Invasion of Privacy Laws Philippines: Is Invading Privacy a Crime?

Last materially reviewed: September 25, 2026

Direct Answer

Invading someone’s privacy is not one single crime in the Philippines, but many forms of it are illegal. Whether invading privacy breaks the law depends on what was done. Misusing personal data can violate the Data Privacy Act of 2012 (RA 10173). Secretly recording a private conversation can violate the Anti-Wiretapping Act (RA 4200). Hacking into an account can violate the Cybercrime Prevention Act (RA 10175). Sharing intimate images can violate the Anti-Photo and Video Voyeurism Act (RA 9995). Cyberstalking can violate the Safe Spaces Act (RA 11313). Even when no crime was committed, Article 26 of the Civil Code lets the victim sue for damages.

So the useful question is not just “Was my privacy invaded?” Ask instead: what was intruded on (your home, your conversations, your data, your body, your accounts), how was it obtained, who disclosed it, and for what purpose? Those four facts decide which law applies and which remedy is available.

Key Takeaways

Philippine law protects privacy through several statutes plus the Civil Code, not through one “invasion of privacy law.”
Criminal liability: RA 10173, RA 4200, RA 10175, RA 9995 and RA 11313 each punish a specific way of invading privacy, with imprisonment and/or fines.
Civil liability: Article 26 of the Civil Code gives a cause of action for damages, prevention and other relief for prying into a residence or meddling with private life, even if the act is not a crime.
Administrative liability: the National Privacy Commission (NPC) can investigate personal-data complaints and impose administrative sanctions on organizations.
No consent does not automatically mean a Data Privacy Act violation, since Section 12 of RA 10173 allows other lawful bases. And information being public does not make every reuse lawful.
Businesses can invade privacy without any hacking: through over-collection, secret monitoring, unauthorized disclosure, weak security or ignoring data-subject requests.
Preserve evidence before you confront anyone, and do not re-share the material yourself.

Jump to a Section

What “invasion of privacy” means
Which laws apply, and the penalties
Decision Snapshot
Examples of invading privacy
Personal data and RA 10173
Secret recordings and RA 4200
Hacking and illegal access
Intimate photos and videos
Cyberstalking and online harassment
Civil Code privacy claims
Public information, social media and doxxing
Remedies: what you can do legally
What this means for businesses
Evidence to preserve
What to do if your privacy was invaded
FAQs

What Does “Invasion of Privacy” Mean in the Philippines?

Invasion of privacy is the everyday name for an unjustified intrusion into someone’s private life, private space, private communications or personal information. Philippine statutes rarely use the phrase itself. Each law defines its own protected interest, so what counts as an invasion depends on which interest was affected.

The phrase does appear in the Safe Spaces Act. Section 12 of RA 11313 lists “invasion of victim’s privacy through cyberstalking and incessant messaging” as a form of gender-based online sexual harassment.

Key terms

Term	What it means	Where it comes from
Personal information	Information from which a person’s identity is apparent or can reasonably be determined. See what counts as personal information.	RA 10173
Sensitive personal information	A protected class of data such as health, government-issued identifiers, and records of proceedings, which carries higher penalties when misused. See personal vs sensitive personal information and examples of sensitive personal information.	RA 10173
Processing	Any operation on personal information, including collection, recording, storage, use, consolidation, erasure or destruction (Sec. 3(j)).	RA 10173
Data subject	The individual whose personal information is processed.	RA 10173
Private communication	A private conversation or spoken word that the parties did not intend to be overheard, intercepted or recorded.	RA 4200
Illegal access	“The access to the whole or any part of a computer system without right.”	RA 10175, Sec. 4(a)(1)
Privacy of communication and correspondence	A right whose obstruction by a public officer or private individual gives rise to civil damages.	Civil Code, Art. 32(11)

The five ways privacy is usually invaded

Intrusion into private space. Prying into a home, peering, spying, planting hidden cameras.
Interception of communications. Secretly recording calls or conversations, reading someone else’s messages.
Misuse of personal data. Collecting, using, selling or disclosing personal information without a lawful basis.
Exposure. Publishing private facts, intimate images or someone’s home address and contact details.
Harassment through surveillance. Cyberstalking, tracking, incessant messaging.

