Filing a Complaint



Who may complain?

Under Section 3, the following can file a complaint:

  1. The National Privacy Commission (NPC), on its own initiative;
  2. Those who have suffered a data privacy violation or personal data breach; and
  3. Persons who are personally affected by a violation of the Data Privacy Act of 2012 (Republic Act No. 10173).

Persons who are the subject of the data privacy violation or personal data breach may appoint a duly authorized representative to prosecute the complaint on their behalf.

If you decide to file a complaint, you must comply with the rule of exhaustion of remedies. This means that you should show that there was an opportunity offered in good faith to have the respondent comply with any legal obligations involving data protection and privacy.

Those who wish to file a complaint must comply with the rule of exhaustion of remedies. This rule means that in filing the complaint, a complainant must be able to show that there was an opportunity offered in good faith to have the respondent comply with any legal obligations involving data protection and privacy.

Back To Top



How do I file a complaint?

File a complaint-affidavit together with copies of any evidence and witnesses’ affidavit through the following:

  • in person (hard copy), at the NPC Office;
  • in person (portable electronic data storage device), at the NPC Office; or
  • electronically, via [email protected]

Electronic documents must be digitally signed and in .PDF format (if practicable), on page sizes compliant with the Efficient Use of Paper Rule. If submitted in this digital format, the NPC may charge fees for printing.

If submitting through a portable electronic data storage device, similar portable data storage devices containing the same files must also be given to any opposing party so named. One portable data storage device is equivalent to one copy. If the portable data storage device is infected with malware, the documents will not be considered as having been filed.

Back To Top



When can I expect a response?

If the subject of the complaint is a data breach that the private information controller must report to the NPC, the NPC may already be acting on the matter before you even file the complaint.

From the time complaints are received, the Complaints and Investigation Division, through its Investigating Officers, shall conduct initial evaluations on complaints so received within a reasonable time. Feedback may be expected within a few working days.

From here, the entire process, up to final adjudication, should take four to six months.

If there is a request to have the NPC issue a temporary stop processing order so as to enjoin the processing of any data, the NPC may issue an Order, after due hearing and the payment of the proper bond. This process can happen from one to two weeks after the filing of this request.

Back To Top



Process Matrix

Want to know more about this service? Download the full process matrix here.

Back To Top