NPC Issuance Wiki

Public Advisory on Online Lending Platforms (OLPs)

Issued Advisory

Issuance Text

ADVISORY

ON ONLINE LENDING PLATFORMS

TO THE PUBLIC:

The government recently received numerous reports of online lending platforms (OLPs) engaging in harassment, intimidation, public shaming, and unlawful use of personal data in their collection practices.

Pursuant to the directive of the President to strengthen consumer protection in the digital space and uphold the dignity and safety of every Filipino, the Department of Information and Communications Technology (DICT), National Privacy Commission (NPC), and Securities and Exchange Commission (SEC) reiterate the provisions of existing issuances1 on the processing of personal data for loan-related transactions, specifically for lending companies (LCs), financing companies (FCs), and other entities offering or facilitating loans through OLPs2, whether recorded or unrecorded:

  • Unnecessary processing of personal data through mobile applications, including requiring unnecessary permissions, is prohibited.

  • Unauthorized, excessive, or disproportionate processing of personal data, particularly regarding access to borrowers’ contact lists, is prohibited. This refers to processing that is unconstrained, excessive, and disproportional to its purpose, such as, but is not limited to:

    • a. Processing that leads to harassment;
    • b. Processing for the collection of debt outside of the guarantors provided by the borrower; and
    • c. Processing that results in unfair collection practices: those which use or involve threats of violence or other criminal means to harm the physical person, reputation or property of any person, as well as those which use threats to take any action that cannot be legally taken.

  • Contacting persons on the borrower’s contact list other than those named as guarantors is prohibited. For purposes of debt collection, LCs, FCs, or persons acting as such may only contact the guarantor.

  • OLPs must have separate interfaces where data subjects can provide: (1) character references who are provided solely for identification or verification purposes; and (2) guarantors, who have expressly consented to assume the responsibility of the loan in case of default and who may be contacted in relation to loan obligations. To be considered a guarantor, one must have given consent to be a guarantor.

  • LCs, FCs, and other persons acting as such shall comply with the applicable NPC Rules on Registration of Data Processing Systems and Notifications regarding Automated Decision-Making.

  • LCs, FCs, and other persons acting as such shall retain personal data of borrowers only for as long as necessary for the fulfillment of the purposes for which the data was obtained, for the establishment, exercise, or defense of legal claims, or as provided by law. Thereafter, they shall ensure secure and proper disposal and destruction of personal data that would render further processing impossible.

  • When the purpose for an application permission has already been achieved, OLPs shall prompt the data subject to turn off, disallow, or revoke such permission.

Individuals availing of loans through OLPs are likewise reminded to be vigilant in protecting their personal data through the following actions:

  • Download OLPs from official or verified sources only and ensure that such OLPs are operated by duly registered and licensed entities.

  • Read privacy notices and consent forms carefully. Some OLPs might use deceptive design patterns or design techniques that aim to manipulate or deceive data subjects to perform a specific act relating to the processing of their personal data, such as:

    • a. pre-ticked boxes for granting permissions;
    • b. interface that makes giving consent easy but makes withdrawing consent difficult;
    • c. prominently highlighted choices that results in greater personal data processing, whereas the alternative that supports data minimization is obscured.

    The use of deceptive design patterns undermines the general data privacy principles and the rights of data subjects and may invalidate consent.

  • Review the permissions being required by OLPs: these must not request unnecessary permissions unless needed for specified and legitimate purposes, e.g., access to your camera or photo gallery is permitted only for identity verification, know-your-customer (KYC), or similar specified and legitimate purposes, and must be turned off once the purpose has been fulfilled.

  • OLPs may only access your contact list to allow you to select character references, guarantors, or to derive proportional metadata when necessary for specified and legitimate purposes. Unbridled processing of contact lists is prohibited.

  • Inform your character references before providing their details. Your chosen guarantors must give separate consent before being bound to any obligation.

  • Violations of applicable laws, IRRs, and SEC regulations may subject the erring FCs and LCs to administrative sanctions, including fines, suspension or revocation of authority to operate, and other penalties provided under relevant laws.

  • Report abusive behavior immediately to the proper authorities:

Unfair Debt Collection PracticesOther forms of Harassments/Threats/Frauds/Scams
Securities and Exchange Commission
Financing and Lending Companies Department (FINLEND)

Submit a complaint at:
imessage.sec.gov.ph
Hotline: 1-4732 (1-4SEC)		DICT Cyber Hotline
E-mail Address: 1326@dict.gov.ph

NBI Cybercrime Division
E-mail Address: ccd@nbi.gov.ph
Tel. Number: (632) 8523-8231 to 38

PNP Anti-Cybercrime Group
E-mail Address: acg@pnp.gov.ph
onlinecims.ocs@gmail.com
Tel. Number: (632) 8723 0401 (loc 7491)

Digital transformation must protect — not prey upon — the Filipino people. The National Government stands firm in enforcing the law and safeguarding the rights, privacy, and dignity of every Filipino in the digital economy.

FOR INFORMATION AND GUIDANCE.

SGD.
HENRY RHOEL R. AGUDA
Secretary
Department of Information and Communications Technology

SGD.
ATTY. JOHANN CARLOS S. BARCENA, CESO III
Privacy Commissioner
National Privacy Commission

SGD.
ATTY. ROGELIO V. QUEVEDO
Commissioner
Securities and Exchange Commission

18 March 2026

Footnotes

  1. See: Data Privacy Act of 2012 and its Implementing Rules and Regulations (IRRs), Guidelines on the Processing of Personal Data for Loan-Related Transactions [ NPC Circular 20-01 ] (14 September 2020), as amended by NPC Circular No. 2022-02, Amending Certain Provisions of NPC Circular No. 20-01 on the Guidelines on the Processing of Personal Data for Loan-Related Transactions (01 December 2022); Financial Products and Services Consumer Protection Act and the SEC IRR, Prohibition on Unfair Debt Collection Practices of Financing Companies (FC) and Lending Companies (LC) [SEC Memorandum Circular No. 18, s.2019] (19 August 2019), Disclosure Requirements on Advertisements of Financing Companies and Lending Companies and Reporting of Online Lending Platforms [SEC Memorandum Circular No. 19, s. 2918] (18 September 2019). ↩

  2. OLPs shall refer to mobile lending applications, websites, and other financial technology (FinTech)-enabled programs or systems where the services and products of FCs and LCs are made available. ↩

Backlinks