Which Philippine Laws Punish Invading Privacy?

Privacy in the Philippines is protected by a combination of statutes, civil-law remedies and regulatory rules. The table below maps each problem to the law most likely to apply and the penalty the statute sets.

Privacy problem	Law that may apply	Penalty in the statute
Processing personal information without consent or other legal authority	Data Privacy Act, RA 10173, Sec. 25	1–3 years and ₱500,000–₱2,000,000 (personal information); 3–6 years and ₱500,000–₱4,000,000 (sensitive personal information)
A controller, processor or its staff disclosing personal data without consent	RA 10173, Sec. 32	1–3 years and ₱500,000–₱1,000,000; 3–5 years and ₱500,000–₱2,000,000 for sensitive personal information
Secretly overhearing, intercepting or recording a private communication	Anti-Wiretapping Act, RA 4200	Imprisonment of not less than 6 months nor more than 6 years (Sec. 2)
Accessing an account, device or system without right; intercepting non-public data	Cybercrime Prevention Act, RA 10175, Sec. 4(a)	Prisión mayor, or a fine of at least ₱200,000 up to an amount commensurate with the damage, or both (Sec. 8)
Recording, copying, selling or publishing intimate images without consent	Anti-Photo and Video Voyeurism Act, RA 9995	3–7 years and ₱100,000–₱500,000, or both at the court’s discretion (Sec. 5)
Gender-based cyberstalking, unauthorized recording and sharing of a victim’s photos or information, impersonation	Safe Spaces Act, RA 11313, Secs. 12 and 14	Prisión correccional in its medium period or a fine of ₱100,000–₱500,000 (Sec. 14)
Prying into a residence, meddling with private or family life	Civil Code, Art. 26	Civil: damages, prevention and other relief
A public officer or private individual obstructing privacy of communication and correspondence	Civil Code, Art. 32(11)	Civil: damages, via an independent civil action

When a crime under the Revised Penal Code or a special law is committed through information and communications technology, Section 6 of RA 10175 raises the penalty by one degree.

Decision Snapshot

Question	Practical answer
Is invasion of privacy a crime in the Philippines?	Sometimes. It is a crime when the conduct matches a specific statute (RA 10173, 4200, 10175, 9995 or 11313). Otherwise it may still be a civil wrong.
Can I sue for invasion of privacy?	Yes, potentially. Article 26 of the Civil Code gives a cause of action for damages even where no crime was committed.
Is every use of my data without consent illegal?	No. RA 10173 allows processing on other lawful bases, such as a contract, a legal obligation or legitimate interests.
Is secretly recording a private conversation illegal?	It can be under RA 4200, depending on the facts and the method used.
Is sharing an intimate video illegal even if it was made with consent?	Yes, it can be. RA 9995 treats copying and distribution separately from the original recording.
Can a company invade my privacy without hacking?	Yes. Unlawful collection, disclosure, monitoring or weak security can all create liability.
Where do I complain?	Personal-data issues go to the NPC. Hacking, recording and harassment go to the PNP Anti-Cybercrime Group, NBI or prosecutors. Civil claims go to the courts.

Examples of Invading Privacy, and the Law That May Apply

Example	Likely legal issue
An ex-partner logs into your Facebook or email using a password they remember	Illegal access under RA 10175; possibly RA 10173 if data is then used or disclosed
Someone secretly records your phone call with a hidden recorder	RA 4200
An intimate video filmed with consent is later posted to a group chat	RA 9995, which requires separate consent for copying and distribution
A hidden camera is placed in a rented room or a changing area	RA 9995 if intimate images are captured; Civil Code Art. 26
A lender’s agent messages your phone contacts about your debt	RA 10173 (processing and disclosure without lawful basis)
A clinic employee shares your diagnosis with outsiders	RA 10173, sensitive personal information, Sec. 32
A store posts CCTV footage of a customer online to shame them	RA 10173; possibly Civil Code Art. 26. See CCTV and the law.
A person publishes your home address and phone number to incite harassment	Possibly RA 10173, RA 11313, Civil Code; see doxxing in the Philippines
Someone repeatedly messages and tracks you online with sexual or sexist remarks	RA 11313 gender-based online sexual harassment
A neighbor keeps peering into your home and spreading details of your family life	Civil Code Art. 26
A company leaks customer records because of weak security	RA 10173 security and breach duties; see data breach reporting
A friend screenshots and forwards your private chat	Context-dependent: may raise Art. 26 or RA 10173 issues; not automatically a crime

1. Unauthorized Use or Disclosure of Personal Data (RA 10173)

The Data Privacy Act of 2012 governs the processing of personal information and sensitive personal information. The National Privacy Commission is the regulator that administers and enforces it. Processing is defined broadly in Section 3(j) and covers collection, recording, storage, retrieval, use, consolidation, blocking, erasure and destruction.

