate conduct that independently constitutes a crime, such as proven fraud. A collector cannot truthfully claim that nonpayment alone guarantees arrest or imprisonment.

Does filing a complaint erase the debt?

No. The legality of the collection conduct and the validity or amount of the debt are separate issues. Ask for the loan agreement, disclosure statement, itemized balance, payment history, and authority of the company to lend.

May the app contact my relatives or co-workers?

For debt collection, current NPC-SEC-DICT guidance states that the lender may contact the guarantor, not other people taken from the borrower’s contact list. A character reference is not automatically a guarantor. Facts such as whether a person separately consented to guarantee the loan matter.

I allowed contact access when installing the app. Does that make contact blasting lawful?

No. Consent must be informed and valid, processing must remain necessary and proportionate, and consent does not authorize harassment or unfair collection. Current rules prohibit unbridled processing of contact lists and collection from people other than guarantors.

Can a character reference be required to pay?

Not merely because the person was listed as a reference. A guarantor must separately and expressly bind themselves in accordance with the law on guaranty. A reference should not be converted into a guarantor without that consent.

Can I demand deletion of all my information immediately?

You may object to unlawful processing and request correction, blocking, erasure, or removal where the legal conditions are met. The lender may still retain limited information when required by law or necessary for the contract or legal claims. Demand a written explanation of the data, purpose, legal basis, recipients, and retention period.

Should I pay while the complaint is pending?

A complaint does not suspend a valid obligation automatically. Pay only after verifying the company, correct balance, and official channel. If the amount is disputed, state the dispute in writing and request an itemized computation. Obtain advice if payment may affect a pending case or claim.

Can a person contacted by the app file their own privacy complaint?

Potentially, yes. A relative, co-worker, reference, or other person whose own personal data was processed or who was directly affected may have an independent complaint. The NPC generally requires one complaint form per respondent, supported by that complainant’s own evidence.

Official sources

This article provides general Philippine legal information, not legal advice for a particular case. Procedures, jurisdiction, and remedies may depend on the lender’s identity, the loan documents, the evidence, and related proceedings. Official sources and reporting channels were checked on 4 August 2026.