How to Ask a Philippine Company to Delete Your Personal Data (Letter Template)

Last materially reviewed: September 6, 2026

Direct Answer

Sometimes. Section 16(e) of Republic Act No. 10173 lets a data subject order the suspension, withdrawal, blocking, removal or destruction of personal data, but only on specific grounds and on substantial proof. It is not an unconditional “delete me” right. A Philippine company may lawfully refuse where it still needs the data for a legal obligation, a legal claim or another recognised basis.

Key Takeaways

• The right lives in Section 16(e) of RA 10173 and is expanded in Rule VIII, Section 34(e) of the Implementing Rules and Regulations (IRR). It is broader than deletion: it covers suspension, withdrawal, blocking, removal and destruction.
• You need a ground. Section 16(e) applies on discovery and substantial proof that the data is incomplete, outdated, false, unlawfully obtained, used for an unauthorised purpose, or no longer necessary for the purpose it was collected for.
• The IRR adds further grounds, including withdrawn consent with no other legal basis, unlawful processing, and violation by the controller of your rights as a data subject.
• Refusal is often lawful. NPC guidance recognises retention for legal obligations, the establishment or defence of legal claims, legitimate business purposes and overriding public interest.
• RA 10173 and the IRR prescribe no response deadline we could verify. NPC Advisory No. 2021-01, Section 5(E) sets thirty (30) working days from receipt, extendable by up to fifteen (15) further working days for complex or numerous requests.
• Before complaining to the NPC, Rule II, Section 2 of NPC Circular 2021-01 requires that you informed the controller in writing and waited fifteen (15) calendar days.
• Lending apps that harvested your phone contacts are a special case: NPC Circular 20-01 prohibits the practice outright and required disposal of contact lists already held.

Jump to a Section

• Decision snapshot
• Governing law and authorities
• What the right entitles you to, ground by ground
• Exceptions, limits and lawful refusals
• Philippine scenarios (hypothetical)
• Evidence and documentation
• Step-by-step procedure
• Remedies and realistic outcomes
• Common mistakes
• The erasure and blocking demand template
• Frequently asked questions
• Related Cybercode guides
• Official sources
• Disclaimer

Decision Snapshot

Your situation	Does the right apply?	What defeats it	Next step
A lending app copied your phone contact list	Strong case — unlawfully obtained and used for an unauthorised purpose	Little; NPC Circular 20-01 prohibits the practice	Demand destruction and cite Circular 20-01, Sections 3(D)(4) and 8
You closed an account years ago and the file is still active	Likely — data no longer necessary for the purpose collected	A statutory or regulatory retention period the company can name	Ask for the retention basis before demanding destruction
You withdrew consent to marketing	Yes, where consent was the only legal basis (IRR Section 34(e))	Another lawful basis for continued processing	Withdraw consent in writing, then demand blocking
You are in a live dispute or case with the company	Weak while the dispute runs	Retention for the establishment or defence of legal claims	Consider blocking rather than destruction
Your details appear on a public shaming post or index	Yes, in qualifying cases	Freedom of speech, of expression or of the press, where justified	Demand removal and ask the controller to notify third-party indexes
You do not know what they hold yet	Use access first	—	See Right to Access Personal Data in the Philippines

Governing Law and Authorities

The core provision is Section 16(e) of RA 10173, the Data Privacy Act of 2012. It gives the data subject the right to suspend, withdraw or order the blocking, removal or destruction of personal information from the controller’s filing system, upon discovery and substantial proof that the personal information is incomplete, outdated, false, unlawfully obtained, used for unauthorised purposes, or no longer necessary for the purposes for which it was collected.

Rule VIII, Section 34(e) of the IRR restates and extends this, adding grounds that are not spelled out in the same way in the statute itself: withdrawal of consent where there is no other legal ground for processing; private information that is prejudicial to the data subject, unless justified by freedom of speech, of expression or of the press; unlawful processing; and violation by the controller or processor of the rights of the data subject.