RA 10173 requires processing to have a lawful basis and to follow the principles of transparency, legitimate purpose and proportionality. It also requires reasonable organizational, physical and technical security measures.

Conduct that may raise Data Privacy Act concerns includes:

collecting personal information without a lawful basis;
using data for a different, unauthorized purpose;
disclosing customer, employee, patient, student or account information without authority;
allowing unauthorized access through negligent security;
keeping identifiable data longer than justified;
posting or sharing leaked databases, screenshots or records obtained through unauthorized access; and
ignoring data-subject requests.

For the full breakdown, see what counts as a data privacy violation and Data Privacy Act penalties.

Does every use of personal data without consent violate the law?

No. Section 12 of RA 10173 lists consent as only one lawful basis for processing ordinary personal information. The others are: performing a contract, complying with a legal obligation, protecting vital interests such as life and health, responding to emergencies or carrying out public-authority functions, and legitimate interests that are not overridden by the data subject’s fundamental rights. A privacy analysis should therefore ask whether the processing had any lawful basis, not only whether consent was given.

Can a private person violate the Data Privacy Act?

Potentially, but not always. Section 25 penalizes persons who process personal information without consent or legal authority. However, Section 3(h) excludes people who process data for purely personal, family or household affairs from the definition of a personal information controller, and several penal provisions, including Section 32, apply only to controllers, processors and their officials, employees or agents. Interpersonal disputes are often better handled under the Civil Code, RA 4200, RA 9995, RA 10175 or RA 11313.

2. Secretly Recording Private Conversations (RA 4200)

Republic Act No. 4200, the Anti-Wiretapping Act (approved June 19, 1965), makes it unlawful for any person not authorized by all parties to a private communication or spoken word to tap a wire or cable, or to use any other device, “to secretly overhear, intercept, or record such communication.”

The Act also punishes knowingly possessing, replaying, communicating or furnishing transcripts of recordings obtained this way. Section 4 makes such recordings inadmissible in any judicial, quasi-judicial, legislative or administrative hearing or investigation.

RA 4200 is narrower than the everyday phrase “recording without permission.” Whether it applies depends on whether the communication was private, the device or method used, and the circumstances. See the Anti-Wiretapping Act guide and can you record someone without consent.

3. Hacking, Illegal Access and Digital Privacy (RA 10175)

The Cybercrime Prevention Act of 2012, RA 10175, punishes illegal access, defined as “the access to the whole or any part of a computer system without right.” It separately punishes illegal interception of non-public computer data, data interference, system interference and computer-related identity theft.

Conduct that may raise cybercrime concerns includes:

logging into another person’s email or social-media account without authority;
using stolen or remembered credentials to read private files or messages;
intercepting non-public transmissions without right (see illegal interception under RA 10175);
acquiring or misusing another person’s identifying information through a computer system; and
altering or deleting someone else’s data without right.

One incident can involve both RA 10175 and RA 10173. Breaking into a database may be illegal access, while later using or publishing the personal data inside can raise separate Data Privacy Act issues.

4. Intimate Photos, Videos and Voyeurism (RA 9995)

Republic Act No. 9995, the Anti-Photo and Video Voyeurism Act (approved February 15, 2010), prohibits four groups of acts under Section 4: taking photo or video of a sexual act or a person’s private area without consent in circumstances where privacy is expected; copying or reproducing such material; selling or distributing it; and publishing or broadcasting it, including through the internet and mobile phones.

Consent to the recording is not consent to sharing. RA 9995 treats copying, distribution and publication as separate acts, so a video made consensually between partners can still lead to criminal liability if one of them later shares it without the required written consent. See the RA 9995 guide.

