The Data Privacy Act protects your personal information and gives you rights over how it is collected, used, and shared. When a personal information controller (a company, agency, or organization) violates those rights, you may file a complaint with the National Privacy Commission (NPC), the body that enforces the law. Common grounds include: processing your data without a lawful basis or consent; failing to secure your data, resulting in a breach or leak; using your data for purposes you did not agree to; refusing to let you access, correct, or erase your data; or unauthorized disclosure of your information. Before filing with the NPC, you are generally required to first exhaust the organization's own complaint or data protection mechanism — that is, notify the company and give it a chance to respond — unless doing so would be futile. The complaint to the NPC must be in writing, verified, and supported by evidence (your notice to the company, their response, and proof of the violation). The NPC can investigate, mediate, order compliance, and recommend prosecution; violations of the Data Privacy Act carry both fines and imprisonment. So if your personal data was mishandled or leaked, the NPC is where you seek redress, after first raising it with the organization.
When You Can Complain
- Data processed without lawful basis or consent;
- Failure to secure your data (a breach or leak);
- Use for unagreed purposes;
- Refusal to let you access, correct, or erase your data; or
- Unauthorized disclosure.
Exhaust the Company First
Before filing with the NPC, you must generally first notify the organization and give it a chance to respond (unless futile). Keep proof of your notice and their reply.
Filing and Outcomes
The complaint must be written, verified, and supported by evidence. The NPC can investigate, mediate, order compliance, and recommend prosecution — violations carry fines and imprisonment.
Practical Takeaways
- Complain to the NPC for mishandled or leaked personal data;
- Notify the company first and keep proof;
- The NPC can order compliance and violations carry fines and jail.
Frequently Asked Questions
Where do I complain if a company leaked my data? With the National Privacy Commission (NPC), the body that enforces the Data Privacy Act, after first raising the matter with the organization involved.
What are grounds for a data privacy complaint? Processing data without a lawful basis or consent, failing to secure data resulting in a breach, using data for unagreed purposes, refusing access, correction, or erasure, or unauthorized disclosure.
Do I need to complain to the company first? Generally yes. You are usually required to exhaust the organization's own complaint or data protection mechanism first, unless doing so would be futile, before filing with the NPC.
What can the NPC do? Investigate, mediate, order compliance, and recommend prosecution. Violations of the Data Privacy Act carry both fines and imprisonment.
This commentary is for general informational purposes only and does not constitute legal advice. For guidance specific to your situation, please consult a licensed attorney.
If you have questions about your rights or options under Philippine law, our firm is available to assist. You may reach us via Viber or WhatsApp, call us at 0995 433 5550, or send an email to vivasnobles@gmail.com. We look forward to hearing from you.