Online-loan privacy and collection boundaries in current NPC guidance

Debt collection does not erase privacy boundaries. The 2026 joint advisory from the DICT, National Privacy Commission, and Securities and Exchange Commission restates rules for entities offering or facilitating loans through online lending platforms, whether recorded or unrecorded.

App access must have a necessary purpose

The advisory says unnecessary permissions and unauthorized, excessive, or disproportionate processing of personal data are prohibited. A request for access should therefore be read as a specific data decision, not as a routine button that must always be accepted. Before granting access, note what category of data is requested, why the app says it is needed, and whether the purpose can be met with less access.

The NPC's earlier loan-transaction guidance also addresses the harvesting of phone and social-media contact lists. A permission screen is not a blank authorization to reuse contact information for harassment, public pressure, or unrelated collection activity.

A contact list is not a list of debtors

The joint advisory states that, for collection, persons in a borrower's contact list other than named guarantors must not be contacted. It also identifies processing that leads to harassment, public shaming, or threats as prohibited. Someone appearing in a phone book, workplace directory, or social network does not become responsible for another person's balance merely because the lender can reach them.

If a third party is contacted, preserve the message without reposting it publicly. A useful record includes the date and time, channel, sender identifier, exact wording, and why the recipient is not a guarantor. Remove unrelated personal data before sharing the record with a complaint handler.

Separate account facts from collection conduct

A balance, due date, or missed payment is an account fact that can be checked against an agreement and payment record. The way a collector communicates is a separate question. Keep both sets of evidence. This prevents a complaint about conduct from being misunderstood as a claim that no balance exists, and prevents an account dispute from obscuring a privacy concern.

Use the source that matches the concern

Start with the provider's formal complaint channel and request a case number. Privacy processing and unauthorized disclosure concerns may fall within NPC processes; conduct by lending or financing companies may also involve SEC rules. If the product is from a BSP-supervised institution, the BSP route has its own scope and sequence. Do not send a full contact list or unrelated screenshots when a smaller, redacted evidence set explains the issue.

This article summarizes public NPC and joint-agency guidance. It does not decide whether a particular communication violates the law and does not replace advice about an individual case.