In Short
- Republic Act No. 10173, the Data Privacy Act of 2012, gives you the right to know how your data is used, to see it, to refuse, to correct it, to have it deleted or blocked, to take a copy to another provider, and to be paid for harm (damages).
- Start by writing to the organization's Data Protection Officer (DPO), the person in charge of privacy. Keep proof that they received it.
- The NPC usually acts on a complaint only after you wrote to the organization and it did not act properly within 15 calendar days.
- The NPC complaint is a sworn statement, signed before a notary, with your proof attached.
Your Rights Over Your Personal Information
You have rights over the personal information others keep about you. Under the Data Privacy Act (RA 10173), the person whose information is collected is the data subject. The company, school, office or app that decides how it is used is the personal information controller. As a data subject, you have the right:
| Right | What It Means in Practice |
|---|---|
| To be informed | To know whether your data is being processed (collected, stored or used), why, by whom, for how long, and who it is shared with. This is usually in the privacy notice. |
| To object | To refuse the use of your data, including for direct marketing (ads sent to you), and to refuse your consent. Some uses do not need your consent, such as what a law requires. |
| To access | To get a copy of your data and information on its sources, the people it was shared with, and how it was used. |
| To correct (rectification) | To dispute wrong or incomplete data and have it fixed. |
| To erasure or blocking | To have data removed, blocked or destroyed when it is incomplete, outdated, false, obtained illegally, no longer needed, or processed without your consent where consent was needed. |
| To data portability | To get your data in a common electronic format you can take to another provider, if the data is kept electronically. |
| To damages | To be paid for harm caused by wrong, incomplete, outdated, false or illegally obtained data, or by use of it without permission. |
The organization may ask you to prove your identity before acting. Some rights have limits, for example when the data is needed for a legal claim, something the law requires, or government work.
Step 1: Write to the Data Protection Officer
Organizations that collect or use personal data must have a Data Protection Officer (DPO). Their contact details are usually in the privacy notice on the website or app.
- Write a short letter or email. Say who you are, what data you are asking about, which right you are using (for example, access or erasure), and what you want them to do.
- Attach a copy of a valid ID if they need to confirm your identity. Cover numbers they do not need.
- For a privacy violation (for example, your data was leaked or shared without your consent), describe what happened, when, and attach screenshots.
- Keep proof that they received it: the email, a receiving copy, or a courier receipt.
See the data access request template.
Step 2: Complain to the National Privacy Commission
Under the NPC's 2021 Rules of Procedure, the NPC usually gives a complaint due course (agrees to act on it) only if:
- you informed the organization in writing of the violation or breach, to give it a chance to act; and
- it did not act in a timely or appropriate way, or did not answer within 15 calendar days of receiving your letter.
The NPC may set these aside if it chooses, for example when there is a serious risk of harm.
How to file:
- Fill in the NPC's complaints-assisted form or prepare a verified complaint (a complaint under oath). Download the current form from the NPC website.
- Sign it in front of a notary public, together with the verification (sworn statement that it is true) and certification against forum shopping (sworn statement that you have not filed the same complaint elsewhere). See getting a document notarized.
- Attach all your evidence: screenshots, your letter to the DPO and its reply (or proof of no reply), and affidavits of witnesses. The NPC warns that a complaint with no evidence attached may be dismissed.
- File it with the NPC's Complaints and Investigation Division through the channels listed on the NPC website, by email or in person.
The NPC says it decides within 30 days whether to act on the complaint. The whole process can take months, and it may refer the parties to mediation first.
Data Breaches
When a data breach (a leak or theft of data) puts people's sensitive personal information at real risk, the law says the organization must notify the NPC and the affected people. Under the NPC's rules this must be done within 72 hours of knowing about the breach. If you get such a notice, follow its advice: change passwords, watch your bank and e-wallet accounts, and be careful with messages that use the leaked details.
Common Situations
- A lending app messaged your contacts or posted your photo. This can violate both the NPC's rules for lenders and the SEC's ban on unfair collection. See debt collection harassment.
- Your ID or personal details were posted online to shame or threaten you. Report the post to the platform, keep screenshots, and consider the NPC as well as the police cybercrime units. See online scams.
- An employer or school shared your records without a legal reason. Write to their DPO first.
- Endless marketing texts or calls after you said no. Use your right to object in writing, then complain if they continue.
Some acts are also crimes under the Data Privacy Act, such as using data without permission (unauthorized processing) or revealing it to cause harm (malicious disclosure). Criminal cases go through the prosecutor or the NPC's recommendation. For a case like this, get legal help. The Public Attorney's Office gives free help to people who qualify.
Before Filing With the NPC
Your ticks stay on this device only.
Common Questions
Do I Have to Write to the Company Before Complaining to the NPC?
Generally, yes. The NPC's rules ask that you informed the organization in writing and that it did not act properly or answer within 15 calendar days. The NPC can set this aside in some cases.
Is There a Fee to File a Complaint With the NPC?
The NPC's complaint pages do not list a filing fee. You will pay for notarizing the complaint. Check the NPC website for any current charges.
Can I Ask a Company for a Copy of All the Data They Have on Me?
Yes. That is your right of access under RA 10173. Write to their Data Protection Officer and be ready to prove your identity.
Can I Make a Company Delete My Data?
You can ask for it to be deleted or blocked when the data is wrong, outdated, obtained illegally, no longer needed, or used without consent where consent was required. Some records must be kept by law, so the company may refuse those.
How Long Does an NPC Complaint Take?
The NPC decides within 30 days whether to act on a complaint (give it due course). A full case can take many months, and mediation may come first.
Not legal advice. This is general information. For advice on your own situation, consult a lawyer. If you cannot afford one, the Public Attorney's Office (PAO) or an IBP legal aid office may help for free.
Government fees, rules and requirements change, so always check with the office concerned before you go. Last reviewed October 8, 2026.