Operational detail comes from NPC Advisory No. 2021-01 on Data Subject Rights, which addresses the right to erasure or blocking, the response period, identity verification, and the circumstances in which a controller may properly decline. It is a regulator’s guidance issuance rather than a provision of the statute; where it fixes a number of days, that number does not appear in RA 10173 or the IRR.

The NPC’s own right-to-erasure page also states that the controller shall communicate with other personal information controllers, including third-party indexes, and request them to erase copies or remove or de-list search results or links to your pertinent personal data. That is the provision to quote when the problem is a copy sitting somewhere else.

Escalation runs under NPC Circular 2021-01, the 2021 Rules of Procedure, as amended by NPC Circular 2024-01. Rule XII, Section 6 of the 2021 Rules repealed the earlier NPC Circular 16-04, so guides still citing 16-04 for complaint procedure are stale.

For lending, the sector-specific rule is NPC Circular 20-01 on the processing of personal data for loan-related transactions, amended by NPC Circular 2022-02.

What the Right Entitles You To, Ground by Ground

Erasure requests fail more often on the ground than on the drafting. Pick the ground that actually fits your facts and say which one you are relying on.

Incomplete, outdated or false data

Where the record is wrong, correction under Section 16(d) is often the better first move; blocking is the fallback while the dispute is unresolved.

Unlawfully obtained data

Data collected without a valid basis, or scraped, or taken from a device beyond what the user agreed to. This is the strongest ground and the one that applies to harvested contact lists.

Used for an unauthorised purpose

Data given for one purpose and repurposed for another — a loan application file used for marketing, or contact details used to shame a borrower.

No longer necessary for the purpose collected

The workhorse ground for dormant and closed accounts. Expect the controller to answer with a retention period; ask it to identify the source of that period.

Withdrawn consent with no other legal ground

Under the IRR, this ground only bites where consent was genuinely the sole basis. If the company can point to contract, legal obligation or another lawful criterion, withdrawal alone does not compel erasure.

Private information prejudicial to the data subject

The IRR qualifies this ground: it yields where processing is justified by freedom of speech, of expression or of the press. Reporting and commentary are not automatically erasable.

Unlawful processing, or violation of your rights

Where the processing itself breaches the Act, or where the controller has already ignored your access or correction rights, the IRR treats that as a ground in its own right.

What you can actually ask for

Note the five verbs in Section 16(e): suspension, withdrawal, blocking, removal, destruction. Blocking — freezing the data so it can no longer be used, without deleting it — is frequently the realistic outcome where the company has a retention obligation. Asking for blocking in the alternative makes your letter harder to refuse outright.

Exceptions, Limits and Lawful Refusals

This right has more built-in limits than any other in Section 16. Be honest with yourself about them before you send anything.

Retention the company can justify

NPC guidance on the right to erasure or blocking recognises that a controller may decline where the personal data remains necessary for compliance with a legal obligation, for the establishment, exercise or defence of legal claims, for legitimate business purposes, or for reasons of public interest. Banks, insurers, employers and regulated lenders routinely have record-keeping duties under other laws. The Data Privacy Act does not override them.

Statutory non-applicability under Section 19

Section 19 of RA 10173, mirrored in Rule VIII, Section 37 of the IRR, disapplies the access, correction and blocking rights where the data is used only for the needs of scientific and statistical research, no activities are carried out and no decisions are taken regarding the data subject, and confidentiality is maintained. Section 19 also disapplies those rights to personal information gathered for the purpose of investigations in relation to any criminal, administrative or tax liability. If you are the subject of an ongoing investigation, an erasure demand will not clear the file.

Processing outside the Act’s scope under Section 4

Section 4 lists categories the Act does not apply to, including information about a government officer or employee relating to the position or functions held; information about a person performing services under contract for a government institution; information relating to discretionary government benefits such as licences and permits; personal information processed for journalistic, artistic, literary or research purposes; information necessary for a public authority to carry out constitutionally or statutorily mandated functions; information necessary for banks and financial institutions to comply with anti-money-laundering obligations; and personal information originally collected from residents of foreign jurisdictions under their laws.

