Can You Sue a Company for Leaking Your Personal Information?

Last materially reviewed: September 2, 2026

Direct Answer

Potentially, yes. A company that unlawfully processes, discloses, exposes, or fails to adequately protect personal information may face regulatory, civil, administrative, or criminal consequences depending on the facts. The Data Privacy Act recognizes a data subject’s right to be indemnified for damages sustained because of inaccurate, incomplete, outdated, false, unlawfully obtained, or unauthorized use of personal information.

But a leak does not automatically guarantee a successful damages claim. You still need evidence linking the company, the violation, and the harm you suffered. The usual path is: write to the company’s Data Protection Officer, wait 15 calendar days for action, then file a verified complaint with the National Privacy Commission, which can award indemnity; a civil case for damages and a criminal complaint are also available.

Primary authority: National Privacy Commission — Data Subject Rights. Available remedies depend on the facts and legal basis of the claim.

Key Takeaways

• A personal data leak can support an NPC complaint and may also lead to a claim for damages.
• Liability depends on the facts, legal duty, breach, causation, and proof of harm.
• Preserve breach notices, screenshots, correspondence, financial-loss records, and other evidence.
• Not every breach is caused by negligence, and not every incident creates the same remedy.
• Other laws may apply if the incident also involves fraud, hacking, identity theft, or misuse of private information.

Jump to a Section

1. When a claim may arise
2. What you need to prove
3. Your options: NPC, court or criminal complaint
4. What damages may matter

When Can a Company Be Liable?

Possible liability may arise where a company processes personal data without a lawful basis, discloses data without authority, fails to use reasonable and appropriate safeguards, mishandles a breach, violates data-subject rights, or commits another prohibited act under RA 10173.

Decision Snapshot

What Evidence Do You Need?

• proof that your data was involved;
• breach notification or company correspondence;
• screenshots, URLs, logs, or unauthorized messages;
• proof of financial loss or other measurable harm;
• communications showing what the company knew and how it responded; and
• evidence connecting the incident to the claimed damage.

See What Evidence Do You Need for a Data Privacy Complaint?

Your Options and What to Do Next

You have three routes, and they can run side by side: a complaint with the National Privacy Commission (NPC), a civil case for damages in court, and a criminal complaint. For most people the NPC complaint is the practical first step, because the NPC is the specialist regulator and can itself award indemnity. Section 7(b) of the Data Privacy Act lets it “receive complaints, institute investigations … adjudicate, award indemnity on matters affecting any personal information” (RA 10173, Sec. 7(b)).

Option 1: Complaint with the NPC (start here)

1. Write to the company first. The NPC will not give a complaint due course unless you informed the company (or its Data Protection Officer) in writing of the violation or breach, and it failed to act or did not respond within 15 calendar days of receiving your letter. The NPC may waive this for good cause or for serious violations, such as where there is grave and irreparable damage that only NPC action can prevent (2021 NPC Rules of Procedure, as amended, Rule II, Sec. 2).
2. Prepare a verified complaint. It must be in writing, signed and verified, name the company (and, where they took part or were grossly negligent, its responsible officers), narrate the facts, state every relief you want (including indemnity), attach all your correspondence with the company, include witness affidavits and documents, and carry a certification against forum shopping (Rule II, Sec. 3). The NPC also accepts a notarized Complaint-Assisted Form (NPC — File a Complaint).
3. File it. A complaint may be filed at any NPC office, and the NPC accepts filing in person, by registered mail, by courier, or by email as the Commission authorizes (Rule II, Sec. 5; Rule III, Sec. 1). Filing fees apply unless you are an indigent complainant or the NPC waives them (Rule II, Sec. 4).
4. What happens next. Within 30 calendar days an investigating officer either gives the complaint due course or dismisses it without prejudice, for example if you did not give the company a chance to respond (Rule IV, Sec. 1). The NPC says the process to final adjudication typically takes about ten to twelve months (NPC).

