How to File a Data Privacy Complaint with the NPC in the Philippines
You file a data privacy complaint with the National Privacy Commission (NPC) by submitting a written, verified complaint that identifies the parties, narrates the facts, attaches supporting evidence, states the relief you want, and certifies that you have not filed the same case elsewhere — either through the NPC’s simpler complaints-assisted process or through a formal, notarized Complaint-Affidavit, depending on how the matter is best resolved.[1][2] The NPC only has jurisdiction over privacy violations and personal data breaches under the Data Privacy Act of 2012 (RA 10173); a complaint that is really about wages, dismissal, or another employment dispute belongs with DOLE, SEnA or the NLRC instead.[1]
Direct Answer
The NPC handles two related but distinct entry points, and picking the wrong one is a common mistake.
Complaints-assisted process: a simpler, NPC-facilitated route where the Commission helps you raise the issue directly with the organization involved, often resolving straightforward matters without a full adjudicative proceeding.[3]
Formal complaint: a verified Complaint-Affidavit filed under the NPC’s 2021 Rules of Procedure (as amended), which triggers a structured investigation, possible mediation, a Fact-Finding Report, and a Commission Decision that can include indemnity, a processing ban, compliance orders, administrative fines, or referral to the Department of Justice for criminal prosecution.[2]
Either way, you must be a data subject affected by the violation (or an authorized representative, guardian, or the NPC itself), your complaint must actually allege a privacy violation or data breach under RA 10173 — not a general employment or consumer dispute — and a formal complaint generally requires a ₱500 filing fee unless you qualify as an indigent litigant or file as a government entity.[1][2][4]
Decision Snapshot
| Element | Summary |
|---|---|
| Who can file | Data subjects affected by a privacy violation or data breach; an authorized representative with a special power of attorney; a parent/guardian for a minor; or the NPC on its own initiative |
| Governing rule | 2021 Rules of Procedure of the National Privacy Commission, as amended (2024) |
| What the NPC covers | Violations of the Data Privacy Act of 2012 and related NPC issuances — not wage, dismissal, or other pure labor disputes |
| Two tracks | Complaints-assisted (NPC-facilitated, less formal) or a formal, notarized Complaint-Affidavit (adjudicative) |
| Filing fee | ₱500 standard fee for a formal complaint; exempt if indigent, a government agency, an LGU, or a GOCC |
| Where to file | In person, by registered mail, by courier, or through NPC-authorized electronic channels |
| Evidence to retain | Correspondence attempting to resolve the issue with the organization, screenshots, breach notices, consent records, and any document showing the violation and its effect on you |
| First action | Confirm the issue is a genuine privacy violation or data breach, gather your evidence, and decide between the complaints-assisted route and a formal Complaint-Affidavit |
Key Takeaways
- The NPC’s jurisdiction is limited to violations of the Data Privacy Act of 2012 and related issuances — a complaint that does not pertain to a privacy violation or data breach can be dismissed outright.[2]
- There are two entry points: a simpler complaints-assisted process and a formal, notarized Complaint-Affidavit that starts a full adjudicative proceeding.[2][3]
- A formal complaint must be verified, identify the parties, narrate the facts with supporting evidence, state the relief sought, show an attempt to resolve the matter directly with the respondent, and include a certification against forum shopping.[2]
- The standard filing fee is ₱500, waived for indigent litigants (on proof) and for government agencies, LGUs, and GOCCs.[1][4]
- The NPC’s own Rules of Procedure do not set a specific administrative filing deadline; they instead defer to Act No. 3326 for the criminal prescription period tied to the specific DPA offense charged.[2][5]
- A Commission Decision can be appealed once by motion for reconsideration, and afterward “to the proper courts, in accordance with law and the rules” — the Rules themselves do not name a specific court, though practitioners generally treat this as an appeal to the Court of Appeals under Rule 43.[2]
