Is Doxxing Illegal in the Philippines? What the NPC Says

Last materially reviewed: September 3, 2026

Sources rechecked as of: September 30, 2026

Direct Answer

Doxxing can be illegal in the Philippines, although no single law is called a “doxxing law.” Posting someone’s personal information online to harass or intimidate them can be a crime under the Safe Spaces Act, a privacy violation under the Data Privacy Act, or part of a threat or cybercrime case, depending on who did it, how the information was obtained and what was said with it. In 2026, the National Privacy Commission (NPC) named doxxing, “the malicious public disclosure of personal data intended to harass or intimidate,” as a prohibited harmful use of scraped personal data by organisations.

If your home address or location has been posted together with threats, treat it as a safety issue first: call 911 or go to the nearest police station, and tell the people you live with.

Primary guidance: NPC Advisory No. 2026-01 and the NPC Notice to the Public dated May 22, 2026.

Key Takeaways

There is no single offense named “doxxing” that covers every situation.
The NPC recognizes malicious public disclosure of personal data intended to harass or intimidate as doxxing in its 2026 scraping advisory.
Data Privacy Act liability depends on the facts, including the source, processing, disclosure and lawful basis involved.
Threats, harassment, illegal access or other cybercrime offenses may also apply.
Victims should preserve the post, URL, account, timestamps and any resulting threats or harassment.
Report the content to the platform and consider NPC or law-enforcement remedies depending on the incident.

Decision Snapshot

Situation	Possible route
Personal data posted to intimidate you	Privacy complaint and/or law-enforcement assessment may be appropriate.
Data came from a hacked database	Cybercrime and privacy issues can overlap.
Post includes threats	Preserve both the data disclosure and the threatening language.
Public information was aggregated for harassment	Public availability does not automatically make every harmful use lawful.

What Does the NPC Say About Doxxing?

NPC Advisory No. 2026-01 (13 April 2026) states that Personal Information Controllers should not use scraped personal data in ways that cause harm, specifically listing “doxxing or the malicious public disclosure of personal data intended to harass or intimidate.” See Section 7(D) of the Advisory. The Advisory is addressed to organisations that scrape or host personal data. It is strong evidence of how the NPC views doxxing, but when the person who doxxed you is a private individual, the Safe Spaces Act and criminal law are often the more direct routes.

When Is Doxxing a Crime Under the Safe Spaces Act?

Section 12 of the Safe Spaces Act (RA 11313) defines gender-based online sexual harassment to include “any unauthorized recording and sharing of any of the victim’s photos, videos, or any information online,” as well as terrorizing and intimidating victims through threats, cyberstalking and incessant messaging, and impersonation. Doxxing that is sexual, sexist, misogynistic, homophobic or transphobic in nature, or aimed at someone because of their gender, can fall here.

Penalty: prision correccional in its medium period, or a fine of ₱100,000 to ₱500,000, or both (Section 14). The penalty is one degree higher if the victim is a minor, a senior citizen or a person with disability (Section 15).
Who handles it: the PNP Anti-Cybercrime Group receives these complaints (Section 13).
Stay-away order: the court may order the offender to stay away from you, your home, school or workplace even before a final decision (Section 27).
No deadline to file: offences under Section 12 are imprescriptible (Section 36(d)).

Where the posting comes with threats to harm you, the Revised Penal Code offences on threats can also apply, with a penalty one degree higher when committed through ICT under Section 6 of the Cybercrime Prevention Act (RA 10175). Whether a particular post is a crime is for the prosecutor and the court to decide on the facts.

What If the Data Came From a Leak or Unauthorized Access?

In May 2026, the NPC warned that unauthorized access, use, disclosure, sharing or further dissemination of another person’s personal data may give rise to civil, administrative or criminal liability under the Data Privacy Act and other applicable laws. The NPC also advised the public not to repost files or screenshots known or implied to have come from unauthorized access.

What Evidence Should a Victim Preserve?

full URL of the post or page;
screenshots showing the account and content;
date and time of publication;
comments, shares or messages showing harassment or threats;
the source of the disclosed data if known;
platform report confirmation; and
records of resulting harm or contact attempts.

Your Options and What to Do Next

First action: screenshot the post with the account name, date and URL visible, and copy the link into a note. Then report it to the platform. Do this before you reply, block or ask anyone to take it down.

Option	When it fits	Where to go
Platform report and takedown	Prepare a removal request; use the platform’s privacy or harassment process	The report button on the post or profile; save the confirmation
Police report for threats or safety	Your address, workplace or family details were posted with threats, or strangers are contacting or visiting you	Nearest police station or 911; the PNP Women and Children Protection Desk if the harassment is gender-based
Criminal complaint for online harassment	The posting is gender-based or sexual, or part of cyberstalking or impersonation (RA 11313 Sec. 12), or includes threats	PNP Anti-Cybercrime Group or NBI Cybercrime Division
Privacy complaint	A company, school, employer or other organisation leaked or published your data, or the data came from a breach	National Privacy Commission; see our NPC complaint guide
Civil action for damages	The poster can be identified and the harm is serious	A lawyer or the Public Attorney’s Office

What to bring to the police, NBI or NPC: a valid ID; printed screenshots with URLs and dates; the links saved in a file or on a USB drive; screenshots of any threats, calls or messages that followed; the platform’s report confirmation; and a short dated timeline. See the evidence checklist for how to capture and back up posts.

If the data came from a leak: do not download or share the leaked files yourself. The NPC has asked the public not to view, download, post or share files, screenshots or links obtained through unauthorized access (NPC Notice to the Public, 22 May 2026). Report the organisation that leaked it to the NPC instead.

If the incident also involves hacking of your accounts, see hacked: first steps, and for other offences use the cybercrime reporting guide.

Frequently Asked Questions

Is posting someone’s address always illegal?

Not automatically in every context. The legal analysis depends on the source, purpose, lawful basis, surrounding conduct and applicable laws.

Can publicly available information still be used unlawfully?

Yes. Public availability does not automatically authorize every form of collection, aggregation, profiling or harmful disclosure.

Should I ask the platform to remove the post?

Yes, but preserve evidence first where practical. A platform takedown does not replace a formal complaint when legal action is warranted.

Related Cybercrime Guides

Related Cybercode Guides

Official Sources

Disclaimer

Important: This article provides general educational information about Philippine law, regulation, cybersecurity, technology, or business compliance. It is not legal advice and does not create an attorney-client relationship. Laws, agency procedures, technical standards, platform rules, and the facts of each situation may change the result. Verify current requirements through the cited official sources and seek qualified professional advice when your rights, deadlines, money, safety, or legal exposure may be affected.

Doxxing Philippines: Is It Illegal and What Can Victims Do?