5. Cyberstalking and Online Harassment (RA 11313)

The Safe Spaces Act, RA 11313, covers gender-based sexual harassment in streets, workplaces, schools and online. Section 12 defines gender-based online sexual harassment to include “invasion of victim’s privacy through cyberstalking and incessant messaging,” unauthorized recording and sharing of a victim’s photos, videos or information online, and impersonating victims online.

Section 13 designates the PNP Anti-Cybercrime Group to receive complaints, with the Cybercrime Investigation and Coordinating Center (CICC) also given a monitoring role. So some conduct that feels like a privacy invasion is really a harassment offense, instead of or in addition to a Data Privacy Act issue. See the Safe Spaces Act guide.

6. Civil Claims for Invasion of Privacy (Civil Code)

You can sue for invasion of privacy in the Philippines even when no crime was committed. Article 26 of the Civil Code requires every person to respect the dignity, personality, privacy and peace of mind of others, and says four kinds of acts “shall produce a cause of action for damages, prevention and other relief” even if they “may not constitute a criminal offense”:

prying into the privacy of another’s residence;
meddling with or disturbing the private life or family relations of another;
intriguing to cause another to be alienated from his friends; and
vexing or humiliating another on account of religious beliefs, lowly station in life, place of birth, physical defect or other personal condition.

Other Civil Code provisions can support a privacy claim. Article 32(11) makes any public officer or private individual who obstructs “the privacy of communication and correspondence” liable for damages. Articles 19, 20 and 21 impose liability for abuse of rights and for willful or negligent acts that cause injury contrary to law, morals or good customs. For personal-data cases, Section 16(f) of RA 10173 separately gives data subjects a right to be indemnified for damages from unlawfully obtained or unauthorized use of their personal information.

Is Public Information Free to Use? Social Media and Doxxing

No rule says information becomes unrestricted just because it is public. Viewing a public post is different from scraping, combining, profiling, republishing or monetizing it for a new purpose. Those later uses can raise Data Privacy Act questions of their own.

On May 22, 2026, the NPC advised the public to “refrain from viewing, downloading, posting, sharing, or further disseminating” files, databases, screenshots or links apparently obtained through unauthorized access. It warned that doing so may lead to civil, administrative or criminal liability.

Is doxxing illegal? There is no Philippine “Anti-Doxxing Act.” But publishing someone’s address, contact details or identity can trigger RA 10173, RA 11313, RA 10175 or Civil Code liability. The outcome depends on how the information was obtained, what was disclosed, and whether threats or harassment followed. See doxxing in the Philippines, posting personal information online without permission and posting photos without permission.

Remedies: What Can You Do If Someone Invades Your Privacy?

A single privacy invasion can support more than one remedy at the same time. These are the four main routes.

Remedy	When it fits	Where	What you can get
Privacy complaint (administrative)	An organization or person mishandled your personal data	National Privacy Commission	Investigation, compliance orders, administrative fines against organizations, recommendation for prosecution
Criminal complaint	Hacking, secret recording, voyeurism, online harassment, unauthorized processing or disclosure	PNP Anti-Cybercrime Group, NBI Cybercrime Division, or the prosecutor’s office	Prosecution; imprisonment and/or fines against the offender
Civil action for damages	Any Art. 26, 32 or 19–21 invasion, or damages under RA 10173 Sec. 16(f)	Regular courts	Actual, moral and exemplary damages; injunctions to stop the conduct
Platform takedown	Content is still online	The platform’s reporting tools	Possible removal or restriction under platform rules; timing and outcome vary. This route does not itself award compensation.

Before filing with the NPC: write to the organization first

Under the NPC’s 2021 Rules of Procedure, a complainant ordinarily has to show that they notified the organization in writing and that it failed to respond within 15 calendar days, or took no appropriate action. The NPC can waive this requirement for serious violations. Details, forms and fees are in the National Privacy Commission guide and on the NPC’s Filing a Complaint page. For criminal routes, see how to report cybercrime and the cybercrime reporting directory.

What Invasion of Privacy Laws Mean for Businesses

A company can invade privacy without being hacked. Most business exposure under Philippine privacy law comes from ordinary operations: collecting more than needed, using customer data for new purposes, monitoring employees without notice, disclosing records to third parties, or failing to secure systems.