There may be no “personal information controller” to demand anything from

Section 3(h) defines the personal information controller and excludes both a person or organisation performing functions as instructed by another, and an individual who collects, holds, processes or uses personal information in connection with the individual’s personal, family or household affairs. This exclusion sits in the Section 3(h) definition, not in the Section 4 scope list — a distinction commonly got wrong. A demand aimed at a private individual’s personal records often has no controller to answer it.

Identity and proof

NPC Advisory No. 2021-01, Section 5(B) requires controllers to use reasonable measures to verify the identity of the requesting data subject and permits requests for supporting documents. Section 16(e) itself speaks of substantial proof. An unevidenced assertion that data is “no longer necessary” is easy to refuse.

Copies elsewhere

Even a successful demand against one controller does not automatically clear mirrors, caches, screenshots and re-posts. The NPC’s stated position is that the controller should communicate with other controllers and third-party indexes; that is a request the controller makes, not a guaranteed result.

Philippine Scenarios (Hypothetical)

The following are hypothetical illustrations, not decided cases.

Scenario 1: the loan app that copied a contact list

A borrower in Davao installs a lending app that requests contacts permission at install. After a missed payment, her cousins and workmates receive messages calling her a delinquent. She writes to the lender’s DPO demanding destruction of the harvested contacts, relying on Section 16(e) — unlawfully obtained and used for an unauthorised purpose — and on NPC Circular 20-01, Section 3(D)(4), which prohibits access to contact details in whatever form, including phone contact lists, e-mail lists and harvested social media contacts, for use in debt collection or to harass the borrower or the borrower’s contacts. She also cites Section 8 of the same circular, which required entities already holding borrower contact lists in contravention of Section 3(D)(4) to dispose of them securely on the circular’s effectivity, and Section 3(E), which bars using personal data for unfair collection practices as defined under SEC Memorandum Circular No. 18, series of 2019. This is the strongest erasure posture available under Philippine law, and the NPC has an established enforcement record in this sector.

Scenario 2: the dormant e-commerce account

A Manila shopper has not used a marketplace since 2019 but still gets targeted promotions. He demands deletion on the ground that the data is no longer necessary. The company replies that it retains transaction records for tax and warranty purposes but agrees to suppress marketing use. Partial compliance — blocking rather than destruction — is a plausible and lawful outcome.

Scenario 3: the ex-employee and the pending case

A former employee with a pending labour case demands destruction of her personnel file. The employer refuses, citing the establishment and defence of legal claims. That refusal is likely lawful while the case is live. Reserving the demand until the case ends is the better strategy.

Evidence and Documentation

Because Section 16(e) requires substantial proof, an erasure file needs more than a delivery receipt.

• Proof of identity. A copy of the government ID you sent, with unnecessary details redacted, plus the account or reference number used.
• Proof of the ground. Screenshots of the harassing messages, the app permission screen, the closure confirmation for the account, the consent-withdrawal email, or the document showing the record is false or outdated. Capture the full screen with visible date and sender.
• Proof you made the request. The dated, signed letter, and the sent email in full.
• Proof of delivery. Courier waybill, registered mail receipt, or email delivery confirmation. The fifteen-day period in Rule II, Section 2 of NPC Circular 2021-01 runs from the controller’s receipt.
• The controller’s reply. Especially any refusal. A refusal that names no legal basis is itself useful evidence.
• A dated log. One line per event, with the document that proves each one.

Our detailed treatment is at Evidence for a Data Privacy Complaint in the Philippines.

