What the NPC Is and What They Can Do for You

Ano ang NPC at Ano ang Magagawa Nila Para Sa Iyo

The National Privacy Commission (NPC) is the Philippine government agency created by RA 10173 (Data Privacy Act of 2012) to enforce data privacy rights. They are independent, attached to the Department of Information and Communications Technology (DICT). They have the power to investigate complaints, mediate disputes, issue cease and desist orders, issue compliance orders, issue temporary or permanent ban orders against violators, impose administrative fines, and recommend criminal prosecution to the Department of Justice (DOJ). Tagal ng buong process: typically 4–6 months from filing to resolution. Walang filing fee sa NPC — libre. Ang gagastusin mo ay nasa notarization (~₱100–500 per affidavit) at sa pagpa-print/courier ng iyong evidence.

Ang National Privacy Commission (NPC) ay ang ahensya ng pamahalaan na nilikha ng RA 10173 (Data Privacy Act of 2012) para ipatupad ang data privacy rights. Independent sila, naka-attach sa Department of Information and Communications Technology (DICT). May kapangyarihan silang mag-investigate ng mga reklamo, mag-mediate ng dispute, mag-issue ng cease and desist orders, mag-issue ng compliance orders, mag-issue ng temporary o permanent ban orders laban sa mga nag-violate, magpataw ng administrative fines, at mag-recommend ng criminal prosecution sa Department of Justice (DOJ). Tagal ng buong proseso: karaniwan ay 4–6 buwan mula filing hanggang resolution. Walang filing fee sa NPC — libre. Ang gagastusin mo ay nasa notarization (~₱100–500 per affidavit) at sa pagpa-print/courier ng iyong evidence.

When You Can File an NPC Complaint

Kailan Pwede Mag-file ng NPC Complaint

An NPC complaint is the right path when your personal data — anything that can identify you — has been processed, shared, or disclosed without your consent or without a lawful basis. Common scenarios where Filipinos file:

Tama ang NPC route kapag ang iyong personal data — anumang nagpapakilala sa iyo — ay na-proseso, na-share, o na-disclose nang walang pahintulot mo o walang legal basis. Mga karaniwang sitwasyon kung saan nag-file ang mga Pilipino:

• Doxxing. Someone posted your phone number, home address, workplace, family members' names, or other identifying details on Facebook, X, TikTok, Reddit, or any public forum without your consent.
• Ex-partner / former friend posting your info. An ex shares your private photos, chats, or your ID picture in a group chat or social media post to embarrass you.
• Employer or HR leaks your records. Your salary slip, medical record, performance review, or 201 file got shared with people who had no business seeing it.
• Business leaks your data. A bank, hospital, lending app, school, or e-commerce site exposed your data through a breach, a careless employee, or by selling it to third parties without consent.
• Online lending app harassment. A lending app contacted your friends, family, or coworkers using your phone contacts list — this is one of the most-filed NPC complaint categories in the Philippines.
• Unauthorized photo / video upload. Someone posted a photo or video of you (taken privately or without your knowledge) on a public platform.
• Identity / data sold or used commercially without consent. Your data was used in ads, scraped for a database, or sold to marketers.

• Doxxing. May nag-post ng iyong phone number, address sa bahay, trabaho, pangalan ng pamilya, o iba pang identifying details sa Facebook, X, TikTok, Reddit, o public forum nang walang pahintulot mo.
• Ex-partner / dating kaibigan na nag-post ng iyong info. Nag-share ang ex mo ng private photos, chats, o ID picture mo sa group chat o social media post para hiyain ka.
• Employer o HR na nag-leak ng records mo. Ang payslip mo, medical record, performance review, o 201 file ay na-share sa mga taong walang dapat malaman dito.
• Negosyo na nag-leak ng data mo. Isang bangko, ospital, lending app, paaralan, o e-commerce site ang nag-expose ng data mo dahil sa breach, pabaya na empleyado, o sa pagbebenta nito sa third parties nang walang pahintulot.
• Harassment galing sa online lending app. Isang lending app ang nag-contact sa iyong mga kaibigan, pamilya, o katrabaho gamit ang phone contacts mo — isa ito sa pinakamadalas na-file na NPC complaint sa Pilipinas.
• Unauthorized photo / video upload. May nag-post ng litrato o video mo (kinunan nang pribado o nang hindi mo alam) sa public platform.
• Data binenta o ginamit commercially nang walang pahintulot. Ginamit ang data mo sa ads, na-scrape para sa database, o ibinenta sa marketers.