Table of Contents
- What Counts as an NPC Complaint
- Who Can File
- The Two Filing Tracks
- What a Formal Complaint Must Contain
- Filing Fees and Exemptions
- How and Where to Submit
- What Happens After You File
- Possible Outcomes and Remedies
- Motion for Reconsideration and Appeal
- Common Mistakes to Avoid
- What to Do Next
- Boundaries — What This Guide Does Not Establish
- Practical Hypotheticals
- Terminology
- FAQs
- Related Topics
Legal Basis
| Authority | Classification | Rule Supported | Binding Effect |
|---|---|---|---|
| Republic Act No. 10173, Data Privacy Act of 2012, Sec. 7 | Statute | NPC’s mandate to receive complaints and institute investigations for violations of the DPA | Binding statute |
| 2021 Rules of Procedure of the National Privacy Commission, as amended (2024), Rule II | Procedural rule | Who may file, complaint form and content, filing fees, case assignment | Binding procedural rule |
| 2021 Rules of Procedure of the NPC, as amended, Rule IV | Procedural rule | Grounds for outright dismissal of a complaint | Binding procedural rule |
| 2021 Rules of Procedure of the NPC, as amended, Rules V–VII | Procedural rule | Preliminary conference, mediation/ADR, discovery, and investigation with a Fact-Finding Report | Binding procedural rule |
| 2021 Rules of Procedure of the NPC, as amended, Rule VIII | Procedural rule | Clarificatory hearing, Commission Decision, available remedies, motion for reconsideration, finality | Binding procedural rule |
| NPC Schedule of Fees and Charges (implementing NPC Circular No. 2023-01) | Administrative issuance | ₱500 standard complaint filing fee and exemptions for indigent litigants, government agencies, LGUs, and GOCCs | Binding administrative rule |
| Act No. 3326 | Statute | General prescription periods for offenses punished by special laws, referenced by the NPC Rules for criminal-side prescription | Binding statute, applied by reference |
1. What Counts as an NPC Complaint
The NPC’s complaint process exists to enforce the Data Privacy Act of 2012 — it hears complaints about how personal data was collected, used, stored, shared, or protected, and about personal data breaches.[1] Under Rule IV of the NPC’s Rules of Procedure, a complaint that “does not pertain to a violation of the DPA or does not involve a privacy violation or data breach” can be dismissed outright, regardless of how serious the underlying grievance might otherwise be.[2]
This matters for employment situations in particular. If an employer mishandled your personal data — for example, disclosing your medical records to coworkers without basis, or failing to secure payroll data that was later leaked — that is a genuine NPC matter.[1] But if your real complaint is about an illegal dismissal, unpaid wages, or another labor standards issue, the correct forum is DOLE’s Single Entry Approach (SEnA) or the NLRC, not the NPC — even if personal data happened to be involved somewhere in the story.[2] See How to File SEnA in DOLE and How to File a Case Against Your Employer in the Philippines for those separate procedures.
2. Who Can File
Under Rule II, Section 1 of the NPC’s Rules of Procedure, a complaint may be filed by:[2]
- The data subject who was affected by the privacy violation or data breach.
- An authorized representative, acting under a special power of attorney.
- A parent or guardian, for a minor or an incompetent person, with appropriate supporting documentation.
- A juridical entity, through a proper board resolution and secretary’s certificate authorizing the filing.
- The NPC itself, acting on its own initiative (motu proprio).
3. The Two Filing Tracks
The NPC offers two distinct paths, and understanding the difference before you file saves time.[2][3]
Complaints-assisted process. This is the NPC’s lighter-touch option, intended for situations that may be resolved by having the Commission facilitate direct communication with the organization involved, using a Complaints-Assisted Form rather than a full notarized affidavit.[3] It is generally faster and less procedurally demanding, but it does not carry the full adjudicative weight of a formal complaint — it will not by itself produce a Commission Decision with indemnity or a processing ban.
