Quick answer
Yes. If personal information, identifiable photos, private messages, records, or other personal data were posted online without a lawful basis, you may demand removal, exercise your rights under the Data Privacy Act, report the content to the platform, and file a complaint with the National Privacy Commission (NPC). Depending on what was posted and why, civil damages, an injunction, workplace or school remedies, and criminal complaints may also be available.
However, lack of consent does not automatically make every post illegal. Consent is only one lawful basis for processing personal information. Disclosure may sometimes be justified by law, legitimate interests, public authority, legal claims, or overriding freedom-of-expression and public-interest considerations. The result depends on the information, its source, the purpose and scale of publication, the poster’s role, and the harm caused.
If the post exposes your address, identification numbers, financial or medical information, intimate material, a child’s sexual content, or threats against you, treat the matter as urgent.
What counts as personal information?
Under the Data Privacy Act of 2012, personal information includes information that identifies a person by itself or when combined with other information. Examples include:
- Name, photograph, voice, address, telephone number, email address, location, or workplace
- Screenshots of private conversations
- Account details, transaction records, or identification documents
- Information that allows strangers to locate or impersonate someone
- An identifiable person’s photograph or video
The Act gives additional protection to “sensitive personal information,” including information about age, marital status, race, religious or political affiliations, health, education, genetic or sexual life, criminal proceedings, tax returns, licences, and government-issued identifiers such as SSS numbers.
Uploading, sharing, reposting, storing, altering, or otherwise using this information may constitute “processing.” The NPC has specifically reminded the public that sharing identifiable photos and videos online must have a lawful basis and comply with transparency, legitimate purpose, and proportionality.
When posting without consent may violate the Data Privacy Act
A disclosure is more likely to be unlawful when:
- The poster obtained the information unlawfully or through unauthorized access.
- An employer, school, business, lender, hospital, association, or government office used information for a purpose materially different from the reason it was collected.
- The disclosure was unnecessary or excessive for any legitimate purpose.
- Sensitive information or identification documents were exposed publicly.
- A person with access through work or official duties disclosed confidential records.
- The information was used to shame, threaten, harass, impersonate, or pressure the individual.
- The poster ignored a valid objection or erasure request without another lawful basis for continued processing.
The Act requires lawful and fair processing and observance of transparency, legitimate purpose, and proportionality. Information should be relevant, not excessive, accurate, and retained only as long as necessary.
Important exceptions and qualifications
Absence of consent is not conclusive. Personal information may sometimes be processed without consent when necessary for a contract, compliance with law, protection of life or health, public functions, or a legitimate interest that is not overridden by the individual’s fundamental rights. Sensitive personal information is governed by narrower exceptions.
Other qualifications include:
- An individual handling information solely in connection with personal, family, or household affairs is excluded from the Act’s definition of a personal information controller. Whether a public social-media disclosure remains within that exclusion is fact-dependent.
- Processing for journalistic, artistic, literary, or research purposes receives special treatment to protect speech, expression, and the press. The exemption applies only to the minimum extent necessary and does not excuse violations of other laws.
- Certain information about government officers, public contracts, government benefits, and public-authority functions is outside parts of the Act’s coverage.
- A removal request may be denied when the information remains necessary for a legal obligation, a legal claim, a legitimate business purpose, or an overriding matter of public interest. The status of the person as a public figure and freedom of speech, expression, or the press may be considered.
- Information being available elsewhere does not automatically authorize every form of republication, profiling, harassment, or use for a new purpose. Conversely, a person’s own decision to post information publicly may affect the reasonable expectation of privacy.
What to do immediately
1. Preserve reliable evidence before seeking removal
Record the content before it disappears, but do not unnecessarily spread it. Preserve:
- Full screenshots showing the post, account name, date, time, captions, comments, and surrounding page
- The exact URL for every post, profile, image, video, or search result
- A screen recording showing how the page was reached
- Copies of the original files, messages, emails, and notifications
- Account-profile information that may help identify the poster
- Dates when you discovered the post and when it was shared or edited
- Numbers of shares, reactions, or views, if displayed
- Messages showing how the poster obtained the information
- Platform reports, reference numbers, and removal responses
- Medical expenses, lost income, security costs, fraudulent transactions, or other documented harm
- Names and affidavits of witnesses who personally saw the material
Keep the original device and unedited files when possible. Electronic evidence must be authenticated; a cropped screenshot by itself may be challenged. The Rules on Electronic Evidence place the burden of proving authenticity on the party presenting the electronic document.