Heads up: defamatory posts (libel) and threats are separate cases filed under different laws (RA 10175 Cybercrime Prevention Act, RA 11313 Safe Spaces Act, Revised Penal Code). The NPC handles the data privacy angle only. Pwede silang mangyari nang sabay — you can file an NPC complaint AND a cybercrime case for the same incident if both apply.

Paalala: ang nakakasirang post (libel) at banta ay hiwalay na kaso na sinusubmit sa ilalim ng ibang batas (RA 10175 Cybercrime Prevention Act, RA 11313 Safe Spaces Act, Revised Penal Code). Ang NPC ay humahawak lang sa data privacy angle. Pwedeng mangyari nang sabay — pwede kang mag-file ng NPC complaint AT cybercrime case para sa parehong incident kung pareho silang applicable.

Pre-Filing: Send a Written Request First (The 15-Day Rule)

Pre-Filing: Magpadala Muna ng Written Request (Ang 15-Araw na Rule)

This is the step most people miss — and it is the #1 reason NPC complaints get dismissed outright. Under NPC Circular 16-04 (Rules of Procedure) and the 2021 Rules, you must first inform the violator in writing of the privacy violation and give them an opportunity to fix it. Only if they ignore you, refuse to act, or do not respond within 15 calendar days can you escalate to the NPC. This is called the "exhaustion of remedies" requirement.

Ito ang hakbang na madalas na-miss ng mga tao — at ito ang #1 dahilan kung bakit na-di-dismiss kaagad ang mga NPC complaints. Sa ilalim ng NPC Circular 16-04 (Rules of Procedure) at ng 2021 Rules, kailangan mo munang ipaalam sa nag-violate sa pamamagitan ng written notice ang paglabag sa privacy at bigyan sila ng pagkakataong ayusin ito. Kapag binalewala ka, tumanggi silang kumilos, o hindi sumagot sa loob ng 15 calendar days, saka mo lang pwedeng i-escalate sa NPC. Tinatawag itong "exhaustion of remedies" requirement.

What your written request should contain

Anong dapat nakalagay sa written request mo

• Your full name and current contact details
• Identification of the violator (name, page handle, company, email)
• A clear description of the privacy violation (what data, where it was posted, when you discovered it, what link or screenshot)
• A specific demand — e.g., "Take down the post within 15 calendar days," "Delete my data from your records," "Stop contacting my references"
• A reference to RA 10173 (Data Privacy Act) and your rights under it (right to object, right to erasure, right to damages)
• Notice that you will escalate to the NPC if they fail to respond or refuse to comply within 15 calendar days
• Your signature and date

• Iyong buong pangalan at kasalukuyang contact details
• Pagkakakilanlan ng nag-violate (pangalan, page handle, kumpanya, email)
• Malinaw na paglalarawan ng privacy violation (anong data, saan ito na-post, kailan mo nadiskubre, anong link o screenshot)
• Tiyak na hinihingi — hal., "Tanggalin ang post sa loob ng 15 calendar days," "Burahin ang aking data sa inyong records," "Itigil ang pag-contact sa aking mga reference"
• Reference sa RA 10173 (Data Privacy Act) at iyong mga karapatan dito (right to object, right to erasure, right to damages)
• Notice na i-e-escalate mo sa NPC kung hindi sila tumugon o tumangging sumunod sa loob ng 15 calendar days
• Iyong lagda at petsa

How to send the written request (so it counts as proof)

Paano ipadala ang written request (para may patunay ka)

• Email with read-receipt where possible. Send to the violator's official email + any DPO (Data Protection Officer) email if it is a company. Take a screenshot of the sent email with timestamp.
• Registered mail with return card via PhilPost — gives you a court-acceptable proof of delivery (₱65–150).
• Courier (LBC, J&T) with delivery confirmation — keep the tracking receipt.
• Facebook / Messenger only if you cannot reach them another way — screenshot the conversation with the timestamp visible. Less authoritative than email or mail but better than nothing.