Formal complaint. This is the adversarial route governed by the 2021 Rules of Procedure. It requires a notarized, verified Complaint-Affidavit and leads to case assignment, a chance for the respondent to answer, an optional preliminary conference and mediation, a formal investigation, and ultimately a Commission Decision that can grant indemnity, order a processing ban, or refer the matter for criminal prosecution.[2]
As a practical matter, a complainant who wants a documented, enforceable resolution — particularly where a data breach caused real harm or where the organization has been unresponsive — should generally use the formal Complaint-Affidavit process rather than the complaints-assisted route.
4. What a Formal Complaint Must Contain
Rule II, Section 3 of the NPC’s Rules of Procedure requires a formal complaint to be in writing, signed by the complainant or counsel, and verified in the format prescribed under the Rules of Court.[2] At minimum, it must include:[2]
- The complainant’s identity and contact information.
- The respondent’s identity, or the circumstances that would allow the respondent to be identified.
- A narration of the material facts, supported by evidence.
- All reliefs sought by the complainant.
- Correspondence or other proof showing an attempt to resolve the matter directly with the respondent.
- A certification against forum shopping — a sworn statement that no similar case is pending in another forum, with an obligation to report within five calendar days if one is later filed.
The NPC has released an official Complaint-Affidavit template with accompanying guidance to help complainants meet these requirements in the correct format.[4]
5. Filing Fees and Exemptions
A formal complaint generally requires payment of a filing fee before the NPC takes further action.[2] The NPC’s Schedule of Fees and Charges sets the standard complaint filing fee at ₱500.[4] Rule II, Section 4 of the Rules of Procedure exempts the following from this requirement:[2]
| Exemption | Requirement |
|---|---|
| Government complainant | The complainant is the government, a government agency or instrumentality, or a GOCC organized under its own charter (not one incorporated under the Corporation Code) |
| Indigent litigant | Complainant qualifies as indigent under the Rules of Court or NPC advisory criteria — generally, gross family income not exceeding double the monthly minimum wage and no real property valued above ₱300,000, supported by a Certificate of Indigency, notarized affidavit, and tax declarations |
| NPC-granted waiver | The NPC, on motion by the requesting party, waives the fee at its discretion for good cause shown |
The complaints-assisted process is generally treated as a no-fee or lower-friction alternative; confirm the current requirement directly with the NPC before filing, since fee schedules can be updated.
6. How and Where to Submit
A notarized formal complaint, together with supporting evidence and witness affidavits, may be submitted through any of the following channels:[2][3][4]
- In person, at the NPC’s designated office.
- Registered mail.
- Courier service.
- NPC-authorized electronic mail, submitted as a digitally signed PDF that complies with the Supreme Court’s electronic-document formatting rules.
The NPC may charge a separate printing fee for documents submitted electronically. Because official channels and portal availability can change, verify the current submission address and any online filing option directly on the NPC’s official website before sending your complaint.
7. What Happens After You File
Once a formal complaint is filed, it generally moves through the following stages under the NPC’s Rules of Procedure:[2]
| Stage | What Happens | Rule |
|---|---|---|
| Case assignment | The NPC raffles or assigns the complaint to an investigating officer within five calendar days | Rule II, Sec. 6 |
| Pre-investigation screening | The officer may dismiss the complaint outright within 30 days on specific grounds — insufficient form, no DPA violation alleged, or insufficient evidence — or otherwise give it due course | Rule IV, Sec. 1 |
| Preliminary conference | Within 30 days after the respondent’s comment, the officer convenes a conference to consider mediation, simplify issues, and address discovery | Rule V, Sec. 1 |
| Mediation (optional) | Parties may pursue alternative dispute resolution; a successful mediated settlement agreement terminates the complaint | Rule VI |
| Investigation | The officer may examine records and systems, conduct on-site inspections where needed, and requires the parties to submit memoranda within 15 days before preparing a Fact-Finding Report within 30 days | Rule VII |
| Clarificatory hearing (optional) | The Commission may call a hearing if it needs more information, with five calendar days’ notice; questions are submitted to the Commission rather than posed directly between parties | Rule VIII, Sec. 1 |
| Decision | The Commission issues a Decision resolving the case based on the evidence, which may include one or more remedies | Rule VIII, Sec. 6 |
The NPC’s own materials describe an initial 30-day window to give a complaint due course or dismiss it, with full resolution of a contested case commonly taking many months given the investigation, mediation, and hearing stages involved.[2][3] Treat any specific timeframe as an estimate rather than a guarantee, since actual duration depends on case complexity, evidence, and the Commission’s caseload.