For intimate material or child sexual abuse or exploitation material, do not forward, repost, or make unnecessary copies. Preserve links and reporting details and contact law enforcement promptly.
2. Secure exposed accounts and documents
If the post includes passwords, identification documents, banking information, signatures, security answers, or contact details:
- Change affected passwords and enable multi-factor authentication.
- Sign out other sessions and review account-recovery settings.
- Notify the bank, e-wallet, telecommunications provider, or issuing agency.
- Ask whether an exposed card, account, SIM, or identification document should be replaced or restricted.
- Monitor statements and preserve evidence of unauthorized transactions.
- Warn trusted household members if the disclosure creates a physical-security risk.
3. Report the content to the platform
Use the platform’s privacy, impersonation, harassment, non-consensual intimate-image, or personal-information reporting process. Report each copy separately when necessary. Save confirmation emails and ticket numbers.
A platform report may produce a faster practical result, but platform removal does not determine legal liability and does not replace an NPC, civil, or criminal complaint.
4. Send a written demand to the responsible person or organization
Address the demand to the poster and, if an organization is involved, its data protection officer or privacy office. Identify:
- The exact URLs and content
- The personal data involved
- Why you say the processing or disclosure is unlawful, inaccurate, excessive, or unauthorized
- Whether consent was never given, was limited to another purpose, or has been withdrawn
- The harm or continuing risk
- The action requested and a reasonable deadline based on urgency
Where applicable, expressly request:
- Immediate suspension, blocking, or removal
- Correction of false or incomplete information
- The source of the information and the identities or classes of recipients
- Cessation of further sharing
- Notification to recipients that the material has been erased or corrected
- Reasonable efforts to ask third-party sites and search indexes to erase copies or de-list links
Send the demand through a method that proves delivery. Do not publish more private material while attempting to rebut the post.
Filing a complaint with the National Privacy Commission
The NPC may investigate violations, facilitate settlement, award indemnity, impose administrative sanctions, compel appropriate action, and refer appropriate cases to the Department of Justice for prosecution.
Exhaustion requirement
As a general rule, you must first inform the personal information controller, processor, or concerned entity in writing and give it an opportunity to act. An NPC complaint may proceed when the entity fails to take timely or appropriate action or does not respond within 15 calendar days from receiving your written notice.
The NPC may waive this requirement for good cause or a serious violation, including circumstances involving grave and irreparable harm, lack of a plain and adequate remedy, or patently illegal conduct. Explain and prove the urgency rather than simply omitting the demand.
Complaint requirements
Use the NPC’s Complaint-Affidavit effective 1 July 2025. The complaint should be verified and should include:
- Your identity and contact details
- The respondent’s identity or facts that may lead to identification
- A clear chronological narration
- The personal data and alleged violations involved
- Documentary evidence and witness affidavits
- Copies of your written demand and the response, if any
- The relief requested
- Verification and certification against forum shopping
- A valid government-issued identification document
The current basic filing fee is ₱500, with additional fees for damage claims and a legal research fee. Indigent complainants and specified government entities may qualify for exemption under the NPC schedule of fees.
Complaints may be filed personally, by registered mail, by courier, or through electronic mail as authorized by the NPC. Check the NPC filing page immediately before submission for the current address, email channel, payment instructions, and formatting requirements.
Urgent temporary relief from the NPC
A complainant may apply for a temporary ban on personal-data processing to preserve the complainant’s rights, national security, or public interest. The application may accompany the complaint or be filed before the NPC decision becomes final. Supporting evidence, judicial affidavits, and a bond fixed by the investigating officer are generally required unless an exemption applies. Use the NPC Temporary Ban Application Form dated 1 March 2026.
