Data Privacy Act Compliance for Lending, Financing and Fintech Companies in the Philippines

Lending, financing and fintech companies are the most closely regulated sector in the Philippines under the Data Privacy Act. They are the only industry with dedicated National Privacy Commission circulars governing how they may process personal data, and the only one where privacy enforcement has been sustained, public and coordinated across three regulators.

If you operate a lending company, a financing company, an online lending platform, or any business acting as such, NPC Circular 20-01 as amended by NPC Circular 2022-02 applies to you directly — in addition to every general obligation under RA 10173. This page sets out what those rules require in practice. For the obligations that apply to every organisation regardless of sector, see our guide to Data Privacy Act and NPC compliance requirements.

Why this sector carries the highest enforcement risk

The NPC issued Circular 20-01 in September 2020 in response to complaints that online lenders were processing borrower data without lawful basis — reaching contacts, shaming borrowers and damaging reputations. It was amended and tightened by Circular 2022-02 in December 2022. In March 2026 the Department of Information and Communications Technology, the NPC and the Securities and Exchange Commission issued a joint public advisory on online lending platforms, restating that unauthorised, excessive or disproportionate processing of personal data — particularly access to borrowers’ contact lists — is prohibited.

Three points follow. First, the rules in this sector are specific rather than principles-based, which makes non-compliance easy to demonstrate. Second, your data subjects are consumers who complain, and complaints are the NPC’s most common trigger. Third, privacy failures here also engage the SEC through unfair debt collection practices, so a single collection call can create exposure with two regulators at once.

What NPC Circular 20-01, as amended, actually requires

All entities processing personal data to grant loan facilities are personal information controllers, and carry the full controller obligations. The Guidelines then add sector-specific rules:

Area	What the Guidelines require	Where firms get caught
Borrower contact list	Unbridled processing is prohibited. Circular 2022-02 defines this as processing that is unconstrained, excessive or disproportionate to its purpose. Harvesting phone or social media contacts for debt collection, or to harass a borrower or their contacts, is prohibited outright.	Lenders holding contact lists in contravention were required to dispose of them under the transitory provisions.
Debt collection contacts	Only the borrower and declared guarantors. Contacting anyone else in the borrower’s contact list is expressly prohibited, and aligns with SEC rules on unfair debt collection practices.	This is the single most enforced provision in the sector.
Guarantors	Separate consent required. A guarantor named by the borrower must give their own consent; the borrower cannot consent on their behalf.	Character references are separately restricted — their details may not be used outside the loan purpose.
Camera and photo gallery	KYC only. Access is permitted to fulfil know-your-customer requirements and must be turned off or default to off once that purpose is achieved, with the app prompting the user that access may be revoked.	Borrower photographs may never be used to shame or pressure for collection.
App permissions generally	Suitable, necessary and not excessive. Privacy by design and by default is expressly required.	Location and storage permissions face the same proportionality test.
Registration of applications	Register every public app. Lenders must submit to the NPC a complete list of all publicly available applications they own or operate, including those used for loan processing.	Commonly missed — firms register the company and forget the apps.
Third-party providers	Your processors must register too. Personal information processors and third-party service providers operating in the Philippines engaged by lenders are themselves required to register with the NPC.	Includes outsourced collection agencies and app developers.
Credit data	Accessible to the borrower. Policies and procedures must enable borrower access to credit data consistent with the Credit Information System Act.	Sits alongside your CIC submission obligations.

The obligations most firms miss

Registering the applications, not just the company

Registration under NPC Circular 2022-04 covers your data processing systems and DPO. The loan guidelines go further and require lenders to submit a complete list of every publicly available application they own or operate. Firms that have launched, rebranded or retired apps since their original registration are almost always out of date, and this is a documentary point a compliance check will find immediately.

Consent from guarantors, separately

A borrower naming a guarantor does not give consent on that person’s behalf. The lender must obtain the guarantor’s own consent. Character references are similarly protected, and their contact details may not be used for any purpose outside the loan.

