What Are the Compliance Deadlines for E-Commerce Businesses?
Introduction
Online merchants, e-retailers, e-marketplaces, and other digital platforms operating in or serving the Philippine market must comply with the requirements of the Internet Transactions Act. These requirements include business identification, consumer disclosures, data protection, invoicing, complaint handling, and registration-related obligations.
The principal statute is Republic Act No. 11967, or the Internet Transactions Act of 2023. It creates the E-Commerce Bureau under the Department of Trade and Industry (DTI), establishes an Online Business Database, and imposes obligations on e-marketplaces, digital platforms, e-retailers, and online merchants.
Businesses should distinguish between deadlines that apply to the government and deadlines that apply directly to online businesses. The Act gives the DTI a period to establish the Online Business Database and grants affected businesses a separate transition period to comply with the law’s requirements.
Who Is Covered by the Internet Transactions Act?
Republic Act No. 11967 applies to business-to-business and business-to-consumer internet transactions within the mandate of the DTI when one of the parties is situated in the Philippines, or when the digital platform, e-retailer, or online merchant is serving the Philippine market and has minimum contacts in the country.
The statute does not cover online media content or consumer-to-consumer transactions. Accordingly, a business selling products or services to Philippine consumers through its own website, social media page, application, or an e-marketplace will generally fall within the Act’s coverage.
The scope and coverage provision is found in Section 3 of Republic Act No. 11967.
Primary Compliance Deadline: The Eighteen-Month Transition Period
Section 32 of Republic Act No. 11967 provides an eighteen-month transitory period from the effectivity of the Act. This period is given to affected online merchants, e-retailers, e-marketplaces, and digital platforms to comply with the law.
The transition period does not mean that businesses may disregard consumer protection, data privacy, taxation, intellectual property, cybersecurity, or other applicable laws while preparing for compliance. It is a period for completing the requirements specifically imposed by the Internet Transactions Act and its implementing rules.
Because the applicable period is measured from the statute’s effectivity, a business should verify the official effectivity date and calculate the compliance deadline from that date. The eighteen-month period should not be treated as an automatic extension for violations of obligations arising under other laws.
Section 32 is the controlling transitory provision. See Republic Act No. 11967.
DTI Deadline for the Online Business Database
The Act directs the E-Commerce Bureau to establish an Online Business Database within one year from the effectivity of the Act. The database is intended to contain information concerning digital platforms, e-marketplaces, e-retailers, and online merchants engaged in e-commerce in the Philippines.
The database is intended to give the government and online consumers access to contact information for online businesses. In establishing it, the DTI must use existing business databases and coordinate with agencies maintaining similar records.
The DTI must also consult the Department of Information and Communications Technology, the National Privacy Commission, the Philippine Competition Commission, the Securities and Exchange Commission, the Cooperative Development Authority, and other concerned agencies in issuing rules governing the database.
The one-year deadline applies to the establishment of the database by the E-Commerce Bureau. It should not be confused with the eighteen-month transition period given to affected businesses. The relevant provision is Section 10 of Republic Act No. 11967.
Business Information That Online Merchants Must Prepare
E-retailers and online merchants must publish specified business information on their homepage. This requirement supports transparency and gives consumers a direct means of identifying and contacting the business.
The information must include:
- the corporate name and trade or business name, as applicable;
- the address of the physical shop or place of business;
- a mobile or landline number and a valid email address; and
- when the service involves a regulated profession, membership details in the relevant professional body or institution.
The information submitted to the Bureau must be accompanied by at least one government identification card or registration document as proof of identity. Businesses should therefore prepare consistent information across their website, marketplace account, business registration records, and customer-support channels.
These requirements appear in Section 23 of Republic Act No. 11967.
Information E-Marketplaces Must Obtain Before Listing a Merchant
E-marketplaces must, as far as practicable, require online merchants to submit specified information before allowing them to list on the platform. The required information includes:
- the merchant’s name, supported by a valid government identification card for an individual or business registration documents for a juridical entity;
- the merchant’s geographic address; and
- contact details, including a mobile or landline number and a valid email address.
For platform operators, this means that merchant onboarding procedures should be completed before product or service listings become available to the public. Existing merchants should also be reviewed and their records updated where information is incomplete or inconsistent.
The applicable requirements are found in Section 21 of Republic Act No. 11967.
Consumer Disclosures and Promotional Offers
E-marketplaces must ensure that internet transactions are clearly identifiable as e-commerce transactions and must identify the person or persons on whose behalf the transaction is made.
Promotional offers must also be identified. Discounts, premiums, gifts, and the conditions for obtaining them must be presented in a manner that is accessible, clear, and unambiguous.
Businesses should review product pages, checkout screens, advertisements, discount codes, and campaign terms to ensure that the actual conditions of an offer are visible before the consumer completes the transaction. A promotional statement should not depend solely on information hidden in an unrelated page or difficult-to-find link.
Electronic Invoices and Receipts
E-retailers and online merchants must issue paper or electronic invoices or receipts for all sales. This obligation should be incorporated into the business’s checkout and order-confirmation process.
A business should ensure that its invoice or receipt system can identify the seller, describe the transaction, state the relevant amount, and preserve the transaction record. The business should also coordinate this requirement with applicable tax rules and registration requirements administered by the Bureau of Internal Revenue.
The issuance of invoices or receipts is expressly included among the obligations of e-retailers and online merchants under Section 23 of Republic Act No. 11967.