A temporary ban is discretionary. Filing an application does not guarantee immediate removal.
Civil remedies
Articles 19, 20, 21, and 26 of the Civil Code require people to act with justice and good faith and to respect another person’s dignity, privacy, and peace of mind. Conduct that meddles with private life or wilfully causes injury contrary to law, morals, good customs, or public policy may support an action for:
- Actual or compensatory damages
- Moral damages when legally and factually justified
- Other appropriate damages
- Prevention, removal, or other injunctive relief
A court application for a temporary restraining order or injunction requires proof of the legal right, the threatened or continuing violation, and the applicable procedural requirements. Courts also consider freedom of expression and the rule against prior restraint, particularly when the information concerns public affairs.
Civil actions based on injury to rights or quasi-delict generally have a four-year period under Article 1146. Actions for defamation have a one-year period under Article 1147. The correct period and when it began can depend on the cause of action and facts, so obtain advice early.
When criminal laws may apply
Not every privacy violation is a crime. Criminal liability requires proof of every statutory element beyond reasonable doubt.
Data Privacy Act offenses
Depending on the respondent’s role and conduct, possible offenses include unauthorized processing, processing for an unauthorized purpose, malicious disclosure, and unauthorized disclosure.
For example:
- Unauthorized processing of ordinary personal information is punishable by one to three years’ imprisonment and a ₱500,000 to ₱2 million fine.
- Unauthorized processing of sensitive personal information is punishable by three to six years’ imprisonment and a ₱500,000 to ₱4 million fine.
- Malicious disclosure by a personal information controller, processor, or its officer, employee, or agent is punishable by one year and six months to five years’ imprisonment and a ₱500,000 to ₱1 million fine.
- Unauthorized disclosure by such a controller, processor, officer, employee, or agent carries different penalties depending on whether ordinary or sensitive personal information was disclosed.
These penalties are not automatically triggered merely because a post lacked consent. The lawful basis, respondent’s legal role, type of data, purpose, intent, and statutory elements must be established.
Anti-Photo and Video Voyeurism Act
The Anti-Photo and Video Voyeurism Act applies to recordings of sexual activity or a person’s specified private areas under circumstances involving a reasonable expectation of privacy. Copying, distributing, publishing, broadcasting, or showing covered material may be illegal even when the person originally consented to its recording.
A violation is punishable by three to seven years’ imprisonment, a ₱100,000 to ₱500,000 fine, or both. The law does not cover every ordinary photograph posted without consent.
Gender-based online sexual harassment
The Safe Spaces Act may apply when the unauthorized sharing forms part of gender-based online sexual harassment. Covered conduct can include cyberstalking, impersonation, threats, sexual or sexist attacks, unauthorized recordings, and sharing photos, videos, voice recordings, or information online in the context defined by the Act.
The PNP Anti-Cybercrime Group is primarily responsible for receiving complaints under this part of the law. Workplace and school cases may also be reported to the institution’s Committee on Decorum and Investigation or equivalent mechanism. The statutory penalty for gender-based online sexual harassment is prision correccional in its medium period, a ₱100,000 to ₱500,000 fine, or both.
Identity theft, hacking, or cyberlibel
The Cybercrime Prevention Act may apply when someone:
- Intentionally acquires, uses, misuses, transfers, possesses, alters, or deletes another person’s identifying information without right
- Obtains the information through illegal access or hacking
- Publishes a defamatory imputation through a computer system
A disclosure that is merely unwanted or embarrassing is not automatically cyberlibel. Defamation, publication, identification, malice, and the other required elements must be proven.
Under the Supreme Court’s ruling in Causing v. People, cyberlibel prescribes in one year from discovery by the offended party, the authorities, or their agents, subject to rules on interruption and proof. Do not delay if defamatory content may be involved.
The NBI and PNP are the statutory cybercrime law-enforcement authorities. The NBI provides investigative assistance for victims of computer crimes.