Permissions that expire

The requirement is not simply to ask for less. Where camera or gallery access was granted for KYC, the application must turn that access off or default it to off once the purpose is met, and prompt the user that access may be revoked. That is a product engineering task, not a policy one — and it is where privacy compliance meets your development backlog.

Your processors are in scope too

Outsourced collection agencies, app developers and other third-party service providers operating in the Philippines that you engage are themselves required to register with the NPC. You remain accountable as controller, which means documented outsourcing terms defining exactly what they may do with borrower data — and, in practice, monitoring whether they do it.

For fintechs that do not lend

Payments providers, e-wallets, remittance operators, insurtechs and digital banks fall outside the loan guidelines but sit squarely inside the Data Privacy Act. Three areas dominate our assessments: the volume of sensitive personal information held, which crosses the mandatory registration threshold almost immediately; cross-border transfers to cloud, analytics and fraud-detection providers, which require accountability measures and appropriate contractual clauses; and automated decision-making or profiling used in credit scoring, fraud screening and pricing, which is separately notifiable to the NPC and attracts specific transparency duties.

What a defensible programme looks like here

A lender or fintech that can withstand a compliance check has: a data inventory covering the app, core system, collections and every third party; documented lawful bases per processing activity; a privacy impact assessment for the application itself, including its permission model; app permission behaviour that matches what the circular requires, verified in the build rather than described in a policy; separate guarantor consent flows; collection scripts and systems that make contacting non-guarantors impossible rather than merely prohibited; current NPC registration covering the company, systems, DPO and every public app; registered and contractually bound processors; and a rehearsed breach response able to meet the 72-hour notification window.

Standards that turn compliance into assurance

Complying with the Data Privacy Act tells a regulator you meet the law. On its own it proves nothing to a bank, an institutional funder, an overseas partner or an enterprise client — they ask for independent assurance. Firms serving those counterparties need both, and the efficient route is to build one control base and certify against it rather than run parallel projects with duplicated evidence.

Standard	What it does for a lender or fintech	When it is worth it
ISO/IEC 27001:2022	Information security management. The control base beneath every other requirement on this page — access control, encryption, logging, supplier management, incident response — and the credential most often demanded in partner and investor due diligence.	The default first certification for any lender or fintech holding borrower or transaction data.
ISO/IEC 27701:2025	Privacy information management. Now standalone and certifiable, it maps directly onto Data Privacy Act obligations — lawful bases, data subject rights, retention, processor terms — turning NPC compliance into independently assured evidence.	When you need proof of privacy maturity, not just a registration seal.
SOC 2 (Type 1 and Type 2)	An AICPA attestation covering security, availability, confidentiality, processing integrity and privacy. Type 2 tests whether controls actually operated over a period — which is what overseas and enterprise counterparties ask for.	When banks, funders or international clients run vendor due diligence on you.
PCI DSS	Payment card data security. Applies in substance if you store, process or transmit cardholder data, directly or through a payment partner. Scoping is where most fintechs either overspend or under-comply.	Card acceptance, issuing, wallet top-up or payment facilitation.
ISO 9001:2026	Quality management. Relevant here for the operational discipline regulators look for: documented processes, complaint and grievance handling, corrective action and management review — the same machinery that keeps collections conduct consistent.	When consumer-protection expectations or service consistency are the pressure point.
ISO 22301	Business continuity. Availability of lending, payment and collection systems is itself a consumer-protection and supervisory concern, and continuity evidence increasingly appears in funding due diligence.	When downtime carries regulatory or contractual consequences.

Through Sterling Trust 360™ we run these as a single programme: one risk assessment, one control set, one evidence base, mapped across the Data Privacy Act, ISO/IEC 27001, ISO/IEC 27701, SOC 2 and PCI DSS. Controls implemented for the NPC are reused for your certification body and your client questionnaires instead of being rebuilt each time.

