Philippine Digital Compliance Guide for Business Websites

This guide summarizes the main Philippine laws and government requirements that affect a business website or online store. It is written for business owners deciding what they actually need to have in place, not as a substitute for legal advice. Requirements described here can change as implementing rules are updated; where a specific date or threshold is cited, the source is named so it can be checked directly. A changelog at the bottom logs revisions.

This is not legal advice. It is a plain-language summary of publicly available regulations, current as of the date above. For a specific situation, particularly registration thresholds, penalties, or a dispute, consult a Philippine lawyer or the relevant government agency directly.

Data privacy — Republic Act 10173

The Data Privacy Act of 2012 governs how personal data is collected, stored, and processed, and it applies to essentially any website with a contact form, email signup, newsletter, or inquiry form, not just large platforms. The National Privacy Commission (NPC) is the government body that enforces it.

For most small business websites, the practical requirement is straightforward: publish a Privacy Notice (sometimes called a Privacy Policy) that clearly states what personal data is collected and why. This is the baseline expectation regardless of business size.

Formal registration with the NPC as a Personal Information Controller or Processor becomes mandatory once a business crosses either of two thresholds: 250 or more employees, or processing sensitive personal information belonging to 1,000 or more individuals. A business past either threshold must also designate a Data Protection Officer and register that appointment with the NPC within 90 days, under NPC Circular No. 2022-04 (effective January 11, 2023). Registered controllers and processors must also report a data breach within 72 hours of discovering it.

Most single-location Philippine SMBs, a clinic, a resort, a single restaurant, will not cross either threshold and won't need formal NPC registration. The Privacy Notice requirement applies regardless.

E-commerce basics — Republic Act 8792

The Electronic Commerce Act took effect on June 19, 2000 and remains the foundational law for online transactions in the Philippines. Its core function is giving electronic documents, signatures, and contracts the same legal standing as their paper equivalents.

For a business website, the practical obligations that flow from this law are disclosure-based: clearly stating the terms of a sale, providing accurate information about products or services offered online, and honoring the consumer's rights around refunds and returns. The Department of Trade and Industry (DTI) holds authority to issue further implementing rules under this law.

Internet Transactions Act — Republic Act 11967

Signed December 5, 2023 and in full effect since June 20, 2025 (following an 18-month transition period after its implementing rules were issued in May 2024), this is the newer and more detailed of the two e-commerce laws, built specifically for the modern online marketplace rather than the general electronic-transactions framework RA 8792 provides.

It created an E-Commerce Bureau within the DTI, tasked with maintaining an Online Business Database of registered online sellers, and it defines specific obligations for online merchants, digital platforms, and e-marketplaces. The law also mandates the existence of an E-Commerce Philippine Trustmark, a certification seal meant to signal that an online seller is registered and compliant. As of this writing, Trustmark registration itself is voluntary, with DTI having extended the voluntary period through December 31, 2026, after an earlier attempt to make it mandatory in late 2025 was reversed following pushback from online sellers. Businesses that do register pay a fee of up to ₱1,130 (₱130 for micro businesses with total assets under ₱3 million), and the badge is valid for one year. The DTI can issue administrative fines of up to ₱1,000,000 for violations of the Act's merchant obligations, independent of whether a business holds the Trustmark.

Business registration

A sole proprietorship operating a business, including one run primarily online, registers its business name with the DTI. Partnerships, corporations, and one-person corporations register with the Securities and Exchange Commission (SEC) instead. Beyond that initial registration, a business also needs a Mayor's or Business Permit from its local government unit, and registration with the Bureau of Internal Revenue (BIR) for tax purposes, which produces a Certificate of Registration (BIR Form 2303).

An online seller's disclosure obligations generally extend to displaying business name, registration number, complete address, and contact details somewhere on the website or storefront, consistent with the transparency requirements under RA 8792 and RA 11967 above.

Quick checklist

A newly launched Philippine business website, at minimum, typically needs: a published Privacy Notice covering what data the site collects and why; DTI (or SEC) business name registration and a current BIR Certificate of Registration; a Mayor's/Business Permit from the relevant LGU; and clear, visible business identity and contact information on the site itself. NPC registration and DTI Trustmark enrollment become relevant only past the specific thresholds described above, or if a business chooses to pursue the Trustmark voluntarily for buyer trust.

Changelog

July 30, 2026 — Guide published, covering RA 10173, RA 8792, RA 11967, and DTI/BIR/SEC registration basics.