Sexual content involving a child
Sexualized material involving a child requires immediate action under the Anti-OSAEC and Anti-CSAEM Act. A child’s apparent consent is not a defense. Do not download, possess, or redistribute the material merely to collect evidence. Preserve the URL and report it promptly to law enforcement, the platform, and child-protection authorities.
Common mistakes to avoid
- Assuming that “no consent” is the only issue and ignoring other possible lawful bases
- Reporting the content before preserving its URL and reliable evidence
- Cropping screenshots so heavily that the account, date, and context cannot be authenticated
- Reposting the material to “expose” the offender
- Publicly arguing with an anonymous account and alerting it to destroy evidence
- Filing an NPC complaint without first giving written notice or explaining why exhaustion should be waived
- Using an outdated NPC complaint form
- Filing against a platform alone without identifying the original poster or responsible organization where possible
- Claiming cyberlibel when the issue is disclosure rather than defamation
- Waiting until a short prescriptive period is about to expire
- Downloading or forwarding intimate or child sexual material unnecessarily
- Treating a successful platform takedown as proof that a law was violated
When legal help is urgent
Consult a Philippine lawyer or contact law enforcement immediately when:
- Your home address, current location, identification numbers, bank details, or children’s information are exposed.
- The post includes threats, stalking, extortion, impersonation, hacking, or fraudulent transactions.
- Intimate images or recordings are involved.
- The victim is a child.
- The material is spreading rapidly or has been copied to several websites.
- An employer, school, hospital, bank, lender, or government office disclosed confidential records.
- You need a temporary ban, restraining order, injunction, or evidence-preservation assistance.
- Cyberlibel or another offense with a short filing period may apply.
- The poster is anonymous and subscriber information may have to be obtained through lawful investigative or court processes.
FAQ
Can I force Facebook, TikTok, Google, or another platform to delete the post?
You can use the platform’s reporting process and, where justified, seek an NPC or court order against the legally responsible party. Removal is not automatic, especially when lawful speech or public-interest issues are involved.
Can I demand deletion even if the information is true?
Possibly. Truth does not by itself settle a data-privacy claim. The source, lawful basis, purpose, necessity, proportionality, public interest, and applicable exceptions still matter. Truth is evaluated differently in defamation cases.
What if the information originally came from my public profile?
A public setting may affect your reasonable expectation of privacy and the assessment of legitimate interests, but it does not necessarily authorize identity theft, harassment, excessive disclosure, or reuse for an unrelated unlawful purpose.
Can I complain if I do not know the poster’s real name?
Yes, but provide all available identifying details, URLs, account names, messages, and circumstances that may lead to the person’s identity. The NPC may dismiss a case if the parties cannot be identified or traced despite diligent efforts, while cybercrime investigators may use lawful processes to obtain relevant records.
Does deleting the post end the case?
Not necessarily. Deletion may reduce ongoing harm, but it does not automatically erase liability for a completed
Quick answer
You may demand removal, report the content to the platform, exercise your data-subject rights, complain to the National Privacy Commission (NPC), and—depending on what was posted and why—seek civil damages, an injunction, or criminal investigation.
However, lack of consent does not automatically make every online post illegal. Consent is only one possible lawful basis for processing personal information. Disclosure may sometimes be justified by law, legitimate interests, public duties, legal claims, or freedom of speech, expression, and the press. The result depends on the information disclosed, its source, purpose, accuracy, audience, harm caused, and the poster’s legal basis.
Act quickly if the post exposes your address, contact details, government IDs, financial or medical records, intimate material, a child’s information, or anything creating an immediate risk of fraud, stalking, violence, or reputational harm.
When the Data Privacy Act may apply
The Data Privacy Act of 2012 protects information from which a person can be identified, either by itself or when combined with other information. Online disclosure is a form of “processing.”
Personal information can include:
- Your name, photograph, voice, address, telephone number, email address, workplace, location, or account details;
- Information identifying your family members;
- Screenshots of private conversations tied to your identity; and
- Any combination of details that makes you reasonably identifiable.
The Act classifies certain data as sensitive personal information, including information about age, marital status, race or ethnicity, religious or political affiliations, health, education, genetic or sexual life, alleged or decided offenses, tax returns, government-issued identifiers, and specified government records.