• Email na may read-receipt kung kaya. Ipadala sa opisyal na email ng nag-violate + sa DPO (Data Protection Officer) email kung kumpanya ito. Kumuha ng screenshot ng email na may timestamp.
• Registered mail with return card sa PhilPost — nagbibigay ng court-acceptable na patunay ng pagpapadala (₱65–150).
• Courier (LBC, J&T) with delivery confirmation — itago ang tracking receipt.
• Facebook / Messenger kapag wala nang ibang paraan — kumuha ng screenshot ng usapan na may makikitang timestamp. Mas mahina ito kaysa email o mail, pero better than nothing.

Wait the full 15 calendar days from the date you can prove they received the notice. If they respond and resolve the issue (e.g., the post is taken down, your data is deleted, they stop contacting your references), you may not need to file with the NPC at all. If they ignore you, refuse, or only partially comply, you can now file.

Hintayin ang buong 15 calendar days mula sa petsa na pwede mong patunayan na natanggap nila ang notice. Kung tumugon sila at naayos ang isyu (hal., natanggal ang post, nabura ang data mo, tumigil silang mag-contact sa references mo), maaaring hindi mo na kailangan mag-file sa NPC. Kung binalewala ka, tumanggi, o partial lang ang compliance, pwede ka nang mag-file.

How to File with the NPC — Step by Step

Paano Mag-file sa NPC — Hakbang-Hakbang

1. Download the Official Complaint-Affidavit Template (July 2025 Version)

   I-download ang Opisyal na Complaint-Affidavit Template (Bersyon ng Hulyo 2025)

   As of July 1, 2025, the NPC uses a new standardized Complaint-Affidavit template with a Q&A format. The old template is no longer accepted, and using the wrong form is grounds for outright dismissal. Download the current template directly from privacy.gov.ph (look for "Complaint-Affidavit" under the Complaints Handling or Resources section). Do not copy a draft from a blog or social media — those are usually outdated.

   Simula Hulyo 1, 2025, gumagamit na ang NPC ng bagong standardized Complaint-Affidavit template na may Q&A format. Hindi na tinatanggap ang lumang template, at ang paggamit ng maling form ay dahilan para outright na ma-dismiss ang reklamo. I-download ang kasalukuyang template direkta sa privacy.gov.ph (hanapin ang "Complaint-Affidavit" sa ilalim ng Complaints Handling o Resources section). Huwag kopyahin ang draft mula sa blog o social media — luma na karaniwan iyon.

   The template has both English and Filipino versions — pick whichever you are more comfortable writing in. Verify with privacy.gov.ph that you have the latest version before submitting.

   May parehong English at Filipino na bersyon ang template — piliin ang mas komportable kang isulatin. I-verify sa privacy.gov.ph na latest na bersyon ang gamit mo bago i-submit.

2. Fill Out the Affidavit with Specific Facts

   Sagutan ang Affidavit gamit ang Tiyak na Impormasyon

   The new Q&A template will guide you through: (1) your identity and contact details, (2) the violator's identity, (3) what personal data was involved, (4) when and where the violation happened, (5) how you discovered it, (6) the harm or damage caused to you, (7) proof you sent the 15-day written notice, and (8) the relief you are asking from the NPC (cease and desist, take-down order, deletion, compliance order, damages).

   Ga-gabayan ka ng bagong Q&A template sa: (1) iyong pagkakakilanlan at contact details, (2) pagkakakilanlan ng nag-violate, (3) anong personal data ang sangkot, (4) kailan at saan nangyari ang paglabag, (5) paano mo ito nadiskubre, (6) ang pinsala o danyos na dinanas mo, (7) patunay na nagpadala ka ng 15-araw na written notice, at (8) anong relief ang hinihiling mo sa NPC (cease and desist, take-down order, deletion, compliance order, damages).

   Be specific and chronological. "On April 15, 2026 at around 8:30 PM, the respondent posted my photo, full name, and home address in a Facebook group called X with N members" is much stronger than "He posted my info on Facebook." The more concrete dates, links, and screenshots you include, the harder it is to dismiss the case.

   Maging specific at chronological. "Noong April 15, 2026 humigit-kumulang 8:30 PM, na-post ng respondent ang aking litrato, buong pangalan, at address sa Facebook group na X na may N members" ay mas matibay kaysa sa "Nag-post siya ng info ko sa Facebook." Habang mas konkreto ang mga petsa, link, at screenshots, mas mahirap i-dismiss ang kaso.

   Then have the affidavit notarized by any commissioned notary public (₱100–500 per affidavit, depending on the city). The affidavit must be sworn and under oath — this is a strict requirement.