Step-by-Step Procedure

1. Find out what they hold first, where you can. An access request under Section 16(c) turns a guess into a specific demand. See Right to Access Personal Data in the Philippines.
2. Identify the controller. Name the legal entity behind the app or brand. For lending apps, check the SEC registration name and the entity named in the loan agreement.
3. Find the Data Protection Officer. Take the contact from the published privacy notice; otherwise address “The Data Protection Officer” at the registered office.
4. Choose and state your ground. One or two, clearly named, each supported by an attachment.
5. Ask for blocking in the alternative. Where retention may be justified, request that processing be suspended and the data blocked pending resolution.
6. Send it so delivery is provable. Email to the DPO, plus courier or registered mail to the registered office where the matter is serious.
7. Diarise the deadline. NPC Advisory No. 2021-01, Section 5(E): thirty (30) working days from receipt of the request and any necessary supporting documents, extendable by up to fifteen (15) further working days for complex or numerous requests, with written notice.
8. Follow up once in writing, referencing the original date and delivery proof.
9. Escalate to the NPC. Once you informed the controller in writing and fifteen (15) calendar days have passed from its receipt without timely or appropriate action, Rule II, Section 2 of NPC Circular 2021-01 is satisfied; the NPC may waive the requirement for good cause or where a serious violation is alleged. The Filing formal complaints page provides the complaint-affidavit form, which must be completed and notarised, then filed in person, by courier or by scanned email. Fees are set by NPC Circular 2023-01. Under Rule IV, Section 1 as amended by NPC Circular 2024-01, a complaint may be dismissed outright where the complainant gave the respondent no opportunity to address it without justification.

Full walkthrough: How to File a Data Privacy Complaint With the NPC.

Remedies and Realistic Outcomes

The most common good outcome is partial: marketing suppressed, a contact list destroyed, a public post taken down, a record blocked rather than erased. Total destruction of everything a regulated company holds about you is rare and often unlawful for the company to do.

Where the controller ignores you, the NPC route is administrative. The Commission investigates, may mediate, and may issue orders; it maintains a framework for administrative fines under NPC Circular 2022-01. It has a substantial enforcement history in the online lending sector: in publishing NPC Circular 20-01 on 19 October 2020, the Commission stated that lenders in possession of borrowers’ contact lists must dispose of them securely, and its own account of that period notes that complaints fell sharply after it ordered the shutdown of 26 online lending companies in 2019. Those are agency actions, not private remedies — the NPC acting on a complaint does not put money in your pocket.

Section 16(f) gives the data subject a right to be indemnified for damages sustained due to inaccurate, incomplete, outdated, false, unlawfully obtained or unauthorised use of personal information. Realistically, recovering money on that basis means a civil action with proof of actual damage. RA 10173 also creates criminal offences, prosecuted by the State rather than by the data subject.

Expect months. Expect a reasoned refusal to be a legitimate answer in some cases. If the underlying problem is a breach or exposure rather than retention, see What to Do If Your Personal Data Is Leaked in the Philippines and Can You Sue a Company for a Personal Data Leak?

Common Mistakes

• Treating it as an unconditional right to be forgotten. Philippine law requires a ground and substantial proof.
• Naming no ground. “Please delete my data” invites a one-line refusal.
• Demanding destruction when blocking would succeed. Where a retention duty exists, asking only for destruction guarantees a refusal.
• Withdrawing consent that was never the legal basis. Check whether the processing rests on contract or legal obligation instead.
• Using a foreign GDPR template. Citing EU articles to a Philippine controller invites dismissal. Cite RA 10173 and the IRR.
• Deleting your own evidence. Do not wipe the harassing messages or uninstall the app before capturing proof.
• Going to the NPC first. Skipping written notice to the controller risks dismissal under the exhaustion rule.
• Forgetting the copies. Ask the controller to notify other controllers and third-party indexes, as the NPC’s guidance contemplates.

The Erasure and Blocking Demand Template

This is a template to adapt, not a finished legal document. Replace every bracketed field, delete the paragraphs that do not apply to your facts, and confirm the controller’s DPO details before sending. The annotations that follow explain each element.