An identifiable photo or video can be personal information even when it does not show a government ID or written name. The NPC has specifically reminded the public that sharing identifiable photos and videos must have a lawful basis and comply with transparency, legitimate purpose, and proportionality.
No consent does not always mean no lawful basis
For ordinary personal information, processing may be lawful without consent when, for example, it is necessary to perform a contract, comply with a legal obligation, protect vital interests, perform an authorized public function, or pursue a legitimate interest that is not overridden by the person’s fundamental rights.
Sensitive personal information receives stricter protection. Its processing is generally prohibited unless a specific exception applies, such as an express legal authorization, protection of life or health, medical treatment, or processing necessary for court proceedings or the establishment, exercise, or defense of legal claims.
Even when a lawful basis exists, the disclosure must generally remain fair, relevant, adequate, and no more extensive than necessary. A legitimate complaint about a transaction, for example, does not automatically justify displaying another person’s home address, identification number, medical history, relatives’ information, or unrelated private messages.
Important exceptions and limits
Personal or household affairs
An individual handling information solely in connection with personal, family, or household affairs is excluded from the statutory definition of a personal information controller. Whether a public social-media disclosure remains within that exclusion is fact-dependent. The post’s audience, purpose, organization, repetition, and connection to business, employment, advocacy, or another non-household activity may matter.
Even where this exclusion prevents a Data Privacy Act claim, the Civil Code and applicable criminal laws may still provide remedies.
Journalism, art, literature, and research
The Data Privacy Act treats processing for journalistic, artistic, literary, or research purposes as a special case to protect speech, expression, and the press. The NPC’s guidance explains that this is not blanket permission to disregard privacy or other laws and applies only to the minimum extent necessary for the protected activity.
Public interest and public figures
The right to erasure may be limited when information remains necessary to inform the public about a matter of overriding public interest. Relevant considerations include freedom of speech and the press, whether the person is a public figure, and whether further processing could reasonably have been expected.
Information already available somewhere online is not automatically free for every unrelated or harmful use. Conversely, a person’s own public disclosure, the public nature of an event, or a genuine public controversy can affect the strength of a privacy claim. Courts and regulators must balance privacy against protected expression based on the actual context.
What to do immediately
1. Preserve evidence before seeking removal
Record the content before it disappears or changes. Preserve:
- Full screenshots showing the post, account name, date, time, captions, comments, and visible URL;
- A screen recording showing how the account and post were accessed;
- The exact post, profile, group, and website links;
- Copies of the original image, video, message, or document when it is safe and lawful to keep them;
- Account identifiers, usernames, profile details, and any available contact information;
- Comments, shares, reposts, view counts, threats, and messages showing how the disclosure spread;
- Emails or notifications from the platform;
- Your written requests for removal and proof that they were received;
- Records of fraud attempts, account access, stalking, lost work, medical treatment, counseling, or other harm; and
- Statements from people who saw the content.
Keep the original electronic files and do not edit or crop your only copy. Electronic evidence must be authenticated; a printout can qualify as an original only when shown to reflect the data accurately. The Rules on Electronic Evidence place the burden of proving authenticity on the party presenting the electronic document.
Do not publicly repost the material merely to call attention to it. That can increase the harm and complicate questions about further disclosure.
If the material depicts child sexual abuse or exploitation, do not download, forward, or circulate it. Preserve the link and basic identifying details and contact law enforcement immediately.
2. Reduce immediate security risks
If exposed data could enable fraud or account takeover:
- Change affected passwords and enable multi-factor authentication;
- Contact your bank, e-wallet provider, mobile carrier, or account provider;
- Ask the issuing agency whether a compromised ID, card, or account number should be replaced;
- Monitor transactions and account-recovery activity;
- Warn household members if their safety or accounts are affected; and
- Report direct threats or an unfolding physical danger to the police.
3. Report the content to the platform
Use the platform’s privacy, harassment, impersonation, doxxing, non-consensual intimate-image, or child-safety reporting channel, whichever accurately fits the content. Submit the exact URLs and explain which details identify you and what harm they create.