   Pagkatapos, ipa-notaryo ang affidavit sa kahit anong commissioned notary public (₱100–500 per affidavit, depende sa lungsod). Ang affidavit ay dapat naka-sumpa at sworn — istrikto ito.

3. Gather and Attach Your Evidence

   Kolektahin at I-attach ang Iyong Ebidensya

   Attach every piece of supporting evidence as numbered annexes (Annex "A," Annex "B," etc.). At minimum:

   I-attach ang bawat piraso ng sumusuportang ebidensya bilang numbered annexes (Annex "A," Annex "B," atbp.). Sa pinakamababa:

   • Screenshots of the privacy violation (with URL bar, date, and time visible — see Evidence section below)
   • Copy of your 15-day written notice to the violator
   • Proof the violator received the notice (email timestamp, courier delivery, registered mail return card)
   • Any response from the violator (or proof of non-response — e.g., screenshot of unanswered email after 15 days)
   • Affidavits of witnesses if anyone else saw the violation or can confirm the harm caused (also notarized)
   • Any prior takedown requests sent to the platform (Facebook, X, TikTok) and their response or non-response
   • Government-issued ID copy of the complainant
   • Mga screenshot ng privacy violation (na may makikitang URL bar, petsa, at oras — tingnan ang Evidence section sa baba)
   • Kopya ng iyong 15-araw na written notice sa nag-violate
   • Patunay na natanggap ng nag-violate ang notice (email timestamp, courier delivery, registered mail return card)
   • Anumang sagot mula sa nag-violate (o patunay ng hindi pagsagot — hal., screenshot ng hindi nasagot na email pagkatapos ng 15 araw)
   • Mga affidavit ng saksi kung may iba pang nakakita sa paglabag o pwedeng magpatunay sa pinsalang dinanas (naka-notaryo din)
   • Mga naunang takedown request na ipinadala sa platform (Facebook, X, TikTok) at ang sagot o hindi pagsagot nila
   • Kopya ng government-issued ID ng nagrereklamo

4. Submit the Complaint via Email or In-Person

   I-submit ang Reklamo sa Email o In-Person

   The NPC accepts complaints in three ways:

   Tinatanggap ng NPC ang mga reklamo sa tatlong paraan:

   • Email (most common): send the notarized complaint-affidavit + all annexes as PDF attachments to complaints@privacy.gov.ph, with a copy furnished (cc) to the violator if you can reach them. Verify the current submission email at privacy.gov.ph before sending — emails do occasionally change.
   • In-person at any NPC office. Main office: 5/F Delegation Building, PICC Complex, Pasay City. Bring printed originals plus a USB or portable drive with PDF copies.
   • Portable storage device (USB) dropped off at any NPC office. Same content as the email option.
   • Email (pinakakaraniwan): ipadala ang notarized complaint-affidavit + lahat ng annexes bilang PDF attachments sa complaints@privacy.gov.ph, na may copy-furnished (cc) sa nag-violate kung mararating mo sila. I-verify ang kasalukuyang submission email sa privacy.gov.ph bago magpadala — paminsan-minsan nagbabago ito.
   • In-person sa anumang NPC office. Main office: 5/F Delegation Building, PICC Complex, Pasay City. Magdala ng printed originals kasama ang USB o portable drive na may PDF copies.
   • Portable storage device (USB) na ihahatid sa anumang NPC office. Pareho lang ng content ng email option.

   No filing fee. After submission, the NPC will issue a docket number within a few business days. Keep this number — every follow-up, email, and inquiry should reference it.

   Walang filing fee. Pagkatapos ng submission, mag-i-issue ang NPC ng docket number sa loob ng ilang business day. Itago ang numerong ito — kailangan i-reference ito sa bawat follow-up, email, at inquiry.

5. NPC Reviews, Assigns a Docket, and Schedules Mediation

   I-rereview ng NPC, Mag-a-assign ng Docket, at Mag-i-schedule ng Mediation

   Once your complaint is docketed, the NPC will first determine if it is sufficient in form and substance. If yes, they typically schedule a mediation conference between you and the respondent (in-person or via video conference). Mediation is the NPC's preferred first step — it is faster, cheaper, and often resolves the issue (e.g., the violator agrees to take down the content, delete your data, pay damages). If mediation succeeds, both parties sign a compromise agreement and the case is closed. If mediation fails or the respondent ignores the call, the case proceeds to formal investigation.