Option 2: Civil action for damages in court

The Data Privacy Act gives you the right to “be indemnified for any damages sustained due to such inaccurate, incomplete, outdated, false, unlawfully obtained or unauthorized use of personal information” (RA 10173, Sec. 16(f)). You can pursue that right in the NPC complaint or in a separate civil case in court. A court case makes sense when your provable loss is large or when you also want relief the NPC does not give. You must prove the company’s violation, your loss, and the link between them. The NPC Rules require you to disclose any other case on the same issues through the certification against forum shopping, so tell your lawyer about an NPC complaint before filing in court. If you cannot afford a lawyer, ask the Public Attorney’s Office whether you qualify.

Option 3: Criminal complaint

Some acts are crimes under the Data Privacy Act, including providing access to personal information through negligence (Sec. 26), concealing a breach of sensitive personal information after knowing of the duty to notify the NPC (Sec. 30), and disclosing personal information to a third party without consent (Sec. 32). The penalties are imprisonment and fines, and the maximum penalty applies when at least 100 people are affected (Sec. 35). When the offender is a company, the penalty falls on the responsible officers who took part in the offense or allowed it through gross negligence (Sec. 34) (RA 10173). The NPC can recommend prosecution to the Department of Justice (Sec. 7(i)), and you can also file a criminal complaint with the prosecutor. If the leak came from a hack, scam or fraud, report that part too; see how to report an online scam.

Which route fits your situation

Documents to bring

• Your written notice to the company and every reply (or proof that 15 calendar days passed without one);
• the company’s breach notice, if you received one;
• screenshots, links and messages showing your exposed data, with dates;
• bank, e-wallet or card statements and receipts showing any loss;
• affidavits of anyone who can confirm what happened; and
• a valid ID and, if someone files for you, a special power of attorney (Rule II, Sec. 1).

See What Evidence Do You Need for a Data Privacy Complaint? and the step-by-step guide on how to file a data privacy complaint with the NPC.

Deadlines

The company has 15 calendar days to respond to your written notice before you can file with the NPC (Rule II, Sec. 2). For the crimes in the Act, the NPC applies the prescription periods for special laws under Act No. 3326 (Rule I, Sec. 6), and those periods depend on the penalty. No single filing deadline for an NPC complaint or a civil damages case was verified for this guide, so act promptly and ask a lawyer or PAO if months have passed.

What Kinds of Harm Matter?

Relevant harm can include direct financial loss, identity-fraud costs, loss associated with unauthorized transactions, reputational injury, and other legally compensable damage. The existence and amount of damages must be supported by evidence.

What Should You Do First?

First action today: secure your accounts (change passwords, call your bank or e-wallet if financial data was involved), then send the company a dated written notice addressed to its Data Protection Officer describing the leak and asking what data was exposed and what it is doing about it. Keep proof of sending, because that letter starts the 15-day period the NPC requires. For the full first-response checklist, see My Personal Data Was Leaked: What Should I Do?

Frequently Asked Questions

Can a data leak automatically result in damages?

No. Liability and available remedies depend on the facts, the legal basis of the claim, the evidence of wrongdoing, and the harm suffered. A leak does not automatically guarantee a successful damages claim.

Should I file with the NPC before going to court?

Usually, yes. The NPC is the specialist regulator, it can award indemnity, and its complaint process does not require a lawyer. Before filing with the NPC you must first notify the company in writing and give it 15 calendar days to act. A civil case for damages or a criminal complaint remains available, but disclose any related case in your certification against forum shopping.

Official Sources

• National Privacy Commission — Data Subject Rights
• National Privacy Commission — File a Complaint
• Republic Act No. 10173, Data Privacy Act of 2012 (NPC text) — Secs. 7(b), 7(i), 16(f), 26, 30, 32, 34, 35
• 2021 NPC Rules of Procedure, as amended (NPC Circular No. 2021-01 as amended by NPC Circular No. 2024-01) — Rule I, Sec. 6; Rule II, Secs. 1–5; Rule III, Sec. 1; Rule IV, Sec. 1

Sources rechecked as of: September 30, 2026

Disclaimer

Important: This article provides general educational information about Philippine law, regulation, cybersecurity, technology, or business compliance. It is not legal advice and does not create an attorney-client relationship. Laws, agency procedures, technical standards, platform rules, and the facts of each situation may change the result. Verify current requirements through the cited official sources and seek qualified professional advice when your rights, deadlines, money, safety, or legal exposure may be affected.