A platform’s removal decision is separate from legal liability. Removal does not prevent an NPC complaint or other case, while refusal by a platform does not prove that the post is lawful.
4. Send a written demand to the responsible person or organization
Send the demand to the poster and, when applicable, the organization’s data protection officer or privacy contact. It should:
- Identify each post and URL;
- List the personal information involved;
- State which information is false, unlawfully obtained, excessive, or used for an unauthorized purpose;
- Explain the immediate risk or harm;
- Request removal, blocking, correction, or restricted access;
- Ask for the source, purpose, legal basis, recipients, and retention period;
- Ask that previous recipients be informed of any correction or erasure;
- Request reasonable steps to remove copies and seek de-listing from search indexes; and
- Require written confirmation of the action taken.
Use a trackable method and keep proof of receipt. Avoid unsupported accusations or threats.
Under the NPC’s current rules, a complainant normally must first notify the respondent in writing and allow appropriate action. If there is no response within 15 calendar days from receipt, or no timely and appropriate action, an NPC complaint may proceed. The NPC may waive this requirement for good cause or a serious violation, including grave and irreparable harm, lack of an adequate remedy, or patently illegal conduct.
Exercising the right to erasure, blocking, objection, or correction
Under Section 16 of the Data Privacy Act and the NPC’s data-subject-rights guidance, you may request suspension, withdrawal, blocking, removal, or destruction when there is substantial proof that the data is:
- Incomplete, outdated, false, or unlawfully obtained;
- Used for an unauthorized purpose;
- No longer necessary;
- Being processed unlawfully; or
- Processed in violation of your data-subject rights.
You may also object when processing relies on consent or legitimate interests, subject to other lawful grounds. If information is inaccurate, request correction and ask that previous recipients be notified.
Erasure is not absolute. A request may be refused to the extent the information remains necessary for a legal obligation, legal claim, legitimate business purpose, overriding public interest, protected expression, or another lawful purpose.
For publicly available online data, NPC guidance directs the responsible controller to take reasonable and appropriate measures to contact other controllers and third-party indexes and request removal of copies, search results, or links. This does not guarantee that every independent copy will disappear.
Filing a complaint with the National Privacy Commission
Use the NPC’s current Complaint-Affidavit form, which took effect on 1 July 2025.
A complaint generally must:
- Be written, signed, verified, and notarized;
- Identify the complainant and respondent, or explain circumstances that may lead to the respondent’s identity;
- Describe the events clearly and chronologically;
- Identify the personal information processed;
- State the relief requested;
- Include documentary evidence and witness affidavits, when available;
- Attach correspondence showing compliance with the 15-day exhaustion requirement, or establish grounds for waiver;
- Include verification and certification against forum shopping; and
- Include a valid government-issued ID and the applicable filing fee or exemption documents.
The basic complaint filing fee under the currently posted NPC schedule is ₱500, plus applicable legal-research and damages-related fees. Qualified indigent litigants and government complainants may be exempt, subject to the required proof.
Complaints may be submitted personally, by registered mail, courier, or authorized email. Check the NPC filing page immediately before filing for the current address, email instructions, payment method, and document requirements.
If continued processing threatens serious harm, a complainant may consider the NPC’s Temporary Ban Application. It may be attached to the complaint or filed before the NPC decision becomes final. Supporting documents, judicial affidavits, and ordinarily a bond fixed by the investigating officer are required. A temporary ban is discretionary, not automatic.
The NPC may facilitate settlement, adjudicate the complaint, award appropriate indemnity, impose administrative sanctions, and issue enforceable orders. If it finds criminal prosecution warranted, it may forward the record to the Department of Justice and recommend prosecution.
Civil remedies
Articles 19, 20, 21, and 26 of the Civil Code require people to act with justice and good faith and to respect the dignity, personality, privacy, and peace of mind of others. Meddling with another person’s private life, humiliating conduct, or a willful or negligent act causing damage can support a claim for:
- Actual or compensatory damages;
- Moral damages when legally justified;
- Other damages allowed by law; and
- Prevention or other appropriate relief, potentially including an injunction.
