NPC Data Privacy Complaint Philippines: How to File a Data Privacy Complaint

Last materially reviewed: October 5, 2026

How do I file a data privacy complaint with the NPC?

To file an NPC data privacy complaint in the Philippines, first notify the respondent in writing. If it does not take timely or appropriate action—or gives no response within fifteen calendar days—submit a verified and notarised Complaint-Affidavit with its Question-and-Answer document, supporting evidence, proof of prior notice and the applicable fee. The NPC permits personal delivery, registered mail, courier and authorised email filing at complaints@privacy.gov.ph. The complaint form lists the NPC office at the 25th–27th Floors, The Upper Class Tower, Quezon Avenue corner Scout Reyes Street, Quezon City 1103.

For the wider rights, breach, evidence and compliance framework, see the Philippine data privacy hub.

Choose the right route, prepare evidence, then file

1. Choose the next step for your situation

• You have not yet written to the organization: preserve the evidence and send its privacy contact a dated account, the personal data involved and the action you seek. Keep proof of receipt; review the prior-notice rule.
• There is no response after fifteen calendar days from receipt, or you can substantiate a failure to take timely or appropriate action: prepare the verified complaint and annexes. The NPC still evaluates whether the requirements are satisfied.
• Waiting risks grave or irreparable harm: document the urgency and request a waiver of the prior step under Rule II, Section 2. Ask the NPC or counsel about appropriate interim relief; a waiver or processing ban is not automatic.
• A hacked account, scam or financial loss is also involved: use the NBI or PNP reporting route and promptly contact the bank or payment provider where relevant. An NPC case does not replace those steps or guarantee recovery.
• You already sent a complaint: keep the exact package, payment proof and acknowledgment, obtain the docket number, and follow the case-monitoring steps below.
• You are reporting an organization’s breach: use the breach-notification guide; organizational notification and an individual’s complaint are different procedures.

2. Prepare your complaint file

• Your dated account of what happened, the personal data involved, the respondent and the action you want.
• Your written notice, proof the respondent received it, and any reply. If asking the NPC to waive prior notice, explain and support that request.
• Original messages, full-context screenshots, URLs, email headers and relevant notices; label copies as supporting exhibits and keep originals intact.
• The current complaint form, supporting documents and applicable identity or representative documents; review the form requirements and evidence checklist before signing or submitting.

3. Open the official filing route

Open NPC official filing instructions and current complaint form

The NPC page explains notarization and submission in person, by courier or by email. Confirm the current destination and applicable fees there. For prior notice and evidence requirements, read the NPC complaint mechanics.

This guide does not collect or submit your complaint. Send personal records only through the verified official channel, keep your submission proof and ask how to follow up. Opening the instructions is not a completed filing.

Key Takeaways

• Complaints are governed by NPC Circular No. 2021-01, the 2021 Rules of Procedure of the National Privacy Commission (28 January 2021), as amended by NPC Circular No. 2024-01 (26 January 2024).
• Exhaustion of remedies is mandatory. Rule II, Section 2 requires that you first inform the respondent in writing, and that it either failed to take timely or appropriate action or gave no response within fifteen (15) calendar days. Proof must be attached.
• The NPC publishes an official Complaint-Affidavit form with an integral Question-and-Answer document; the current version is marked NPC_LEO_CID_CAF-V2.0, R0.0, dated 01 March 2026.
• That form states plainly that failure to attach evidence shall cause outright dismissal.
• A filing fee of Php 500.00 applies under NPC Circular No. 2023-01, with waivers for government entities, indigent complainants, and good cause.
• The NPC can order compliance, ban processing, impose fines and award qualifying indemnity. None of these outcomes is automatic, and initial screening is not final adjudication.

Jump to a Section

• Decision snapshot: jurisdiction
• Governing law and authorities
• The mandatory prior step
• The complaint, element by element
• When another route or more evidence is needed
• Hypothetical scenarios
• Evidence and affidavit exhibits
• The procedure, step by step
• What happens after you file
• Remedies and realistic outcomes
• Common mistakes
• Complaint preparation checklist
• FAQs
• Official sources

Decision Snapshot: Does the NPC Have Jurisdiction?