Where businesses most often cross the line

Business activity	Privacy risk	Control that reduces the risk
Employee monitoring (email, screens, GPS)	Processing without a legitimate, proportionate purpose; lack of notice	A written monitoring policy, notice to staff, proportionality review, a PIA
CCTV	Audio recording, cameras in private areas, sharing footage	Visible notices, no cameras in restrooms or changing areas, retention limits (see CCTV law)
Collections and customer contact	Contacting third parties, disclosing debts	Scripts limited to the data subject, vendor contracts with privacy clauses
Marketing and analytics	Reusing data for a new purpose, profiling	Privacy notices, a lawful basis for each purpose, opt-outs
Staff access to records	Snooping by employees (Sec. 32 reaches employees and agents)	Role-based access, access logs, confidentiality undertakings
Security incidents	Breach of personal data	An incident-response plan; NPC notification within 72 hours where required (see data breach reporting)

Minimum practical setup for SMEs

Confirm whether and how the Act covers you: which businesses must comply with the Data Privacy Act.
Designate a Data Protection Officer and map what personal data you hold.
Publish a clear privacy notice and document a lawful basis for each purpose.
Run a privacy impact assessment before monitoring employees or launching new data uses.
Restrict and log internal access to customer and employee records.
Put privacy clauses in vendor contracts (see controller vs processor).
Prepare a breach-response plan and a data-subject request process.

For the full implementation roadmap, see how to comply with RA 10173.

Evidence to Preserve

Screenshots showing the full URL, username, date and time, plus the original links
Original files (recordings, images, documents) with their metadata intact. Do not crop, edit or re-save them.
Messages, emails and email headers showing threats, admissions or demands
Account security alerts, login notifications and recovery emails showing unauthorized access
Your written notice to the company or person, and proof of the date it was received
Platform reports, takedown requests and the platform’s responses
Names of witnesses and a written timeline of events

Use Cybercode’s electronic evidence checklist. Do not forward intimate or leaked material to others merely to prove it exists.

Copyable privacy-incident brief

Use this working note when speaking to a DPO, investigator or lawyer. It is not a formal complaint form. Describe what happened before choosing a legal label, and distinguish what you observed from what you suspect.

Date discovered / date of each act:
What happened: access, collection, recording, disclosure, or harassment:
Data, account, communication or private space affected:
Person or organization involved / identity still unknown:
How the material was obtained, if known:
Who received it / where it remains available:
Original evidence location / relevant URLs and timestamps:
Threats, continuing exposure, financial loss or other harm:
Action already taken / report or request reference:
Outcome sought: stop access, remove material, correct data,
investigate an offence, or seek compensation:
Unknown facts / questions for the receiving office:

Keep the originals securely and share only relevant material through the receiving office’s confirmed channel. Avoid circulating intimate images or leaked records merely to demonstrate the problem. A takedown request, a data-subject request and a formal complaint are different steps; record each separately.

If the NPC route fits, use its current formal-complaint instructions and downloadable form. The NPC page calls for a completed, notarized form and identifies submission options. This brief helps organize the facts; it does not replace that process.

What Should You Do If Your Privacy Was Invaded?

Address immediate danger and preserve evidence where safe. Keep available records before requesting removal, but do not delay urgent safety measures to complete a dossier.
Secure your accounts. Change passwords, enable multi-factor authentication and sign out other sessions.
Identify the type of invasion: data misuse, recording, hacking, intimate images, harassment or intrusion into private life. Use the table above.
Do not spread the material further. Re-sharing it can deepen the harm and create liability for you.
Request removal from the person, the company’s Data Protection Officer, or the platform.
Use the correct channel: the NPC for personal-data issues (after writing to the organization), the PNP Anti-Cybercrime Group or NBI for hacking, recording, voyeurism and online harassment, and the courts for civil damages. If your data was exposed in a breach, see what to do if your personal data was leaked.
Get legal advice for serious cases involving threats, stalking, intimate images, financial loss or ongoing disclosure.

Common Mistakes

“Anything private is automatically illegal to reveal.”

Not necessarily. Liability depends on the specific law and its elements.

“If it was posted publicly once, anyone can use it forever.”