A court application to stop or remove speech requires careful legal assessment. Courts must also consider freedom of expression, public interest, procedural requirements, and the rule against unjustified prior restraint.
Civil actions based on injury to rights or quasi-delict generally have a four-year prescriptive period, while an action for defamation must generally be filed within one year. The correct period and starting date depend on the cause of action pleaded, the facts, and any controlling special law. Consult counsel promptly rather than waiting for the apparent deadline.
When criminal laws may apply
An offensive or unwanted post is not automatically a crime. Criminal liability requires proof of every statutory element beyond reasonable doubt. Depending on the facts, the following laws may apply.
Data Privacy Act offenses
Possible offenses include unauthorized processing, processing for an unauthorized purpose, malicious disclosure, and unauthorized disclosure. The exact offense depends on the accused’s role, the kind of information, authorization, purpose, and mental state.
For example:
- Unauthorized processing of ordinary personal information carries one to three years’ imprisonment and a ₱500,000 to ₱2 million fine.
- Unauthorized processing of sensitive personal information carries three to six years’ imprisonment and a ₱500,000 to ₱4 million fine.
- Malicious disclosure by a personal information controller, processor, or its responsible official, employee, or agent carries one year and six months to five years’ imprisonment and a ₱500,000 to ₱1 million fine.
- Unauthorized disclosure by such a controller, processor, official, employee, or agent carries one to three years and a ₱500,000 to ₱1 million fine for ordinary personal information, or three to five years and a ₱500,000 to ₱2 million fine for sensitive personal information.
These penalties are not automatically imposed merely because a complaint was filed. Criminal penalties require prosecution and conviction.
Cybercrime and identity theft
The Cybercrime Prevention Act may apply when someone intentionally acquires, uses, misuses, transfers, possesses, alters, or deletes another person’s identifying information without right. Impersonation, fraudulent accounts, or misuse of identifying data may constitute computer-related identity theft if all elements are established.
The NBI and PNP are the designated cybercrime law-enforcement authorities. Victims may seek assistance from the NBI Cybercrime Division or the appropriate PNP cybercrime unit.
Cyberlibel
A post containing a defamatory imputation may constitute cyberlibel if the legal elements of libel—including identification, publication, defamatory imputation, and the required malice—are proven. A disclosure that is merely private or embarrassing is not necessarily libel, and truth, privileged communication, fair comment, public interest, and other defenses require fact-specific analysis.
The Supreme Court has held that cyberlibel generally prescribes in one year from discovery by the offended party, authorities, or their agents. Because proving the discovery date can become important, preserve evidence of when and how you first learned of the post. See the Supreme Court’s ruling in Causing v. People.
Intimate photos or videos
The Anti-Photo and Video Voyeurism Act applies specifically to images or recordings of sexual acts, similar activity, or private areas captured under circumstances involving a reasonable expectation of privacy.
It also prohibits copying, distributing, publishing, broadcasting, showing, or exhibiting covered material. Consent to the original recording does not by itself authorize later copying or publication; written consent to the later disclosure is material. Violations carry three to seven years’ imprisonment, a ₱100,000 to ₱500,000 fine, or both, at the court’s discretion.
Gender-based online sexual harassment
The Safe Spaces Act may apply when the conduct is gender-based or sexual and involves threats, cyberstalking, incessant messaging, impersonation, reputational attacks, or unauthorized online sharing of photos, videos, recordings, or other information.
Gender-based online sexual harassment is punishable by prision correccional in its medium period, a ₱100,000 to ₱500,000 fine, or both. The PNP Anti-Cybercrime Group is the primary body designated to receive these complaints. The Act also permits an appropriate court to issue a stay-away order.
If the conduct occurred in a workplace or school, report it to the institution’s Committee on Decorum and Investigation or equivalent mechanism. Covered workplace and school committees must generally investigate and decide complaints within 10 days or less, while observing due process, protecting against retaliation, and maintaining confidentiality as far as possible.