Situation	What must be checked?	Next step
A company allegedly used your data unlawfully and has not replied to your written notice.	Is the claim about personal-data processing? Can you show receipt and fifteen calendar days without a response?	Prepare the complaint package; the lapse does not itself prove a DPA violation.
You found a leak yesterday and have not contacted the organization.	The prior step is ordinarily incomplete. Is there a supported basis for the NPC to waive it?	Give written notice, or explain and support an urgent waiver request.
An insulting post, fraud or bank debit also involves your personal data.	Separate the alleged data-processing violation from defamation, criminal conduct or the payment dispute.	Use the NPC route for the privacy issue and the appropriate crime-reporting route where needed; disclose related proceedings.
A public office published a name and job title in an official directory.	Does the information and use actually fall within a Section 4 special case, and only to the necessary extent?	Check the DPA IRR, Section 5, before concluding that publication was unlawful or exempt.

Governing Law and Authorities

The substantive law is Republic Act No. 10173, the Data Privacy Act of 2012. Section 7 gives the Commission the function of receiving complaints, investigating and adjudicating disputes over personal information processing, and empowers it to issue cease-and-desist orders and to ban processing. Section 16(f) gives the data subject the right to be indemnified for damages sustained through inaccurate, incomplete, outdated, false, unlawfully obtained or unauthorised use of personal information.

Procedure comes from NPC Circular No. 2021-01, the 2021 Rules of Procedure, dated 28 January 2021, amended by NPC Circular No. 2024-01 of 26 January 2024, which revised Rule II, Section 1 on who may file and how representatives are authorised. The consolidated text this guide relies on, read on 5 October 2026, is the 2021 Rules of Procedure of the NPC, As Amended. Fees come from NPC Circular No. 2023-01, the Schedule of Fees and Charges, dated 17 May 2023.

The Mandatory Prior Step With the Controller

Before filing an NPC data privacy complaint in the Philippines, Rule II, Section 2 requires written notice to the respondent and an opportunity to act. CyberCode’s guide explains that filing may proceed after no response within fifteen calendar days or after action that is not timely or appropriate.

Under Rule II, Section 2, the fifteen-calendar-day period runs from the respondent’s receipt of the written notice. The alternative is a failure to take timely or appropriate action. A reply before day fifteen does not automatically satisfy or defeat that condition: explain what was requested, what the respondent did and why its action was inadequate. The NPC assesses the supporting facts.

Rule II, Section 2 lets the Commission waive exhaustion where good cause is shown and proven, or where the allegations involve a serious violation given the risk to the data subject — including grave or irreparable damage only the Commission can prevent, cases where the respondent cannot provide an adequate remedy, and conduct that is patently illegal. A waiver is argued for, not assumed. Section IV of the official form gives two options only: you contacted the respondent in writing and list the correspondence, or you did not and must state the reason. That stated reason is your waiver argument.

The Complaint, Element by Element

An NPC Complaint-Affidavit in the Philippines must satisfy Rule II, Section 3 or it may be dismissed under Rule IV, Section 1. Use the current official form rather than an old six-page copy circulating online.

What the official complaint form contains

• Section I — Complainant: identity, contact details and address for service.
• Section II — Respondent: the controller, processor, responsible officer or other entity complained of and available contact information.
• Section III — Personal information: the categories of personal or sensitive personal information involved.
• Section IV — Exhaustion of remedies: prior correspondence with the respondent, its response or non-response, or the facts supporting a requested waiver.
• Section V — Alleged violation: the provision relied on and the date, time and place of the incident.
• Section VI — Narration: a chronological statement of material facts.
• Section VII — Evidence: an indexed list of annexes, supporting documents and witness affidavits.
• Section VIII — Relief: the orders, compliance action, indemnity or other relief requested.
• Question-and-Answer document: an integral attachment addressing the elements of each checked violation.
• Verification and certification against forum shopping: signed under oath and notarised.

Documents to attach

• Form: in writing, signed by the party or counsel, and verified as required by the Rules of Court.
• Complainant’s identity as the data subject claiming the violation or damage.
• Contact details and an address for service, including email.
• Respondent’s identity — the controller, processor or entity complained of. Responsible officers may also be named where they participated in the acts or were grossly negligent.
• Respondent’s contact information, if known.
• Narration of material facts, with the evidence showing the violation.
• The relief sought.
• The correspondence with the respondent, plus a statement of what it did or failed to do.
• Supporting documents: copies of the evidence and affidavits of witnesses.
• Certification against forum shopping, under oath, with an undertaking to report any similar action filed later within five (5) calendar days.