No. Collection, aggregation, profiling and republication can raise separate issues.

“No consent means an automatic Data Privacy Act violation.”

No. Section 12 of RA 10173 recognizes other lawful bases.

“Only businesses can invade privacy.”

No. Individuals can be liable under RA 4200, RA 9995, RA 10175, RA 11313 and the Civil Code.

“A privacy complaint and a cybercrime complaint are the same thing.”

No. One incident can involve both, but the elements, agencies and remedies differ.

Frequently Asked Questions

What law covers invasion of privacy in the Philippines?

No single law covers every case. Depending on the conduct, the relevant laws are RA 10173 (personal data), RA 4200 (secret recording), RA 10175 (hacking), RA 9995 (intimate images), RA 11313 (online harassment) and Articles 26 and 32 of the Civil Code (civil damages).

Is invading someone’s privacy a crime in the Philippines?

It is a crime when the act falls under a penal statute, such as unauthorized processing of personal data, wiretapping, illegal access, voyeurism or gender-based online harassment. Other intrusions, like a neighbor prying into your home, are usually civil wrongs under Article 26 rather than crimes.

What is the penalty for invasion of privacy in the Philippines?

It depends on the law violated. Examples: 6 months to 6 years under RA 4200; 1–6 years and up to ₱4,000,000 under RA 10173 Sec. 25; 3–7 years and ₱100,000–₱500,000 under RA 9995. Civil cases result in damages rather than imprisonment.

Can I sue someone for invading my privacy?

Yes, potentially. Article 26 of the Civil Code gives a cause of action for damages, prevention and other relief, and Article 32(11) covers obstruction of the privacy of communication and correspondence.

Is secretly recording someone illegal in the Philippines?

It can be. RA 4200 prohibits secretly overhearing, intercepting or recording a private communication without the authorization of all parties, using a device. The facts and method matter.

Is reading someone’s messages without permission illegal?

Accessing another person’s account or device without right can be illegal access under RA 10175. Reading messages someone voluntarily showed you is different. What you then do with the content can raise separate issues.

Can someone post my address or phone number?

Not always lawfully. The answer depends on how the information was obtained, the purpose, context and whether harassment, threats or unauthorized access were involved. See doxxing.

Can my employer monitor me at work?

Monitoring is not automatically illegal. It should have a legitimate purpose, be proportionate and be disclosed to employees. Covert monitoring of private communications can raise RA 10173 and RA 4200 issues.

Can I complain to the National Privacy Commission?

Yes, if the dispute involves personal-data processing covered by RA 10173. You will ordinarily need to write to the organization first and wait 15 calendar days for a response.

How is invasion of privacy different from a data breach?

A personal data breach can involve accidental or unlawful destruction, loss or alteration, as well as unauthorized access or disclosure. It is one type of privacy problem; privacy invasion can also involve recording, spying or harassment. Not every breach requires notification to the NPC and affected individuals. The controller must assess the notification conditions, including the data involved, unauthorized acquisition and the risk of serious harm. Incidents must still be documented even when notification is not required. See NPC IRR Sections 3(k), 38 and 41 and our data breach guide.

Related Cybercode Guides

Official Sources

Republic Act No. 10173, Data Privacy Act of 2012: National Privacy Commission
Filing a Complaint: National Privacy Commission
NPC Notice to the Public on unauthorized access and dissemination of personal data (May 22, 2026)
Republic Act No. 4200, Anti-Wiretapping Act: Senate of the Philippines
Republic Act No. 10175, Cybercrime Prevention Act of 2012: Senate of the Philippines
Republic Act No. 9995, Anti-Photo and Video Voyeurism Act: Senate of the Philippines
Republic Act No. 11313, Safe Spaces Act: Senate of the Philippines
Republic Act No. 386, Civil Code of the Philippines (Articles 19–21, 26 and 32): Senate of the Philippines

Disclaimer

Important: This article provides general educational information about Philippine law, regulation, cybersecurity, technology or business compliance. It is not legal advice and does not create an attorney-client relationship. Laws, agency procedures, technical standards, platform rules and the facts of each situation may change the result. Verify current requirements through the cited official sources and seek qualified professional advice when your rights, deadlines, money, safety or legal exposure may be affected.