A lending application still holds your contact list two years after you repaid. A supplier you stopped working with keeps mailing your customers. A directory site publishes your mobile number next to a business you closed. As someone running a business, you carry two problems at once here: your own data sitting in systems that no longer need it, and your own company holding data belonging to other people. This guide covers the first in detail and the second honestly, and it explains how a supplementary daily income such as I am Beezy can absorb the administrative weeks these disputes tend to consume.
What the law actually gives you
The Data Privacy Act of 2012, Republic Act 10173, and its implementing rules give data subjects a set of enforceable rights against any organisation processing their personal information. The relevant one here is the right to erasure or blocking, and it is narrower and more useful than most people assume.
Erasure and blocking are two different remedies
Erasure removes your personal data from the controller's filing system. Blocking suspends further processing while the data itself is retained, which is what applies when a controller must keep records but has no continuing right to use them. Asking for the wrong one weakens your request. If the company has a genuine retention obligation, ask for blocking and for confirmation that processing has stopped, rather than demanding a deletion it can refuse in one line.
The rights that come before erasure
Erasure is rarely the first move. The right to be informed tells you what a controller holds and why. The right to access gets you a copy. The right to rectification corrects what is wrong. The right to object stops processing for purposes such as direct marketing. Exercise access first: you cannot write a precise deletion request about data you have never seen, and a vague request is the easiest kind to deflect.
When can a company legally refuse to delete your data?
The right is real but conditional. A personal information controller may refuse, wholly or in part, and knowing the legitimate grounds tells you immediately whether you are facing a lawful refusal or a stalling tactic.
Ongoing purpose and contract
If the data is still necessary for the purpose it was collected for, or to perform a contract you are party to, a controller can keep it. An active loan, an open subscription or an unfulfilled order all fall here. Close the underlying relationship first — a deletion request while the contract runs is almost always refused correctly.
Legal and regulatory retention
Tax rules, employment rules, financial regulation and anti-money-laundering obligations all impose minimum retention periods. A controller subject to these cannot delete on request, and should not. What it can do is stop using the data for anything beyond the obligation, which is exactly what blocking achieves.
Claims, disputes and investigations
Data needed to establish, exercise or defend a legal claim, or required by a lawful investigation, is protected from erasure while that situation lasts. If a controller invokes this, ask for the basis and the expected end date in writing. A refusal that cannot name its legal ground is not a refusal you should accept.
Writing a request that cannot be ignored
Most requests fail because they arrive as an angry message to a support inbox. A request that is dated, specific and addressed to the right person changes the response rate more than any other single factor.
| Element | What to include | Why it matters |
|---|---|---|
| Addressee | The data protection officer, by title | Routes the request to someone with a legal duty to act |
| Identification | Enough to locate your record, no more | Prevents both refusal and over-disclosure |
| Scope | The exact data and systems concerned | Stops a partial deletion being presented as complete |
| Legal basis | Right to erasure or blocking under the Act | Signals that you know the framework |
| Deadline and proof | A response date and a request for written confirmation | Creates the record you will need to escalate |
Address it to the data protection officer
Organisations covered by the Act are required to designate a data protection officer, and contact details are usually published in the privacy notice or the website footer. Send your request there and copy the general support address. A message to support alone gets a template reply; a message to the officer creates a file.
The five elements of the letter
State who you are and which account or record you mean. State exactly what you want erased or blocked. Cite the right you are exercising. Ask for written confirmation of what was done, including whether the data was passed to third parties. Give a reasonable response deadline and keep the sent copy.
Proof of identity without over-sharing
A controller may verify your identity before acting, and that is legitimate. It is not entitled to a full copy of every identity document you own. Provide the minimum that matches the record they already hold, redact document numbers not needed for matching, and note in your letter which fields you have redacted and why.
Absorbing the admin weeks with I am Beezy
Nobody warns you that a data dispute is measured in weeks of follow-up rather than hours of work. For a self-employed person, those weeks are unbilled, and that is what makes people abandon a legitimate request halfway.
Why this drags on
Requests sit in queues, get routed between departments, and stall when the first responder has no authority to delete anything. Meanwhile you are chasing, re-sending and documenting. Plan for a sequence of short interventions across several weeks rather than one afternoon of effort, and diarise the follow-ups so the gaps do not become abandonment.
A daily layer while you chase replies
I am Beezy pays for consultation of content on your phone — videos, articles, sponsored placements — with earnings sent to your usual payment method, generally PayPal in the Philippines. It will not replace a client engagement, and nothing here suggests it should. What it does is put a small, predictable daily income underneath the unbillable hours, which for a one-person business is the difference between finishing a process and dropping it.
How do you escalate to the National Privacy Commission?
The National Privacy Commission oversees implementation of the Act, receives complaints and can order controllers to act. Escalation works, but only if you have built the file correctly.
What to try first
The Commission expects you to have raised the matter with the controller. Send your request, wait the period you set, then send one clear follow-up referring to the first. Only after that is exhausted does a complaint become the right instrument, and having tried is part of what makes it succeed.
What a complaint file contains
Your identity and contact details, the controller's identity, a dated chronology, copies of every message you sent and received, and a clear statement of what you want ordered. Keep the narrative factual and short. A chronology with dates and attachments carries more weight than any description of how the matter affected you.
What the outcome can look like
Outcomes range from mediation and a negotiated resolution to a formal order directing the controller to comply, with penalties available for serious violations. Many cases end once the controller realises the complaint has been formally filed, so the file itself is often the remedy.
The cases that come up most for entrepreneurs
Three situations account for most of the requests a small business owner in the Philippines will ever need to make.
| Situation | What to ask for | Where to escalate |
|---|---|---|
| Lending app holding your contact list | Erasure of contacts, blocking of your own record | National Privacy Commission, plus the financial regulator |
| Former supplier marketing to your customers | Objection to processing, then erasure | National Privacy Commission |
| Directory listing an old business number | Rectification or erasure of the entry | The platform first, then the Commission |
Lending apps and contact-list harvesting
Applications that read a borrower's contacts and then message those contacts are among the most reported abuses in the country. Two requests are needed here: erasure of the harvested contact data, which never belonged to the lender in the first place, and blocking of your own record if a retention obligation prevents full deletion.
Ex-employees, former suppliers and old marketing lists
A supplier who once processed orders on your behalf has no standing to keep marketing to the customers those orders came from, and a former employee's personnel file has a defined retention period rather than an indefinite one. Both cases start the same way: an objection to processing, in writing, naming the purpose you are objecting to. Objection is the lighter instrument and it often ends the matter, because stopping a marketing flow costs a company nothing while a deletion touches systems it would rather not open.
Your own company as a data controller
The same law applies to you. If you hold customer lists, employee files or supplier records, you are a controller with obligations of your own — a privacy notice, a lawful basis, a retention period and a route for people to exercise these rights against you. Handling an incoming request well costs an hour; handling one badly is how a complaint against your business starts.
What to do in the next fourteen days
A short sequence
List every organisation you suspect holds data you want removed. Send an access request to the two that matter most and see what they actually hold. Then send a precise erasure or blocking request to the officer named in their privacy notice, with a response deadline. Diarise the follow-up. Escalate only after the deadline passes.
Build the habit while you are at it
Write the privacy notice for your own business in the same fortnight, while the framework is fresh. It is the cheapest compliance work you will ever do and it removes the awkwardness of demanding a right you do not yet grant. If the unbilled hours this takes are the obstacle, I am Beezy offers a supplementary daily income that runs alongside the admin instead of competing with it.