Who may file

Under Rule II, Section 1 as amended: the affected data subject; a representative holding a special power of attorney; a parent for a minor, supported by the birth certificate, or a guardian under court order; a single juridical person representing multiple data subjects, which needs an SPA from each; and non-resident citizens without a Philippine representative, whose documents must be notarised through a Philippine embassy or consulate, or apostilled. The NPC may also act on its own initiative.

Fees and timing

Rule II, Section 4 requires a filing fee. Under NPC Circular No. 2023-01 it is Php 500.00, with a legal research fee of one per cent of the filing fee but not less than Php 10.00, and an additional fee scaled to any damages claimed. Mediation and a motion for reconsideration are Php 500.00 each; a cease-and-desist application is Php 1,000.00. Check eligibility under Rule II, Section 4 and the current NPC fee schedule before assuming an exemption. For an indigency or discretionary waiver request, submit the required supporting documents and obtain NPC confirmation.

The Rules set no express filing deadline in Rule II; Rule I, Section 6 refers to Act No. 3326 for prescription of the Act’s penal provisions. Because no administrative filing deadline appears in the consolidated Rules as read on 5 October 2026, this guide states none — file promptly rather than rely on an assumed limitation period.

When Another Route or More Evidence Is Needed

The NPC route concerns personal-data processing under the DPA. Distinguish a claim outside that mandate from a complaint that lacks necessary proof or identification:

• Defamation, harassment or a billing dispute alone: those issues do not establish a DPA claim. Explain separately any allegedly unlawful collection, use or disclosure of personal data.
• An anonymous actor: identification is a practical filing obstacle, not a rule that every scam is outside privacy law. Rule IV, Section 1(5) permits dismissal where the parties, other than responsible officers of juridical persons, cannot be identified or traced despite diligent efforts. Preserve account, transaction and contact details and seek appropriate investigative assistance.
• Section 4 special cases: certain information and activities receive limited treatment under the DPA. IRR Section 5 limits the exemption to the processing necessary for the specific purpose; it is not a blanket exemption for an entire government office, bank, journalist or research project. Controllers and processors retain applicable security obligations.
• Recovery of a transfer or other financial loss: promptly use the provider’s dispute process and relevant regulator or court route. A privacy complaint is not a payment-reversal service. Qualifying indemnity under the NPC Rules is addressed below.

Hypothetical Philippine Scenarios

These are illustrative hypotheticals, not real cases and not decided NPC rulings.

Hypothetical 1: The lending app that called the contacts

A borrower in Cebu defaults on an app loan. Collectors message twenty people from her contact list, naming her debt. She emails the data protection officer on 1 August, hears nothing, and files on 20 August. The fifteen-day silence branch is satisfied. Her evidence: the app’s permission screen, the messages her contacts received with sender details and timestamps, and the delivered email showing no reply.

Hypothetical 2: The clinic that emailed results to the wrong patient

A Quezon City clinic sends a patient’s laboratory result to the wrong address. The patient writes; the clinic replies after four days that it is investigating. That acknowledgment alone does not determine whether action was timely or appropriate. The patient should retain the misdirected email and reply, identify the sensitive data exposed, and explain any continuing risk or missing action. If grave harm requires urgent NPC intervention, the patient can support a request to waive the prior step rather than assume that any early reply permits immediate filing.

Hypothetical 3: The complaint dismissed on day twenty-nine

A complainant files a well-written narration but attaches nothing, intending to “submit evidence later.” The investigating officer dismisses it without prejudice inside the thirty-day window under Rule IV, Section 1, exactly as the form warned. The complainant should address the stated defects promptly and check any reconsideration, refiling or prescription issue before acting.

Evidence, Documentation and the Affidavit Exhibits

The form requires you to list and identify all supporting documents, and states that evidence must comply with the Rules on Electronic Evidence. Not all proof is equal.

• A screenshot shows content but proves little about origin. Keep it full-screen and unedited, with the URL or account handle and a date visible.
• Full email headers beat a screenshot of an email body: they carry routing, sending server and timestamp data a cropped image does not.
• A platform message export beats photographs of a phone screen, because it preserves structure and metadata.
• The breach notice you received is authored by the controller itself, and is often the single most valuable exhibit you hold.
• Transaction records and account alerts connect the exposure to actual consequences.
• Timestamps establish the sequence: when it happened, when you found out, when you gave notice, and when any reply came.
• Prior-notice records: keep the written notice, proof of receipt and any reply. Explain either fifteen calendar days without response or why the action taken was untimely or inappropriate. If seeking waiver, support that request under Rule II, Section 2.