8. Possible Outcomes and Remedies
If the Commission finds a violation, Rule VIII, Section 6 authorizes several possible remedies, which may be combined depending on the case:[2]
- Indemnity for harm to the data subject’s personal data protection rights, with the amount determined under Civil Code principles.
- A temporary or permanent ban on the respondent’s processing of personal data.
- A compliance order, compelling the respondent to take specific corrective action.
- An order for a sua sponte investigation, to identify the individuals within an organization responsible for the violation.
- Administrative fines for violations of the DPA or NPC issuances.
- A recommendation to the Department of Justice for criminal prosecution under the DPA’s penalty provisions.
Not every complaint results in every remedy, and the Commission’s Decision is based on the specific facts and evidence presented in that case — no outcome is guaranteed in advance.
9. Motion for Reconsideration and Appeal
A party has one opportunity to file a motion for reconsideration of a Commission Decision, which suspends the running of the period for the decision to become final.[2] If no motion is filed, the Decision becomes final 15 calendar days after notice, and an entry of judgment is issued.[2]
Beyond the motion for reconsideration, the Rules of Procedure state only that “any appeal from the decision shall be to the proper courts, in accordance with law and the rules,” without naming a specific court or procedural rule.[2] Because the NPC is a quasi-judicial agency, Philippine legal commentary and practice generally treat an appeal from a final NPC Decision as going to the Court of Appeals under Rule 43 of the Rules of Court, consistent with how appeals from other quasi-judicial bodies are handled — but this specific characterization comes from secondary legal commentary rather than the NPC’s own Rules, and should be confirmed with counsel before relying on it for a filing deadline.[6]
10. Common Mistakes to Avoid
| Mistake | Why It Matters |
|---|---|
| Filing an employment dispute as an NPC complaint | The NPC only has jurisdiction over DPA violations and can dismiss outright a complaint that does not pertain to a privacy violation or data breach |
| Skipping direct communication with the organization first | The Rules require the complaint to show correspondence or another attempt to resolve the matter with the respondent directly |
| Filing an unverified or unnotarized formal complaint | A formal Complaint-Affidavit must be verified and notarized in the prescribed format to be accepted |
| Omitting the certification against forum shopping | This sworn certification is a required element of the complaint, not an optional attachment |
| Assuming the NPC will confirm a specific fine or compensation amount in advance | Remedies depend on the Commission’s evaluation of the specific facts and evidence; no outcome is guaranteed |
| Missing the 15-day window to move for reconsideration | A Decision becomes final and executory 15 calendar days after notice if no motion for reconsideration is filed |
What to Do Next
- Confirm your complaint genuinely involves a privacy violation or personal data breach under the Data Privacy Act, not a separate employment or consumer issue.
- Gather your evidence: correspondence with the organization, screenshots, breach notices, consent records, and anything showing how the violation affected you.
- Attempt to resolve the issue directly with the organization first, and keep a record of that attempt.
- Decide between the complaints-assisted process and a formal Complaint-Affidavit based on how serious the matter is and whether you want an enforceable Commission Decision.
- If filing formally, prepare, verify, and notarize your Complaint-Affidavit using the NPC’s official template, and pay the applicable filing fee or file for an exemption.