   Pagka-docket ng reklamo mo, pag-aaralan muna ng NPC kung sapat ito sa form at substance. Kung oo, karaniwan ay mag-i-schedule sila ng mediation conference sa pagitan mo at ng respondent (in-person o via video conference). Ang mediation ay ang preferred na unang hakbang ng NPC — mas mabilis, mas mura, at madalas naka-resolba ang isyu (hal., pumayag ang nag-violate na tanggalin ang content, burahin ang data mo, magbayad ng damages). Kung successful ang mediation, pipirmahan ng parehong parties ang compromise agreement at sara na ang kaso. Kung nabigo ang mediation o binalewala ng respondent ang tawag, magpa-proseso ang kaso sa formal investigation.

What Evidence to Collect (Before You Even File)

Anong Ebidensya ang Kokolektahin (Bago Pa Mag-file)

Evidence wins NPC cases. Without good evidence, even a clear violation can get dismissed. Collect everything before you contact the violator — because once they realize you might file, they often delete the posts. Pro tip: archive the page on the Wayback Machine (archive.org) or archive.ph immediately. These third-party archives produce a permanent, time-stamped URL that the NPC will accept even after the original post is deleted.

Ang ebidensya ang nananalo sa NPC cases. Kung walang magandang ebidensya, kahit malinaw na paglabag ay pwedeng ma-dismiss. Kolektahin ang lahat bago mo i-contact ang nag-violate — dahil kapag napansin nilang baka mag-file ka, madalas ay binubura nila ang posts. Payo: i-archive agad ang page sa Wayback Machine (archive.org) o archive.ph. Ang third-party archives ay nag-iiwan ng permanent, time-stamped URL na tatanggapin ng NPC kahit nabura na ang original post.

What Happens After You File

Ano ang Mangyayari Pagkatapos Mag-file

A full NPC complaint typically runs 4 to 6 months from filing to a final decision, though complex cases (multiple parties, mass breaches, foreign respondents) can take longer. Here is the typical timeline:

Ang buong NPC complaint ay karaniwang tumatagal ng 4 hanggang 6 na buwan mula filing hanggang final decision, pero ang mga kumplikadong kaso (maraming partido, mass breaches, foreign respondents) ay maaaring mas matagal pa. Narito ang karaniwang timeline:

• Week 1–2: Docketing. The NPC reviews your submission, assigns a docket number, and notifies the respondent.
• Week 3–8: Mediation phase. The NPC schedules one or more mediation conferences. If both parties reach an agreement, the case ends here with a compromise agreement.
• Week 9–20: Formal investigation. If mediation fails or is declined, an Investigating Officer takes the case. They may issue clarificatory questions, request additional evidence from both sides, and conduct fact-finding. You and the respondent submit position papers and may be required to appear at hearings.
• Week 20–26: Decision. The NPC issues a written Decision. If you win, the violator may be ordered to cease and desist, pay administrative fines, delete your data, comply with specific instructions, or be referred to the DOJ for criminal prosecution. If you lose, you can file a Motion for Reconsideration within 15 days, then appeal to the Court of Appeals.

• Linggo 1–2: Docketing. Iri-review ng NPC ang submission mo, mag-a-assign ng docket number, at ipa-papabatid sa respondent.
• Linggo 3–8: Mediation phase. Mag-i-schedule ang NPC ng isa o higit pang mediation conferences. Kung magkasundo ang dalawang partido, tatapos ang kaso dito sa pamamagitan ng compromise agreement.
• Linggo 9–20: Formal investigation. Kapag nabigo o tinanggihan ang mediation, kukunin ng Investigating Officer ang kaso. Maaari silang mag-issue ng clarificatory questions, humingi ng karagdagang ebidensya sa magkabilang panig, at magsagawa ng fact-finding. Ikaw at ang respondent ay mag-su-submit ng position papers at maaaring kailanganing dumalo sa hearings.
• Linggo 20–26: Desisyon. Mag-i-issue ang NPC ng nakasulat na Decision. Kung nanalo ka, maaaring inutusan ang nag-violate na mag-cease and desist, magbayad ng administrative fines, burahin ang data mo, sumunod sa specific na instructions, o i-refer sa DOJ para sa criminal prosecution. Kung natalo ka, pwede kang mag-file ng Motion for Reconsideration sa loob ng 15 araw, at mag-appeal sa Court of Appeals.