Annex your exhibits in the order the narration refers to them, letter them consecutively, and identify each in Section VII of the form. Attach a valid government-issued ID; the form lists accepted types including the Philippine passport, driver’s licence, PRC, postal, voter’s, GSIS, SSS, TIN and student identification. See also what evidence you need for a data privacy complaint.

The Procedure, Step by Step

Filing channel	Exact destination or requirement
Email	complaints@privacy.gov.ph. Use digitally signed PDF documents where practicable and follow the NPC’s electronic-filing requirements.
Personal filing	National Privacy Commission, 25th–27th Floors, The Upper Class Tower, Quezon Avenue corner Scout Reyes Street, Quezon City 1103. Rule III, Section 1(a) requires two originals plus copies for receiving parties, plainly identified. Bring a further copy for your acknowledgment and confirm current counter instructions.
Registered mail	Send the complete complaint package to the same NPC office address and keep the registry receipt and tracking proof.
Courier	Send the complete package to the same office address through an accepted courier and retain delivery confirmation.
Web portal	No general public NPC complaint-filing portal was identified in the official complaint guidance. DBNMS is for organizational breach notifications, not individual complaints.

Before sending: check the NPC’s current File a Complaint page and the current form for any changed address, email, payment or formatting instruction.

1. Write to the controller. Address the data protection officer. State what happened, what data was involved, which right was breached, and what you want done. Use a channel that produces proof of delivery.
2. Wait for the trigger: fifteen calendar days of silence, or a response that fails to take timely or appropriate action.
3. Download the current form. The NPC’s Complaint-Affidavit with Question and Answer document is the operative version as at 5 October 2026 (NPC_LEO_CID_CAF-V2.0, R0.0, 01 March 2026). Download it fresh; old copies circulate widely.
4. Complete every section. I and II identify the parties; III lists the personal information processed; IV records exhaustion of remedies; V identifies the violations alleged, with checkboxes for Sections 25, 26, 27, 28, 31 and 32 of RA 10173 plus the date, time and place; VI is the narration; VII lists the evidence; VIII states the reliefs prayed for.
5. Answer the Question-and-Answer document. It is an integral part of the complaint and walks through the elements of each offence ticked.
6. Sign the verification and the certification against forum shopping, and have the affidavit notarised.
7. Attach the annexes in order, with a copy of your identification.
8. Obtain the fee assessment. Complete the Service Request and Assessment Form (SRAF). The NPC 2025 Citizen’s Charter, Filing of Complaints Process directs submission of the SRAF, notarised complaint and supporting documents to the NPC for assessment. Pay the assessed amount through its official instructions and keep proof, or submit the required waiver documents. Under Circular 2023-01, the Php 500.00 base filing fee is supplemented by the legal research fee and any applicable damages-claim fee.
9. File it. The NPC accepts complaints personally, by registered mail, by courier, or by electronic mail as authorised by the Commission, and publishes complaints@privacy.gov.ph for that purpose. Its office address on the form is the 25th to 27th Floors, The Upper Class Tower, Quezon Avenue corner Scout Reyes Street, Quezon City 1103. Electronic documents should be digitally signed and in PDF where practicable, consistent with the Supreme Court issuance the NPC cites, A.M. No. 11-9-4-SC.
10. Keep a complete set, with proof of payment and of filing.

What Happens After You File

After you file an NPC data privacy complaint in the Philippines, CyberCode’s guide explains that an investigating officer screens the filing, the respondent may submit a verified comment, and the matter may proceed through conference, mediation or memoranda before submission for decision.

1. Initial screening: The case is raffled or assigned to an investigating officer within five calendar days of receipt.
2. Due-course review: The investigating officer has thirty calendar days to give the complaint due course or dismiss it without prejudice for defects such as insufficient form, no prior notice, lack of substantiation, an unrelated claim, or unidentified parties.
3. Respondent comment: If the complaint proceeds, the respondent files a verified comment within fifteen calendar days.
4. Preliminary conference: A conference follows no later than thirty calendar days after the comment period, addressing mediation, discovery and simplification of issues.
5. Mediation or memoranda: Agreed mediation may suspend proceedings for up to ninety calendar days. Otherwise, the parties file simultaneous memoranda within fifteen calendar days.
6. Submission for decision: The investigating officer submits a Fact-Finding Report within thirty calendar days, and the parties are notified within ten calendar days that the case is submitted for decision.