- Submit through an official NPC channel and keep proof of submission.
- Consult a Philippine lawyer with data privacy experience, or the NPC directly, if the case is complex, involves a large-scale breach, or if you are unsure whether an exemption or a specific deadline applies to your situation.
Boundaries — What This Guide Does Not Establish
This guide explains the general procedure for filing a complaint with the National Privacy Commission. It does not determine whether your specific situation actually involves a privacy violation or data breach under the DPA — that depends on your facts. It does not guarantee that the NPC will accept, mediate, investigate, or rule in favor of any particular complaint, and it does not calculate or promise a specific indemnity, fine, or other remedy. It does not state a fixed administrative filing deadline, because the NPC’s own Rules of Procedure do not set one for administrative complaints. It also does not replace advice from the NPC directly or from a Philippine lawyer with data privacy experience on a specific, active complaint.
Practical Hypotheticals
Hypothetical 1 — Genuine NPC matter: An employee discovers that a former employer disclosed their SSS number and medical records to a third-party recruiter without consent or any lawful basis. This is a personal-data-processing issue governed by the DPA, so the employee gathers the relevant messages and records, attempts to raise the issue with the former employer in writing, and files a formal Complaint-Affidavit with the NPC after that attempt is unsuccessful.
Hypothetical 2 — Wrong forum: An employee believes they were dismissed without valid cause and that HR shared their termination notice with coworkers. The core issue is the dismissal itself, which is a labor dispute properly filed through SEnA or the NLRC; only the narrower question of whether sharing the termination notice was an unauthorized disclosure of personal data would potentially be a separate, secondary NPC matter, and even then only after confirming it meets the DPA’s requirements.
Hypothetical 3 — Data breach affecting many employees: A company’s payroll system is breached, exposing employees’ bank details and government ID numbers. Multiple affected employees may each file complaints, or the matter may also prompt the NPC to act on its own initiative once it becomes aware of the breach, independent of any individual complaint.
Terminology
| Term | Meaning |
|---|---|
| Complaints-assisted process | The NPC’s simpler, facilitation-oriented complaint channel, distinct from a formal adjudicative proceeding |
| Complaint-Affidavit | The verified, notarized document that formally initiates an NPC adjudicative complaint proceeding |
| Certification against forum shopping | A sworn statement confirming no identical case is pending in another forum, required in a formal complaint |
| Fact-Finding Report | The investigating officer’s report summarizing findings after the investigation stage, submitted to the Commission |
| Data Protection Officer (DPO) | The individual an organization designates to ensure compliance with the DPA and act as its NPC contact point — see the glossary entry |
FAQs
Is there a filing fee to complain to the NPC?
A formal Complaint-Affidavit generally requires a ₱500 filing fee under the NPC’s Schedule of Fees and Charges, unless you qualify for an exemption as an indigent litigant, a government agency, an LGU, or a GOCC.[2][4]
How long does an NPC complaint take to resolve?
The NPC generally acts on an initial screening within 30 days of filing, but a fully contested case that goes through preliminary conference, investigation, and a Commission Decision can take considerably longer, since the timeline depends on case complexity, evidence, and the Commission’s caseload.[2][3]
Do I need a lawyer to file an NPC complaint?
A lawyer is not strictly required to file a complaint, but the formal Complaint-Affidavit must still be properly verified, notarized, and complete, and a lawyer can help ensure the certification against forum shopping and evidentiary presentation meet the NPC’s requirements, particularly for a complex or high-value case.
Can I file an NPC complaint about something that also involves my job?
Only the personal-data-processing aspect of the situation falls under the NPC’s jurisdiction. A dismissal, wage, or other core employment dispute must go through DOLE’s SEnA process or the NLRC; the NPC can dismiss a complaint outright if it does not actually pertain to a DPA violation.[2]
What happens if the NPC rules against me?