Throughout, follow up monthly using your docket number. Email complaints@privacy.gov.ph with the docket reference asking for status updates. Polite persistence helps move things along.

Sa buong proseso, mag-follow up buwan-buwan gamit ang docket number mo. Mag-email sa complaints@privacy.gov.ph kasama ang docket reference para humingi ng status updates. Ang magalang na pagsusumikap ay nakakatulong.

Penalties the Violator Could Face

Mga Parusa na Pwedeng Harapin ng Nag-violate

Under RA 10173, criminal penalties depend on the type and severity of the violation. The fines and imprisonment terms listed below are imposed by a court — the NPC investigates, makes a finding, and refers cases to the Department of Justice (DOJ) for prosecution. The NPC itself can also issue administrative fines and orders:

Sa ilalim ng RA 10173, ang criminal penalties ay nakadepende sa uri at bigat ng paglabag. Ang mga multa at imprisonment terms na nakalista sa baba ay ipinapataw ng korte — ang NPC ay nag-iimbestiga, gumagawa ng finding, at nag-rerefer ng mga kaso sa Department of Justice (DOJ) para sa prosecution. Ang NPC mismo ay pwedeng mag-issue ng administrative fines at orders:

• Unauthorized processing of personal information: 1–3 years imprisonment + ₱500,000–₱2,000,000 fine.
• Unauthorized processing of sensitive personal information (health, finance, government IDs, sexual life, religious/political views, etc.) — per RA 10173 §25(b): 3–6 years imprisonment + ₱500,000–₱4,000,000 fine.
• Malicious disclosure (with malice or bad faith): 1.5–5 years imprisonment + ₱500,000–₱1,000,000 fine.
• Unauthorized access or intentional breach of a data system: 1–3 years imprisonment + ₱500,000–₱2,000,000 fine.
• Administrative fines imposed by the NPC itself (for "grave" infractions under NPC Circular 2022-01): 0.5% to 3% of the violator company's annual gross income, capped at ₱5,000,000 per act or omission.
• Cease and desist orders, compliance orders, and temporary or permanent ban orders can be issued by the NPC directly — these are non-monetary but immediately enforceable.

• Unauthorized processing ng personal information: 1–3 taon bilangguan + ₱500,000–₱2,000,000 multa.
• Unauthorized processing ng sensitive personal information (kalusugan, pananalapi, government IDs, sexual life, paniniwalang panrelihiyon/pampulitika, atbp.) — per RA 10173 §25(b): 3–6 taon bilangguan + ₱500,000–₱4,000,000 multa.
• Malicious disclosure (na may malisya o masamang loob): 1.5–5 taon bilangguan + ₱500,000–₱1,000,000 multa.
• Unauthorized access o intentional breach ng data system: 1–3 taon bilangguan + ₱500,000–₱2,000,000 multa.
• Administrative fines na ipinapataw ng NPC mismo (para sa "grave" infractions sa ilalim ng NPC Circular 2022-01): 0.5% hanggang 3% ng annual gross income ng kumpanyang nag-violate, na hanggang ₱5,000,000 lang per act o omission.
• Cease and desist orders, compliance orders, at temporary o permanent ban orders ay pwedeng i-issue ng NPC nang direkta — non-monetary ito pero immediately enforceable.

If the violator is a corporation, the responsible officers and employees who participated in or allowed the violation can be personally prosecuted. Realistic expectation: most NPC complaints end in a take-down order, a compliance order, or a settlement during mediation. Criminal prosecution and jail time happen but are reserved for the worst cases (mass leaks, repeat offenders, sale of sensitive data). Hindi guarantee na makukulong agad ang nag-violate sa iyo, but the legal pressure alone is often enough to make them stop.

Kung ang nag-violate ay isang corporation, ang mga responsable na opisyal at empleyado na lumahok sa o nagpahintulot ng paglabag ay pwedeng i-prosecute personally. Realistic expectation: karamihan ng NPC complaints ay nagtatapos sa take-down order, compliance order, o settlement sa panahon ng mediation. Nangyayari ang criminal prosecution at pagkakulong pero nakareserba ito para sa pinakamasamang kaso (mass leaks, paulit-ulit na nag-violate, pagbebenta ng sensitive data). Hindi guarantee na makukulong agad ang nag-violate sa iyo, pero ang legal pressure lang ay madalas sapat na para tumigil sila.