Building an E-Commerce Website That Complies With the Internet Transactions Act

⏱ 9 min read

The Internet Transactions Act of 2023 (Republic Act No. 11967) is a law in force that governs business-to-consumer and business-to-business transactions conducted over the internet in the Philippines. It created a DTI E-Commerce Bureau and an Online Business Database, and it sets out the liability of online merchants and e-marketplaces; its Implementing Rules and Regulations (IRR) were signed on May 22, 2024. If you are building or running an online store, design it so that your identity, prices, terms, payments and customer data handling are clear and documented.

This guide explains the law’s key points as reported by the Department of Trade and Industry, then translates them into website features and processes. It is informational only and not legal advice: read the IRR and consult a lawyer or the DTI about your specific obligations.

What the Internet Transactions Act is

President Marcos signed the Internet Transactions Act on December 5, 2023, according to the DTI. The law aims to build trust in online commerce by making it clearer who is selling, what the rules are, and who is accountable when things go wrong. The DTI highlights three main elements:

• The E-Commerce Bureau within the DTI, which oversees internet transactions and coordinates with other agencies.
• An Online Business Database, intended to make information about online businesses available to consumers.
• Rules on liability for online merchants, e-retailers and e-marketplaces, so that platforms as well as sellers have responsibilities.

The IRR was signed on May 22, 2024, in an interagency signing led by the DTI with the Bangko Sentral ng Pilipinas, the Department of Agriculture, the DICT, the Department of Health and the National Privacy Commission. That list of agencies is telling: online commerce touches payments, food and agricultural products, technology, health products and personal data. The full IRR is available from the DTI and is the document to read for detailed obligations.

Where the ITA fits with other laws

The ITA does not replace earlier rules; it sits alongside them. A Philippine online store typically has to consider:

Sector rules can add more. Health products, food and regulated financial services each have their own regulators, which is why the DA, DOH and BSP joined the IRR signing.

Why this matters more as online selling grows

Online commerce is no longer a side channel. The Philippine Statistics Authority’s preliminary 2025 estimates put the digital economy at about ₱2.74 trillion, or 9.8% of GDP, with e-commerce accounting for 32.2% of it, as reported by GMA News on April 30, 2026. The DTI also reported onboarding 300,321 MSMEs to e-commerce between January 2023 and March 2024, according to Philstar.

More sellers means more competition for trust. In ServicioPro’s analysis, the features that support ITA and privacy compliance are the same ones that make shoppers comfortable buying from a store they have never heard of: a visible business identity, clear prices, honest delivery promises and reliable receipts.

Compliance and conversion point in the same direction: the clearer your store is about who you are and what the customer pays, the easier it is to say yes.

Payments: QR Ph, e-wallets and cards

Payment habits have shifted decisively. The BSP reported that digital payments made up 64.7% of retail payment volume in 2025, up from 57.4% in 2024, and that QR Ph handled 2.47 billion transactions worth ₱1.16 trillion, overtaking cards, as reported by the Daily Tribune on August 19, 2026. GCash alone reported 90 million registered users in 2025 in its parent Mynt’s IPO filing announcement.

For an online store, that means:

• Offer QR Ph and e-wallets, not just cards. A payment gateway can provide GCash, Maya, QR Ph, cards and bank transfers through one integration. See our guide to the payment gateway stack for Philippine apps.
• Confirm payments server-to-server. Mark an order paid only after your server verifies it with the gateway, never based on a customer’s screenshot or browser redirect alone.
• Show the total before payment. Product price, shipping, and any fees should be visible before the customer commits.
• Issue a receipt automatically. Send an order confirmation and receipt by email or SMS immediately after payment.

Our article on accepting GCash and Maya on your website or app explains setup in more detail.

Must-have features for an ITA-ready online store

The checklist below is ServicioPro’s recommended feature set. It reflects the law’s goals of transparency and accountability and general good practice; it is not an official compliance list.

Business transparency

1. An “About” or “Business information” page with your registered business name, DTI or SEC registration details, physical address, email and phone number.
2. Consistent identity across your website, marketplace stores, social pages and invoices, so customers and regulators can match them.
3. A visible customer support channel with expected response times.

Product and price clarity

4. Accurate product descriptions, including size, variants, condition and what is included.
5. Prices in pesos with shipping and any extra fees shown before checkout.
6. Stock and lead times that match reality, especially for pre-orders and made-to-order items.

Terms and after-sales

7. Clear terms of sale: delivery areas, timelines, cancellation rules.
8. A returns, exchange and refund policy written in plain language and linked from every product page and the checkout.
9. Order confirmation and receipts sent automatically, with an order history in the customer account.
10. A complaint process with a ticket or reference number and records kept.

Privacy and security

11. A privacy notice explaining what data you collect, why, who receives it (couriers, payment gateways) and how customers can exercise their rights.
12. Consent and minimal collection: ask only for what you need to fulfil the order.
13. Secure hosting, HTTPS, updates and backups, plus admin two-factor authentication.
14. A breach response plan that can meet the NPC’s 72-hour notification rule.

Data privacy inside the store

Every order involves personal data: names, addresses, phone numbers and sometimes IDs. The Data Privacy Act applies regardless of the size of your shop. Practical steps:

• Limit admin access by role: packers see addresses, not payment details; marketing staff see aggregated data, not full customer lists.
• Do not store card numbers yourself; let the payment gateway handle them.
• Set retention rules: how long you keep order data, and when it is deleted or anonymised.
• Log admin exports and changes so you can investigate incidents.
• Review what you share with couriers and marketing tools.

For a full walkthrough, read our guide on Data Privacy Act compliance for websites and apps, and see the OWASP Top 10:2025 for Philippine businesses for the security side.

A practical build sequence

If you are commissioning a new store, build compliance in from the start rather than bolting it on:

1. Gather your registration documents, business address and official contact details.
2. Write your terms of sale, returns policy and privacy notice before design begins, so the layout makes room for them.
3. Choose a payment gateway that supports QR Ph, e-wallets and cards, with server-side confirmation.
4. Design product, cart and checkout pages to show full prices and fees.
5. Set up automated receipts, order records and a support ticket process.
6. Configure admin roles, two-factor authentication, logging and backups.
7. Test the full journey on mobile, including failed and duplicate payments, returns and cancellations.
8. Review the IRR and have a lawyer check your policies before launch.

Cost depends on the number of products, payment methods, integrations with couriers or accounting systems, and how much custom functionality you need. ServicioPro’s business website packages start from ₱5,000, and the website cost guide explains what moves the price up for e-commerce.