Last materially reviewed: September 2, 2026
Direct Answer
To file a data privacy complaint with the National Privacy Commission, you generally need to first notify the Personal Information Controller, Personal Information Processor, or concerned entity in writing and give it an opportunity to act. If it does not take timely or appropriate action, or does not respond within the period recognized by the NPC Rules of Procedure, you may file a notarized complaint-assisted form or verified complaint with supporting evidence.
Primary authority: National Privacy Commission — File a Complaint and the NPC complaint mechanics.
Key Takeaways
- Complaints may be filed by affected data subjects or properly authorized representatives.
- The NPC generally expects exhaustion of remedies before giving due course to a complaint.
- Keep proof that you notified the organization in writing.
- Submit evidence, witness affidavits when relevant, and a properly executed complaint.
- The NPC accepts filing personally, by registered mail, courier, and electronic means as authorized by the Commission.
Jump to a Section
Who May File a Complaint?
Under the NPC’s 2021 Rules of Procedure, an affected data subject may file a complaint. A representative may also file if properly authorized, including through a special power of attorney where required.
What Must You Do Before Filing?
As a general rule, inform the PIC, PIP, or concerned entity in writing about the alleged privacy violation or personal data breach. This gives the organization an opportunity to investigate and provide an appropriate remedy. Keep proof of delivery and the response, if any.
The NPC may waive exhaustion requirements in serious cases where the rules allow.
Decision Snapshot
| Situation | Typical next step |
|---|---|
| Company responds and resolves the issue | Document the resolution |
| No response or inadequate action | Consider NPC complaint |
| Serious breach with urgent risk | Preserve evidence and assess whether NPC intervention is immediately appropriate |
What Documents and Evidence Should You Prepare?
- Completed and notarized complaint-assisted form or a verified complaint;
- copies of screenshots, emails, letters, URLs, breach notices, or transaction records;
- proof of your written notice to the organization;
- the organization’s response, if any;
- witness affidavits when relevant; and
- proof of identity or authority to represent the data subject where required.
See What Evidence Do You Need for a Data Privacy Complaint?
How Can You File?
The NPC states that complaints may be filed personally, by registered mail, by courier, or by electronic mail as authorized by the Commission. Electronic documents should comply with the NPC’s stated format and signing requirements.
What Happens After Filing?
The NPC’s Complaints and Investigation Division reviews complaints for due course or dismissal. The current NPC guidance states that investigating officers have 30 calendar days from receipt to give due course or dismiss without prejudice.
Common Filing Mistakes
- Filing without first notifying the organization when exhaustion is required;
- submitting accusations without dates or supporting evidence;
- failing to identify the respondent clearly;
- submitting screenshots without context, URLs, or timestamps;
- missing notarization or verification requirements.
Related Guides
Start with My Personal Data Was Leaked: What Should I Do? and review What Counts as a Data Privacy Violation?
Frequently Asked Questions
Do I need to complain to the company before filing with the NPC?
In many cases, the NPC expects the complainant to first raise the matter with the organization or its data protection officer unless there is a valid reason not to do so. Keep a copy of that request and any response.
What should I attach to an NPC complaint?
Include a clear timeline, relevant correspondence, screenshots or records, proof of prior attempts to resolve the issue where applicable, and documents that support the facts and privacy rights involved.