Annotations

• Why the subject line cites Section 16(e). It marks the letter as a statutory demand rather than a customer request, and routes it to the DPO.
• Why paragraph 1 is specific. A controller cannot act on “everything.” Naming the dataset and the date makes compliance measurable and refusal harder.
• Why paragraph 2 names the ground. Section 16(e) is conditional. The ground is the legal hook; without it there is nothing to grant.
• Why paragraph 3 attaches proof. Section 16(e) speaks of discovery and substantial proof. Attachments convert an assertion into a supported demand.
• Why the lending paragraph is separated. Delete it entirely if no loan app is involved; a misapplied circular weakens the whole letter.
• Why paragraph 4 offers blocking in the alternative. It removes the company’s easiest exit — refusing outright because it must keep records — and forces it to name its retention basis.
• Why paragraph 5 addresses copies. It tracks the NPC’s stated expectation that the controller will approach other controllers and third-party indexes.
• Why you demand a reasoned refusal. It creates a document you can put before the NPC, and it starts the clock cleanly under Rule II, Section 2 of NPC Circular 2021-01.

Frequently Asked Questions

Is there a right to be forgotten in the Philippines?

Not as an unconditional right. Section 16(e) of RA 10173 provides a conditional right to suspension, withdrawal, blocking, removal or destruction on defined grounds and on substantial proof. It is narrower than the phrase suggests.

How long does the company have to respond?

RA 10173 and its Implementing Rules prescribe no number of days that we could verify. NPC Advisory No. 2021-01, Section 5(E) sets thirty (30) working days from receipt of the request and any necessary supporting documents, extendable by up to fifteen (15) further working days for complex or numerous requests. That figure comes from an NPC advisory rather than from the statute.

Can a lending app keep my contacts if I still owe money?

NPC Circular 20-01, Section 3(D)(4) prohibits access to and saving of borrowers’ contact lists and harvested social media contacts for debt collection or harassment, and Section 8 required disposal of lists already held. An outstanding balance is not a defence to that prohibition. Collection of the debt itself is a separate matter governed by other rules.

Do I have to write to the company before going to the NPC?

Yes, as a general rule. Rule II, Section 2 of NPC Circular 2021-01 requires that you informed the controller in writing and that fifteen (15) calendar days passed from its receipt without timely or appropriate action or response. The NPC may waive this for good cause or where a serious violation is alleged.

What if I do not know what data they hold?

Send an access request first under Section 16(c). Access tells you what exists, where it came from and who received it; erasure then targets something specific.

Related Cybercode Guides

• Right to Access Personal Data in the Philippines — get the copy first, with its own DSAR letter template.
• Data Privacy Rights in the Philippines — the hub covering all Section 16 rights.
• The Data Privacy Act of the Philippines Explained.
• Right to Correct Personal Data Under the Data Privacy Act — often the better remedy for inaccurate records.
• How to File a Data Privacy Complaint With the NPC.
• Evidence for a Data Privacy Complaint in the Philippines.
• What to Do If Your Personal Data Is Leaked in the Philippines.
• Can You Sue a Company for a Personal Data Leak?

Official Sources

• Republic Act No. 10173, Data Privacy Act of 2012 — full text (LawPhil)
• Implementing Rules and Regulations of RA 10173 — National Privacy Commission
• National Privacy Commission — Right to Erasure or Blocking
• National Privacy Commission — Data Subject Rights
• NPC Circular No. 20-01 — Processing of Personal Data for Loan-Related Transactions
• NPC — Online lenders barred from harvesting borrowers’ phone and social-media contact list (19 October 2020)
• NPC Advisories and Circulars, including NPC Advisory No. 2021-01 and NPC Circular 2021-01
• National Privacy Commission — Filing formal complaints

Disclaimer

Important: This article provides general educational information about Philippine law, regulation, cybersecurity, technology, or business compliance. It is not legal advice and does not create an attorney-client relationship. Laws, agency procedures, technical standards, platform rules, and the facts of each situation may change the result. Verify current requirements through the cited official sources and seek qualified professional advice when your rights, deadlines, money, safety, or legal exposure may be affected.