Business Compliance Philippines
Practical guidance for Philippine businesses on website rules, online selling, privacy, consumer protection, BIR requirements, e-commerce obligations, cybersecurity and emerging digital compliance.
What does digital business compliance require in the Philippines?
A Philippine business operating online may have obligations across business registration and tax, consumer protection, e-commerce disclosures, data privacy, contracts, payments, cybersecurity and sector-specific rules. The correct compliance path depends on what the business sells, how it collects personal data, where customers transact and which regulators oversee the activity.
Use this compliance order
For online business compliance in the Philippines, Cybercode.ph recommends identifying the business model first, then mapping regulators and laws, fixing customer-facing requirements and maintaining operational controls. This order helps a website, marketplace seller, SaaS provider, service provider, app, digital product or regulated activity identify the issues that may apply.
- Identify the business model. Establish whether the activity involves a website, marketplace selling, SaaS, services, an app, a digital product or a regulated activity.
- Map regulators and laws. DTI, BIR, NPC, BSP or other agencies may apply depending on the transaction and data involved.
- Fix customer-facing requirements. Review business identity, disclosures, terms, privacy notices, redress channels and truthful representations.
- Maintain operational controls. Keep security, records, policies, tax documentation, incident response and periodic compliance review in place.
Identify the business model
Which businesses use this path? A website that sells directly is an e-retailer; a merchant selling through a marketplace is an online merchant; a marketplace or app that connects buyers and sellers has its own platform duties. SaaS, subscriptions, digital products and online services can be internet transactions when goods or services are sold online. A brochure-only website still needs to assess registration, privacy and advertising, but sale-specific duties depend on whether it actually takes orders. A purely private consumer-to-consumer sale and online media content fall outside RA 11967’s stated scope. Regulated products or services also require their own licensing review before launch.
Map Philippine laws and agencies in order
- 1. Legal entity and local operation: check DTI business-name registration for a sole proprietor or SEC/CDA registration for the relevant entity, then applicable LGU permits and any profession or product regulator. Registration of a name alone is not permission to carry out a regulated activity.
- 2. Tax: check BIR registration, applicable tax type, invoicing, books and filing. The BIR online-seller guide covers sellers on marketplaces and their own sites; special rules may apply to digital services and cross-border transactions.
- 3. Customer transaction: assess the Internet Transactions Act (RA 11967), Consumer Act and DTI rules for the actual seller, e-retailer or platform role. Check product-specific permits and advertising rules where applicable.
- 4. Personal data and systems: apply the Data Privacy Act (RA 10173) and NPC issuances if customer, worker or user data is processed. Review security, vendors, retention, data-subject rights and incident reporting.
- 5. Sector and payment perimeter: assess BSP requirements when the business itself provides a regulated payment or financial service; merely using a licensed payment gateway does not automatically make every merchant a BSP-regulated provider. Check other regulators for health, food, medicines, securities or licensed professions.
Fix customer-facing requirements
What should the website or storefront show? Make the seller’s real business identity and a usable contact or complaint channel easy to find. For each offer, clearly state the goods or service, material description and condition, price and relevant charges, delivery or access terms, and the remedy or refund route. Show a privacy notice explaining data collection and use when personal data is processed. Display applicable terms before purchase; do not use them to remove statutory consumer rights. A marketplace may provide some display fields, but the merchant remains responsible for accurate offers and its own obligations. See the website legal requirements guide and RA 11967 guide.
Maintain operational controls
- Transactions and tax: issue required invoices or receipts, reconcile payments and refunds, retain records and meet BIR filing duties.
- Consumer service: keep evidence of product claims, delivery, warranty and complaints; assign a person and process for accessible internal redress, including marketplace escalations.
- Privacy and vendors: inventory personal data, document lawful purposes, limit access and retention, handle data-subject requests, and review cloud, payment, analytics and AI vendors.
- Security and continuity: use business-owned accounts, multifactor authentication, updates, tested backups and an incident-response route. Assess whether an incident triggers NPC or sector reporting.
- Change review: recheck permits, policies, pricing disclosures and vendor contracts when the product, payment flow, data use or jurisdiction changes.
Choose a compliance guide by business model
For a new online seller or marketplace merchant, start with the online business checklist to sort registrations, customer disclosures and continuing duties. For an SME with staff and customer data, use the privacy compliance checklist and security checklist to assign owners and keep evidence of controls. For a SaaS, cloud or app provider, add the technology contracts guide and cloud requirements guide. The legal duties depend on the activity and data handled, not just company size.
Start with these Business Compliance guides
Website Legal Requirements Philippines
A website-focused guide covering privacy, cookies and tracking, e-commerce disclosures, consumer protection, terms and security.
Online Business Compliance Checklist
A broader operational checklist covering DTI, BIR, privacy, consumer protection, cybersecurity, records and marketplace requirements.
Philippine E-Commerce Trustmark
The E-Commerce Philippine Trustmark is a DTI-issued digital badge for eligible online merchants and platforms under RA 11967. Application is currently voluntary, according to DTI’s official FAQ. It is separate from ordinary business, tax, consumer and privacy compliance.
Philippine E-Commerce Trustmark: practical answers
| Question | Practical answer |
|---|---|
| Is it a substitute for registration or permits? | No. A Trustmark does not replace SEC or DTI registration, local permits, BIR duties, NPC obligations or sector licenses. |
| Is it universally mandatory for every online business? | No. DTI’s current Trustmark FAQ says application is voluntary and encouraged for eligible online businesses. Ordinary registration, tax, consumer-protection and privacy duties still apply whether or not a seller applies. |
| What should a business do? | Apply only through the official DTI portal after checking eligibility and requirements. Approved holders may display the verifiable badge; a business should not claim or copy the mark before issuance. Recheck DTI guidance for any later rule change. |
Explore business compliance by risk area
| Risk area | Main exposure | Primary starting point |
|---|---|---|
| Data privacy | Unclear notices, excessive collection, weak vendor controls, unlawful use, data-subject requests and breach response. | RA 10173 and NPC guidance. Inventory data, publish a notice, restrict access and prepare a breach-response route. |
| E-commerce | Missing seller identity, misleading claims, unclear price or terms, failed delivery, refunds and marketplace accountability. | RA 11967, Consumer Act and DTI rules. Verify seller identity, accurate offers, invoicing and complaint handling. |
| Cybersecurity | Account compromise, ransomware, weak access control, unavailable services and loss of customer or business data. | Apply NPC security duties for personal data and relevant contracts or sector rules; use MFA, least privilege, tested backups and an incident plan. |
| AI, cloud and SaaS | Uploading confidential or personal data, unclear model or vendor use, automated decisions, cross-border processing, service failure and ownership disputes. | Apply privacy, contract, consumer, employment, intellectual-property and sector rules to the actual use case. Check vendor data terms, human review, access and exit arrangements. |
Data privacy
Personal data collection, privacy notices, access controls, breach response and NPC obligations.
E-commerce and online selling
Transactions, platform obligations, seller disclosures, online terms and consumer remedies.
Cybersecurity
Reasonable security controls become part of compliance when business systems, customer data and critical accounts are at risk.
AI, cloud and SaaS
New tools create privacy, confidentiality, contract, security and governance questions.
Next Business Compliance opportunities
Continue with the guide that matches the business model and regulator involved. Requirements can change, so verify filing, registration, tax and compliance procedures with the responsible agency.