Sexual material involving a child
The Anti-OSAEC and Anti-CSAEM Act prohibits producing, publishing, transmitting, distributing, possessing, or accessing child sexual abuse or exploitation material, regardless of an apparent consent by the child.
Report such content immediately to law enforcement, the PNP Women and Children Protection Desk, or an appropriate child-protection authority. Do not save or forward the material beyond what authorities instruct you to do.
Common mistakes to avoid
- Assuming that “no consent” is enough without addressing other claimed lawful bases;
- Reporting only the account instead of preserving the post’s exact URL and content;
- Cropping screenshots so heavily that the account, date, or context cannot be verified;
- Editing or deleting original files and metadata;
- Publicly reposting the material and increasing its reach;
- Filing an NPC complaint without first making a written demand or explaining why the requirement should be waived;
- Submitting an unverified, unnotarized, incomplete, or unsupported NPC complaint;
- Naming the wrong respondent without documenting efforts to identify the responsible person or organization;
- Treating every embarrassing statement as cyberlibel;
- Assuming that a platform’s refusal to remove content decides the legal issue;
- Waiting until evidence disappears or a prescriptive period is close to expiring; and
- Downloading or circulating intimate or child sexual-abuse material in an attempt to preserve proof.
When legal help is urgent
Consult a Philippine lawyer or contact law enforcement immediately when:
- The post includes threats, stalking, extortion, sexual coercion, or your live location;
- Your address, government ID, banking information, passwords, or account-recovery details are exposed;
- Intimate content has been posted or threatened;
- A child’s safety or sexual material involving a child is involved;
- The poster is anonymous and subscriber or platform records may be needed;
- The material is spreading rapidly or causing immediate employment, financial, medical, or physical harm;
- You need an NPC temporary ban, court injunction, or preservation of platform records;
- The post may be cyberlibel and the one-year period is running; or
- You are considering parallel NPC, civil, criminal, workplace, or school proceedings and need to avoid inconsistent filings or forum-shopping problems.
FAQ
Can I force Facebook, TikTok, X, or another platform to delete the post?
You can use the platform’s reporting process and may pursue legal remedies against the responsible parties. Removal is not automatic. The platform’s rules, its role in processing the data, Philippine jurisdiction, applicable lawful bases, and any regulator or court order will affect the result.
Is a screenshot of a private conversation protected?
It can contain personal or sensitive personal information. Disclosure may violate privacy law when it lacks a lawful basis or is excessive, unfair, or unrelated to a legitimate purpose. But disclosure may be justified in limited situations, such as evidence necessary for a legal claim, report to authorities, or other lawful purpose.
Does it matter that the information is true?
Yes, but truth does not automatically authorize every disclosure. Accurate information can still be private, sensitive, excessive, or used for an unauthorized purpose. For defamation, truth and good motives or justifiable ends may be relevant, but the exact defense depends on the kind of statement and circumstances.
Can I complain if the poster is anonymous?
Yes, but provide every available identifier and explain your efforts to identify the account holder. Law enforcement may seek subscriber or computer data through the procedures and court authority required by law. NPC complaints may be dismissed if the parties cannot be identified or traced despite diligent effort.
Must I wait 15 days while a dangerous post remains online?
Not necessarily. Continue using platform safety channels and contact law enforcement when there is immediate danger. The NPC may waive exhaustion for good cause or a serious violation, including grave and irreparable harm or lack of an adequate remedy. Explain and prove the urgency in the complaint.
Can I claim damages before the NPC?
The Data Privacy Act authorizes the NPC to award appropriate indemnity in matters affecting personal information. The current Complaint-Affidavit allows a complainant to request damages and administrative fines. A separate civil action may also be possible, but parallel proceedings require careful attention to jurisdiction and the certification against forum shopping.
Does deleting the post end the case?
No. Deletion can reduce continuing harm, but it does not necessarily erase liability for the original processing, disclosure, harassment, or damage. Preserve evidence before removal.
Official references
This article provides general Philippine legal information, not legal advice or a prediction of any case’s outcome. Rights, defenses, procedure, venue, and deadlines depend on the complete facts and documents. Sources and procedures were checked as of 3 August 2026.