Loan apps need some of your personal data to verify who you are — but "some" has a legal limit, and quite a few borrowers in the Philippines have discovered the hard way what happens when an app oversteps it.

This guide covers what data a loan app can legally collect, what it can't, and what to do if your privacy is violated.

What Data Loan Apps Can Legally Collect

Under the Data Privacy Act of 2012 (Republic Act No. 10173), any company processing personal data — including loan apps — must have a lawful basis for doing so, and can only collect data that's genuinely necessary for the stated purpose.

For identity verification and loan assessment, this generally includes your name, valid ID details, contact number, and financial information directly relevant to determining your creditworthiness.

The National Privacy Commission (NPC) has specifically noted that excessive data collection — like harvesting an applicant's entire contact list or photo gallery — isn't actually necessary to assess creditworthiness, since lawful, reasonable alternatives exist for that purpose.

Contact List and Camera Permissions Explained

The NPC issued specific guidelines (NPC Circular No. 20-01) addressing loan-related data processing directly in response to numerous complaints against lending apps that accessed users' contact lists, cameras, location, and device storage without a clear, lawful basis.

A legitimate reason for requesting limited access might include verifying your identity through a selfie during onboarding, but this is very different from an app harvesting your entire contact list to use later for collection purposes if you fall behind on payment.

If an app requests permissions that seem unrelated to the actual loan process — like full access to your photo gallery, social media accounts, or your complete contact list without clear, specific justification — this is worth pausing on before granting access, since it may not be a lawful or necessary request under the DPA.

Your Rights Under the Data Privacy Act of 2012

As a data subject under the DPA, you have the right to be informed about how your data is collected and used, the right to object to processing that isn't necessary or lawful, and the right to access and correct your own personal information held by a company.

You also have the right to file a complaint with the NPC if you believe your data has been processed unlawfully, misused, or disclosed without your consent — including situations where a lender contacts people in your phone without proper authorization.

Companies found in violation can face administrative penalties, and in serious cases, the NPC can refer matters for criminal prosecution under the DPA's penalty provisions.

How to Report a Privacy Violation

If you believe a loan app has misused your data — accessed your contacts without proper basis, disclosed your information to third parties, or used data collection methods that go beyond what's reasonably necessary — you can file a complaint directly with the National Privacy Commission through their official process at privacy.gov.ph.

Save documentation before filing, including screenshots of the permissions the app requested, any messages sent to your contacts without authorization, and the general timeline of what happened.

If the same incident also involves threats, harassment, or abusive collection tactics, filing a related complaint with the SEC covers the debt collection angle specifically — see our guide on what to do against unfair debt collection in PH for that process.

Before you even reach the point of needing to file a complaint, checking an app's permission requests and privacy policy during the application stage — one part of confirming it's among trustworthy lending apps for 20-year-olds — can help you avoid a problematic lender in the first place.

FAQ

Can a loan app legally access my entire phone contact list?

Generally no, unless there's a specific, lawful, and clearly disclosed reason — the NPC has explicitly stated that harvesting a full contact list isn't necessary to assess creditworthiness.

What should I do if a loan app contacted people in my phone without my permission?

This is a potential Data Privacy Act violation, and you can file a formal complaint with the National Privacy Commission at privacy.gov.ph, ideally with documentation like screenshots and timestamps.

Is it normal for a loan app to ask for a selfie during application?

Yes, a selfie for identity verification is a common and generally reasonable request, which is different from broader, unrelated data access like your full photo gallery or social media accounts.

What law protects my personal data when using a loan app in the Philippines?

The Data Privacy Act of 2012 (Republic Act No. 10173) is the primary law, supplemented by NPC Circular No. 20-01, which specifically addresses data processing for loan-related transactions.

Can I ask an app why it needs a specific permission before granting it?

Yes, and a transparent, legitimate lender should be able to explain clearly why each permission is necessary — vague or evasive answers are worth treating as a red flag.