How Sterling delivers it

Three phases, separately priced. Design establishes your position: gap assessment against RA 10173 and the loan guidelines, data inventory across app, core system, collections and processors, a privacy impact assessment of the application and its permission model, and a prioritised roadmap. Drive implements: privacy manual and policies, borrower and guarantor notices and consent flows, retention schedule, outsourcing terms, security controls, NPC registration including your applications, breach playbook, and training for collections, product and engineering teams. Sustain maintains it through internal audits, annual renewal and the Annual Security Incident Report.

Where you have no in-house capacity, our managed DPO service provides the designated officer on retainer. Delivery is by Philippine-based consultants. We are compliance consultants and implementers, not a law firm, and we work alongside your counsel — which matters in this sector, where privacy, SEC and BSP obligations intersect.

Start with a scoping call

Tell us whether you are a lending or financing company, how many borrower records you hold, whether your applications are registered with the NPC, and whether collections is in-house or outsourced. That is usually enough to indicate scope, and we will follow with a fixed-fee proposal. Call +63 9778151204, email info@iso-certification.ph, or contact our Manila team.

Frequently asked questions

Do the loan guidelines apply to us if we are a bank, not a lending company?

NPC Circular 20-01 as amended applies to lending companies, financing companies and other persons acting as such. Banks and other BSP-supervised institutions are not the primary addressees, but they remain personal information controllers under RA 10173 with the full set of obligations — DPO, registration, PIAs, security measures and breach reporting — and BSP has its own expectations on consumer protection and information security that overlap heavily.

Are we allowed to access a borrower’s contact list at all?

Access is not banned outright, but unbridled processing is prohibited — defined as processing that is unconstrained, excessive or disproportionate to the purpose. In practice this means you must be able to justify precisely why access is needed, limit it to that purpose, and never use it for collection or to contact anyone other than the borrower and declared guarantors.

Our collections team calls people from the borrower’s phone contacts. Is that a problem?

Yes, and it is the highest-risk practice in the sector. Contacting persons in the borrower’s contact list other than those declared as guarantors is expressly prohibited, and it also engages SEC rules on unfair debt collection practices. Prior app permission does not cure it.

We use the camera for selfie verification. What do we have to change?

Camera and photo gallery access is permitted for know-your-customer purposes. Once KYC is complete, access must be turned off or default to off, and the application must prompt the user that access may be revoked. Borrower photographs may not be used for collection pressure of any kind.

Do we have to register our lending app with the NPC?

Yes. Beyond registering your data processing systems and DPO, lending and financing companies must submit a complete list of all publicly available applications they own or operate, including online applications used for loan processing. Firms that registered the company years ago and have since launched new apps are usually out of compliance without realising it.

Does our outsourced collection agency need to register?

Personal information processors and third-party service providers operating in the Philippines engaged by lenders are required to register with the NPC. It does not remove your accountability as controller — you also need documented outsourcing terms governing what they may and may not do.

What is the 2026 joint DICT-NPC-SEC advisory about?

Issued in March 2026, the joint public advisory on online lending platforms reinforces the existing rules, confirming that unauthorised, excessive or disproportionate processing of personal data — particularly access to borrowers’ contact lists — is prohibited. Its significance is the three-regulator alignment: privacy, corporate regulation and the technology department taking a common position.

We are a fintech but not a lender — payments, e-wallet or insurtech. What applies to us?

The loan guidelines will not apply, but the Data Privacy Act does in full, and you will typically hold sensitive personal information at volumes that trigger mandatory NPC registration. Expect scrutiny of your lawful bases, consent flows, retention, cross-border transfers to cloud and analytics providers, and any automated decision-making or profiling, which is separately notifiable.

Sterling International Consulting provides compliance consulting, implementation, training and assessment-readiness services. We are not a law firm and nothing on this page constitutes legal advice. Regulatory references are current as of August 2026.