These stages come from Rules IV–VIII of the amended NPC Rules. Count each deadline from its specified trigger, especially receipt of an order; the listed periods do not guarantee a total completion time. Keep a case log with the docket number, filing and service dates, payment proof and next deadline. Check the email account used for filing, including spam, because NPC orders may be served there. If no acknowledgment or docket number arrives, follow up through the official filing contact with your original submission details rather than sending unexplained duplicate complaints.

Remedies and Realistic Outcomes

Direct answer: the NPC can do more than issue compliance orders. Its Rules permit indemnity in appropriate data-protection matters, but an administrative fine is ordinarily payable to the government—not automatically to the complainant—and a broader civil-damages case may still belong in court.

Possible outcome	Who benefits or receives it	Practical limit
Compliance, correction or cooperation order	Protects the complainant or affected data subjects	Directed at bringing processing into compliance; not compensation by itself
Temporary or permanent processing ban	Protects affected data subjects	A temporary ban has separate requirements, including bond and summary hearing rules
Administrative fine	Paid to the government	It is not a damages payment to the complainant
Indemnity	May be awarded to the complainant where legally supported	Must relate to personal-data protection and be referable to the Civil Code
Mediated settlement	Terms may directly benefit the parties	Depends on voluntary agreement and enforceable settlement terms
DOJ prosecution recommendation	Public criminal-enforcement route	The NPC recommends; the criminal case proceeds through the DOJ and courts
Separate civil damages case	Damages may be awarded by a court	Requires a proper civil cause of action, evidence and disclosure of parallel proceedings

Rule VIII, Section 6 lists what the Commission may order: an award of indemnity on matters affecting personal data protection, in an amount referable to the Civil Code; a permanent ban on processing; a recommendation to the Department of Justice for prosecution; an investigation on its own initiative; orders compelling entities and government agencies to comply; the imposition of fines; and any other order enforcing compliance. Rule IX lets a complainant move for a temporary ban during the case, subject to a bond and a summary hearing.

Rule VIII, Section 6 expressly permits indemnity determined by reference to the Civil Code for personal-data protection or data-subject rights. It does not guarantee compensation in every case. Explain the harm and amount claimed and attach supporting evidence. A separate court claim may require a different cause of action and procedure; obtain advice on jurisdiction, available relief and forum-shopping rules before pursuing parallel proceedings. See whether you can sue a company for leaking your personal information.

A decision becomes final and executory fifteen calendar days from notice, with proof of service. One motion for reconsideration is allowed and suspends that period. Appeal is to the proper courts in accordance with law and the rules.

Common Mistakes

CyberCode’s NPC complaint guide identifies avoidable filing errors that can lead to dismissal or delay, especially missing prior written notice, missing proof, incomplete annexes and an outdated Complaint-Affidavit form.

• Filing before writing to the controller: This can lead to dismissal unless the NPC grants a supported waiver.
• Having no exportable proof of written notice: An in-app chat may not provide usable proof of delivery.
• Filing with no annexes: The form warns that failure to attach evidence can result in outright dismissal.
• Naming the respondent vaguely: “The bank” is not a respondent.
• Skipping the Question-and-Answer document: It is where the elements of each offence are established.
• Omitting verification, certification against forum shopping or notarisation: Each is part of the required filing package.
• Treating the NPC as a debt-collection or money-recovery service: The NPC’s jurisdiction concerns personal information processing.
• Reusing an outdated form: Download the current Complaint-Affidavit version before filing.

Complaint Preparation Checklist

Work through this before going to the notary. Include the items relevant to your allegations and filing method; not every incident produces a breach notice, email header or transaction record. If requesting a waiver of prior notice, explain and support that request rather than invent correspondence.