Data Privacy and Information Security Preparation
Online merchants, e-retailers, e-marketplaces, and covered digital platforms must take necessary precautions to protect consumer data and comply with applicable information-security standards. The Act specifically refers to Republic Act No. 10173, or the Data Privacy Act of 2012, and issuances of the National Privacy Commission.
Businesses should therefore review the following before the transition period expires:
- the categories of personal data collected from consumers;
- the purpose and legal basis for collecting and using the data;
- privacy notices and consent mechanisms, where applicable;
- access controls and user permissions;
- retention and deletion procedures; and
- incident-response and breach-reporting procedures.
The inclusion of personal-data safeguards in the Internet Transactions Act does not replace the Data Privacy Act. Compliance should be assessed under both statutes and the applicable rules of the National Privacy Commission.
Complaint Handling and Redress Mechanisms
E-retailers must have an accessible and efficient redress mechanism for handling complaints from clients. Other digital platforms must also provide an effective and responsive mechanism for reporting users or information posted on the platform that may violate relevant laws.
A suitable complaint system should identify the responsible team, provide a working contact channel, acknowledge complaints, preserve relevant transaction records, and communicate the result or next step to the complainant. Businesses should also establish escalation procedures for fraud, unsafe products, unauthorized transactions, privacy incidents, and unlawful content.
A contact form that is inaccessible, unmonitored, or incapable of producing a response may not adequately satisfy the statutory purpose of an effective redress mechanism.
Additional Platform Duties
Digital platforms that do not retain oversight over the consumption of the transaction have additional obligations. These include maintaining, as far as practicable, an updated list of accounts using the platform for e-commerce and providing specific information when ordered by a competent authority through a subpoena.
The subpoena-related disclosure is connected to an investigation based on a sworn complaint stating that the platform is being used in the commission of a crime or has been used as a means to commit a malicious, fraudulent, or unlawful act, and that the complainant cannot ascertain the perpetrator’s identity.
Covered platforms must also take necessary precautions to protect consumer data, comply with minimum information-security standards, and observe ordinary diligence. Failure to observe ordinary diligence may expose the platform to penalties under the Act.
These duties are provided in Section 22 of Republic Act No. 11967.
Recommended Compliance Calendar
| Period or trigger | Required action |
|---|---|
| Within one year from the Act’s effectivity | The E-Commerce Bureau must establish the Online Business Database. |
| Within eighteen months from the Act’s effectivity | Affected online merchants, e-retailers, e-marketplaces, and digital platforms must comply with the Act’s requirements. |
| Before merchant listing | E-marketplaces should obtain the required merchant identity, address, and contact information as far as practicable. |
| Before or at the time of each sale | E-retailers and online merchants must issue a paper or electronic invoice or receipt. |
| During continued operations | Businesses must maintain consumer disclosures, privacy safeguards, security measures, and complaint-handling mechanisms. |
How Businesses Should Prepare
First, identify the business’s legal classification under the Act. A business may be an online merchant, e-retailer, e-marketplace, or another type of digital platform, and different categories may carry different duties.
Second, create an inventory of every digital channel used for Philippine transactions. This should include websites, mobile applications, social-media stores, marketplace accounts, payment pages, customer-service accounts, and fulfillment systems.
Third, conduct a document and process audit. The audit should compare the information displayed to consumers with the business’s registration documents, physical address, contact information, privacy notices, promotional terms, invoices, receipts, and complaint procedures.
Fourth, assign responsible personnel and set internal deadlines earlier than the statutory deadlines. The business should retain evidence of compliance, including screenshots, merchant-verification records, invoices, privacy documents, complaint logs, and platform policies.
Finally, monitor implementing regulations and official compliance procedures issued by the DTI and other relevant agencies. The statute establishes the general obligations, while implementing rules may provide the operational details for registration, reporting, platform duties, and enforcement.
Typical Compliance Scenarios
Online retailer selling directly to Philippine consumers. The retailer should publish its business identity and contact information, issue paper or electronic invoices or receipts, maintain a complaint mechanism, and protect consumer data.
Marketplace onboarding third-party sellers. The marketplace should obtain merchant identification, address, and contact details before listing sellers as far as practicable. It should also provide clear disclosures, maintain platform records, and operate a responsive reporting mechanism.
Foreign platform serving the Philippine market. A foreign platform may fall within the Act when it avails of the Philippine market and has minimum contacts in the country. The platform should assess its Philippine-facing operations, seller records, consumer support, data practices, and statutory compliance responsibilities.
Business still completing its compliance system. The business may use the eighteen-month transition period to complete implementation, but it should not delay basic consumer protection, privacy, tax, cybersecurity, and recordkeeping measures that may independently be required by other Philippine laws.
Final Observations
The principal compliance deadlines under the Internet Transactions Act are the one-year period for establishing the Online Business Database and the eighteen-month transition period for affected online businesses and platforms. These periods should be calculated from the Act’s effectivity and should not be confused with continuing operational duties such as issuing receipts, protecting consumer data, publishing business information, and maintaining complaint channels.
Businesses should begin with a classification review, followed by a channel-by-channel audit and a written compliance calendar. Early preparation is especially important for platforms handling numerous merchants because identity verification, consumer disclosures, data security, and complaint processing require coordinated technical and legal controls.
About Nicolas and De Vega Law Offices
Nicolas and de Vega Law Offices is a full-service law firm in the Philippines. You may visit us at the 16th Flr., Suite 1607 AIC Burgundy Empire Tower, ADB Ave., Ortigas Center, 1605 Pasig City, Metro Manila, Philippines. You may also call us at +632 84706126, +632 84706130, +632 84016392 or e-mail us at [email protected]. Visit our website https://ndvlaw.com.
