This article shares practical record-keeping habits for Philippine money lenders, lending companies, and small MFIs for educational purposes. It is not legal advice. Confirm your consent wording, retention periods, collection scripts, and breach procedures with your data protection officer (DPO) or counsel before you change forms or workflows. The borrower names and peso amounts below are illustrative only.
If a borrower, a guarantor, or the National Privacy Commission asked you today, “Show me where this person agreed to let you collect and use their data, and for what,” could your branch answer in five minutes? For many small lenders the honest answer is no. The consent form exists somewhere: stapled in a folder, photographed on an officer’s phone, or ticked on an old paper template that no longer matches what the desk actually does with the data. A borrower consent log fixes that by turning every consent into one findable row: who agreed, to which purposes, on which form version, when, and where the proof lives.
This guide is for Philippine lending desks that onboard borrowers in branches and in the field. You get the seven columns a workable consent log needs, a role-by-role contact matrix for borrowers, guarantors, and character references, a worked example of where consent breaks in a real loan cycle, a 15-minute weekly audit, the traps that make a log look complete when it isn’t, and a simple framework for what to fix first.
Why consent proof matters for a small lender
The Data Privacy Act of 2012 (Republic Act No. 10173) defines consent as a “freely given, specific, informed indication of will,” and says it must be evidenced by written, electronic, or recorded means. The same law asks you to process personal data under the principles of transparency, legitimate purpose, and proportionality, and to keep it only as long as necessary for the purpose it was collected for, or for legal claims and other legitimate business purposes.
Consent is not the only lawful basis for processing; a loan contract itself supports much of what a lender does. But in practice small lenders lean on consent forms for the extras: texting reminders, sharing data with a collection partner, sending offers for a second loan. Those extras are exactly where complaints start. If you can’t show that the borrower agreed to that specific use, you are arguing from memory.
Lending also has its own rulebook on top of the Act. The Commission’s NPC Circular No. 20-01 sets guidelines for processing personal data in loan-related transactions, and NPC Circular No. 2022-02 amended it. Among other things, the amended circular says consent should be obtained at the point where the data is actually needed, with a short just-in-time notice explaining how that piece of information will be used. It also requires reasonable retention policies for applicants who were denied and borrowers who have fully paid, and says personal data should not be kept forever on the chance it might be useful someday.
Lending files also carry high-risk data: government IDs, payslips, bank details, home photos, sometimes health reasons for a restructure. Under NPC Circular 16-03 on personal data breach management, a reportable breach must be notified to the Commission, and to affected people, within 72 hours of knowing or reasonably believing it happened. A clean log tells you, within minutes, whose data sat in a compromised folder or on a lost phone, and what each person agreed to. That is the difference between a calm notification and a weekend of guessing.
Borrowers, guarantors, and character references are not the same
The single most common consent mistake at small lending desks is treating everyone named on the application the same way. The amended circular draws clear lines between them, and your log should too. Use this matrix as the reference card for officers and collectors.
| Person | What you may use their contact for | What their row in the log must show | Desk rule |
|---|---|---|---|
| Borrower | Evaluation, servicing, reminders, and collection of their own loan, plus extras they agreed to | Each purpose ticked separately, form version, proof location | Fresh row at every renewal or material change |
| Guarantor | Collection, if the borrower defaults; the guarantor is the only person besides the borrower the desk may contact to collect | Their own separate consent and signed guaranty, not the borrower’s form | No separate consent on file means not a guarantor for collection purposes |
| Character reference | Only verifying the borrower’s identity and the truth of what the borrower declared | Date they were informed they were named, and any request to be removed | Never call a reference to collect, market, or cross-sell |
Two lines from the circular are worth printing for every collector: a character reference shall not be automatically treated as a guarantor, and for debt collection a lender may only contact the guarantor, not other people from the borrower’s contacts. The circular also says the lender should tell a character reference that they were named, how their details were obtained, and that they can ask to be removed. No ticked box on the borrower’s form changes those rules, so don’t design your log as if it could.
The seven columns a borrower consent log needs
Keep it to one row per person per consent event. A borrower who renews twice should have three rows, not one row that gets overwritten.
| Column | What goes in it | Why it matters |
|---|---|---|
| Person and role | Borrower, guarantor, or character reference, linked to the loan account | The role decides what the desk may do with the contact (see the matrix above) |
| Purposes ticked | Each purpose as its own yes/no: credit evaluation, SMS or email reminders, sharing with a named collection partner, offers for future loans | Bundled “I agree to everything” consent is hard to defend as specific |
| Form version | Template code and date, for example CONSENT-v3-2026-07 | Proves what wording and notice the person actually saw |
| Date, branch, officer | When and where it was captured, and by whom | Lets you trace bad captures to a person or a branch |
| Proof location | Scan ID, document reference, or record link | A row without retrievable proof is just a claim |
| Withdrawal or change | Date and channel if the person later objected, limited a purpose, or asked to be removed as a reference | Stops the desk from texting or calling someone who opted out |
| Retention review date | When the file should be reviewed for disposal after the loan closes or the application is denied | Keeps you from holding closed-account IDs forever |
Store the scans themselves in your loan document folder or vault; the log only points to them. If you are still sorting how files are organized, our guide to a loan file document vault covers naming and access.