Complaint-Affidavit, notice and the controller’s reply

Document to attach	Why it is needed
Completed Complaint-Affidavit, Sections I–VIII, notarised	Rule II, Sec. 3 form and verification
Completed Question-and-Answer document for each violation ticked	Integral part of the complaint; establishes the elements
Your written notice to the controller	Rule II, Sec. 2 exhaustion of remedies
Proof of delivery of that notice	Proves the fifteen-day clock started
The controller’s reply, or a statement that none came	Establishes which branch of Sec. 2 you rely on

Breach notice, screenshots, email headers and transaction records

Document to attach	Why it is needed
The breach or incident notice you received	The controller’s own account of what happened
Screenshots, full-screen and unedited, URLs visible	Shows the content complained of
Full email headers for any email relied on	Establishes origin and timing
Platform message export for any conversation relied on	Preserves structure and metadata
Transaction records, account alerts, fraud reports	Links the exposure to actual harm
A written timeline of dates and times	Required for Section V of the form

Witness affidavits, ID, authority documents and filing fee

Document to attach	Why it is needed
Affidavits of any witnesses	Rule II, Sec. 3
Copy of a valid government-issued ID	Required by the form’s instructions
SPA, board resolution, birth certificate or guardianship order, if filing for another	Rule II, Sec. 1 as amended
Signed certification against forum shopping	Rule II, Sec. 3
SRAF, proof of assessed fees paid, or supported waiver application	Rule II, Sec. 4 and the NPC Citizen’s Charter filing process

Frequently Asked Questions

Do I really have to complain to the company first?

Yes, as a general rule. Rule II, Section 2 requires you to inform the respondent in writing and give it an opportunity to act. Only a waiver granted for good cause, or a serious violation of the kind that section describes, relieves you of it.

How long must I wait after writing to the company?

The no-response period is fifteen calendar days from receipt of your written notice. Alternatively, you must substantiate that the respondent failed to take timely or appropriate action. An early reply alone does not settle that question. The NPC may waive the prior step on a properly supported ground under Rule II, Section 2.

Can I file a data privacy complaint online?

Yes, by authorised email filing. Send the complete complaint package to complaints@privacy.gov.ph, following the NPC’s rules for electronic documents, signatures, PDF format and payment. The underlying Complaint-Affidavit must still be properly signed, verified and notarised before it is scanned or electronically submitted. The NPC guidance reviewed for this update does not identify a general public web portal for individual complaints. DBNMS is a breach-notification system for organizations, not the individual complaint portal.

How much does it cost?

Php 500.00 under NPC Circular No. 2023-01, plus a legal research fee of one per cent of the filing fee but not less than Php 10.00, plus an additional fee scaled to any damages claimed. Waivers exist for government entities, indigent complainants and good cause. Notarial fees are separate.

Will the NPC award me damages?

Rule VIII, Section 6 permits qualifying indemnity for personal-data protection or data-subject rights, determined by reference to the Civil Code. An award depends on the facts, legal basis and proof; an administrative fine is not compensation to you. Seek advice on the proper forum and any parallel court claim.

What if my complaint is dismissed?

Read the order and its stated basis immediately. Initial dismissal under Rule IV, Section 1 is without prejudice, but you should check the applicable reconsideration or refiling procedure and deadlines before acting. Rule VIII provides reconsideration procedures for LEO Director resolutions and Commission decisions; the latter generally become final fifteen calendar days from notice, subject to the Rules.

Related Cybercode Guides

• My Personal Data Was Leaked: What Should I Do?
• What Evidence Do You Need for a Data Privacy Complaint?
• Your Data Privacy Rights in the Philippines
• Can You Sue a Company for Leaking Your Personal Information?
• What Should a Company Do After a Personal Data Breach?
• Data Breach Notification Rules and the NPC
• Your Right to Access Your Personal Data
• Can You Ask a Company to Delete Your Personal Data?
• The Data Privacy Act of 2012 Explained

Official Sources

• National Privacy Commission — Filing a Complaint
• National Privacy Commission — File a Complaint
• National Privacy Commission — Mechanics for Complaints
• NPC Complaint-Affidavit with Question and Answer Document (NPC_LEO_CID_CAF-V2.0, 01 March 2026)
• 2021 Rules of Procedure of the NPC, As Amended
• NPC Circular No. 2024-01 — Amendments to the 2021 Rules of Procedure
• NPC Circular No. 2023-01 — Schedule of Fees and Charges (17 May 2023)
• Republic Act No. 10173 — Data Privacy Act of 2012

Disclaimer

Important: This article provides general educational information about Philippine law, regulation, cybersecurity, technology, or business compliance. It is not legal advice and does not create an attorney-client relationship. Laws, agency procedures, technical standards, platform rules, and the facts of each situation may change the result. Verify current requirements through the cited official sources and seek qualified professional advice when your rights, deadlines, money, safety, or legal exposure may be affected.