Who may complain?

Under Section 3, the following can file a complaint:

1. The National Privacy Commission (NPC), on its own initiative;

2. Those who have suffered a data privacy violation or personal data breach; and
3. Persons who are personally affected by a violation of the Data Privacy Act of 2012
(Republic Act No. 10173).

Persons who are the subject of the data privacy violation or personal data breach may appoint a
duly authorized representative to prosecute the complaint on their behalf.

If you decide to file a complaint, you must comply with the rule of exhaustion of remedies. This
means that you should show that there was an opportunity offered in good faith to have the
respondent comply with any legal obligations involving data protection and privacy.

Those who wish to file a complaint must comply with the rule of exhaustion of remedies. This
rule means that in filing the complaint, a complainant must be able to show that there was an
opportunity offered in good faith to have the respondent comply with any legal obligations
involving data protection and privacy.

How do I file a complaint?

File a complaint-affidavit together with copies of any evidence and witnesses’ affidavit through
the following:

 in person (hard copy), at the NPC Office;

 in person (portable electronic data storage device), at the NPC Office; or
 electronically, via complaints@privacy.gov.ph.

Electronic documents must be digitally signed and in .PDF format (if practicable), on page sizes
compliant with the Efficient Use of Paper Rule. If submitted in this digital format, the NPC may
charge fees for printing.

If submitting through a portable electronic data storage device, similar portable data storage
devices containing the same files must also be given to any opposing party so named. One
portable data storage device is equivalent to one copy. If the portable data storage device is
infected with malware, the documents will not be considered as having been filed.
When can I expect a response?

If the subject of the complaint is a data breach that the private information controller must report
to the NPC, the NPC may already be acting on the matter before you even file the complaint.

From the time complaints are received, the Complaints and Investigation Division, through its
Investigating Officers, shall conduct initial evaluations on complaints so received within a
reasonable time. Feedback may be expected within a few working days.

From here, the entire process, up to final adjudication, should take four to six months.

If there is a request to have the NPC issue a temporary stop processing order so as to enjoin the
processing of any data, the NPC may issue an Order, after due hearing and the payment of the
proper bond. This process can happen from one to two weeks after the filing of this request.

A formal complaint needs to be filed in a specific format. You may use the downloadable form
below and follow these steps:

1. Download this form
2. Print and fill out
3. Have it notarized
4. Then submit to NPC (3 options):
a. in person
b. send via courier service, or
c. scan and email it to complaints@privacy.gov.ph