You may file one motion for reconsideration within the period stated in the Commission’s Decision. If that is unsuccessful or not filed, the Decision becomes final 15 calendar days after notice, after which any further appeal proceeds to the courts — generally understood in practice as the Court of Appeals under Rule 43, though the NPC’s own Rules do not name the specific court.[2][6]
Related Topics
- What Is the Privacy Law in the Philippines? — the governing statute behind every NPC complaint.
- Is a Data Protection Officer Mandatory in the Philippines? — who within an organization is accountable for the conduct a complaint may target.
- Employer Monitoring of Remote Workers in the Philippines — a common source of workplace privacy complaints.
- How to File SEnA in DOLE — the correct route for labor disputes that are not privacy violations.
- How to File a Case Against Your Employer in the Philippines — the broader labor-complaint process.
- Data Privacy Act of 2012 — glossary definition of the governing statute.
- Data Protection Officer (DPO) — glossary definition of the accountable role.
Conclusion
Filing a data privacy complaint with the NPC means confirming your issue is genuinely a privacy violation or data breach under the Data Privacy Act, choosing between the complaints-assisted process and a formal, verified Complaint-Affidavit, preparing your evidence and certification against forum shopping, paying the ₱500 filing fee unless you qualify for an exemption, and submitting through an official NPC channel. From there, the case moves through case assignment, possible mediation, investigation, and a Commission Decision that can include indemnity, a processing ban, or referral for prosecution — with one motion for reconsideration available before the decision becomes final. A dispute that is really about your job, rather than your personal data, belongs with DOLE or the NLRC instead.
Sources and Legal Citations
- Republic Act No. 10173, Data Privacy Act of 2012, Section 7, National Privacy Commission. Official text via LawPhil. Supports: NPC’s mandate to receive complaints and investigate DPA violations. Status: verified official source.
- 2021 Rules of Procedure of the National Privacy Commission, as amended, National Privacy Commission. Official NPC Rules of Procedure (PDF). Supports: who may file, complaint content requirements, filing fees and exemptions, case-assignment and investigation timeline, available remedies, motion for reconsideration and finality. Status: verified official source.
- National Privacy Commission, “File a Complaint.” Official NPC page. Supports: description of the complaints-assisted process and general submission channels. Status: verified official source.
- National Privacy Commission, “Filing a Complaint” and Complaint-Affidavit template. Official NPC page; NPC Schedule of Fees and Charges (PDF). Supports: formal complaint submission process and the ₱500 standard filing fee with exemptions. Status: verified official source.
- Act No. 3326, An Act to Establish Periods of Prescription for Violations Penalized by Special Acts. Referenced in the NPC Rules of Procedure, Rule I, Section 6, for criminal-side prescription. Status: verified by reference within the primary source; full text not independently rechecked in this article.
- Secondary legal commentary on NPC appeal practice (e.g., Respicio & Co., “National Privacy Commission Complaint Guide Philippines,” respicio.ph). Supports: the general practitioner understanding that NPC Decisions are appealed to the Court of Appeals under Rule 43. Status: secondary source; the NPC’s own Rules of Procedure do not name a specific court or rule, and this characterization should be confirmed with counsel before relying on it for a filing deadline.
Sources rechecked as of: August 17, 2026. Last materially reviewed: August 17, 2026.
Disclaimer
This article is for general educational and legal-information purposes only and is not legal advice. Whether a specific situation qualifies as a privacy violation or data breach, which filing track is appropriate, what fee or exemption applies, and what remedy the NPC may grant all depend on your specific facts and current NPC rules, which can change. Nothing here guarantees that the NPC will accept, mediate, investigate, or rule in favor of a complaint, or guarantees a specific compensation, fine, or other outcome. For a specific situation, consult a Philippine lawyer with data privacy experience or the National Privacy Commission directly. LaborCode.ph is an independent information resource and is not a law firm, government agency, or tribunal.
