The highest-enforcement area in the country. Online lending has produced more Philippine data privacy enforcement than any other sector.

Where the enforcement actually is

If you are a lending or financing company, this is the part to read first.

The contact-list prohibition is absolute. SEC MC 18-2019 bars accessing a borrower's phone contacts for collection purposes. Consent does not cure it. An app that requests contacts permission is a finding regardless of what the user agreed to, and regardless of whether the permission was ever used.

Online lending has generated more Philippine data privacy enforcement than any other sector, and the pattern is consistent: unfair collection practices, excessive permissions, and disclosure to third parties who had no business receiving the data.

What the overlay covers

• Lawful basis and consent design for loan-related processing, under NPC Circular 20-01 as amended by 2022-02
• Mobile app permission review — contacts, location, storage, camera — against what the service genuinely requires
• Debt collection practices assessed against SEC MC 18-2019
• Credit scoring and automated decision-making, which is itself an NPC registration trigger
• Outsourcing and service provider agreements meeting BSP expectations
• Financial consumer protection obligations under RA 11765
• Cross-border transfer where processing or storage sits offshore
• AMLA record retention reconciled against data minimization