When to capture consent in a loan cycle
Because the amended circular ties consent to the moment data is needed, one form at the start of the relationship rarely covers everything. Map your capture points once, then train officers on them.
| Moment | What is being collected or used | Log action |
|---|---|---|
| Application | Identity, income, address, character references | Borrower row on the current form; reference rows with “informed” date |
| ID and photo capture | ID scans, selfie, home or store photo | Proof location filled the same day; no photos left on personal phones |
| Guarantor sign-up | Guarantor identity and contact | Separate guarantor row with their own consent and signed guaranty |
| Renewal or top-up | Updated income, new amounts, any new purposes | New row on the current form version; never reuse the old scan |
| Handover to a collection partner | Account data shared with a third party | Check the purpose and lawful basis with the DPO before release |
| Closure or denial | Nothing new; retention clock starts | Set the retention review date |
Worked example: where consent breaks in one loan cycle
Take an illustrative borrower, Lorna, who runs a sari-sari store in a Laguna barangay. She signs a ₱15,000 loan in March on consent form v2, ticking credit evaluation and SMS reminders. She names her cousin as a character reference and her neighbor as a guarantor. In July, Lorna misses two weekly payments.
- A collector calls the cousin. The cousin is a character reference, not a guarantor. Calling a reference to collect is the kind of contact the amended circular prohibits, whatever the form says. The cousin complains.
- The collector then calls the neighbor. The neighbor is listed as a guarantor on the application, but nobody captured the neighbor’s own consent or signed guaranty. On paper, the desk can’t show the neighbor ever agreed.
- Lorna renews in September for ₱25,000. The officer reuses the March scan instead of capturing a new v3 consent, which now mentions a collection partner.
- The branch hands the account to a partner in November. The file shows only v2 consent, which never mentioned third-party sharing.
Each step was normal desk behavior. With a consent log, the collector would have seen “role: character reference, verification only” before dialing the cousin and “guarantor consent: missing” before dialing the neighbor. The renewal checklist would have forced a fresh v3 row, and the handover would have been held until the DPO confirmed the basis for sharing. Four complaints become four ten-second checks.
A 15-minute weekly consent audit
- Pull last week’s new and renewed loans (about 3 minutes). Compare the count to new borrower consent rows. Any gap is a missing capture.
- Check guarantor rows (about 2 minutes). Every guarantor named on last week’s loans should have their own row and signed guaranty.
- Spot-check five proofs (about 4 minutes). Open the scan for five random rows. Is it legible, signed, and on the current form version?
- Check withdrawals against outbound lists (about 3 minutes). Anyone who withdrew SMS consent or asked to be removed as a reference should not appear on this week’s reminder or call lists, and no character reference should appear on a collection list at all.
- Flag retention dates (about 3 minutes). List closed or denied files whose review date has passed and send them to your DPO for a keep-or-dispose decision.
Write the result as one line in your compliance file: date, loans checked, gaps found, owner, fixed by. That line is the evidence that your process runs, not just exists.
Traps that make a log look complete
- One checkbox for all purposes. It fills the column but weakens the “specific” requirement.
- Copy-pasted renewal consent. The date on the row is new; the proof is the old form.
- Officer-phone photos. The proof location says “photo,” but the image lives on a personal device that leaves with the officer.
- Guarantors riding on the borrower’s form. The borrower row is perfect; the guarantor never signed anything of their own.
- References on the collection list. The log is tidy, but the call list was built from every phone number on the application.
- Withdrawals recorded on paper only. The objection exists in a notebook, while the reminder list keeps sending.
Decision framework: what to fix first
If you have no log at all, start with active loans only: borrowers first, then guarantors, then character references. If you have a log but no form versions, freeze one current template and record its code on every new row from Monday. If collectors work from raw application phone lists, split them by role this week, because calling the wrong person is the failure that reaches the Commission fastest. If your log is solid but withdrawals leak, fix the link between the log and your reminder and call lists before anything else, because that is where a borrower actually feels the failure.
Who can skip this? A lender with a single officer and a dozen loans can manage with a well-kept paper register and a locked cabinet, as long as the role rules above are followed. Once you have multiple officers, field capture, guarantors, or a collection partner, a log stops being optional housekeeping.
A lending system such as PesoLend keeps borrower profiles and uploaded documents on the borrower and loan record, which makes the “proof location” column a link instead of a hunt. Pair it with the identity steps in our KYC field checklist for small lenders so consent is captured at the same moment as the ID, and with our guide to guarantors and co-makers in clean borrower files.
Frequently asked questions
Can a borrower consent to us calling their references for collection?
Treat the answer as no. The amended circular limits character references to verifying the borrower’s identity and information, and limits collection contact to guarantors. A checkbox on the borrower’s form does not turn a reference into a guarantor. Confirm your scripts with your DPO.
Do we need a new consent at every renewal?
Capture a new row whenever the loan, the form wording, or the purposes change, which in practice means most renewals. It costs one signature and saves you from defending an old form against a new use.
How long should we keep a closed borrower’s file?
There is no single number that fits every lender. The circular asks for a reasonable written retention policy for denied applicants and fully paid borrowers, and rules out keeping data indefinitely. Set the period with your DPO or counsel, taking into account tax, accounting, and possible legal claims, then put the review date on every row.
What to do this week
Pick your current consent form, give it a version code, and split any bundled purposes into separate yes/no lines. Split your contact lists by role so collectors only see borrowers and guarantors with consent on file. Then open a simple log with the seven columns above for every loan released from today, and run the 15-minute audit next Monday. When you’re ready to keep borrower records and loan documents in one place across branches, sign in at https://pesolend.com/app/login.