Home › Business kits › Professional and online services
A solo virtual assistant mostly adds BIR rules on how you get paid. A VA agency that handles client data on its own systems may also need to register with the National Privacy Commission (NPC). What owners miss: NPC registration turns on when you process sensitive personal information of 1,000 or more people, which a VA team doing HR or medical admin can reach fast.[1,2]
Solo VA or agency
NPC registration is mandatory for organizations with 250 or more employees, or those processing sensitive personal information of 1,000 or more individuals. A service provider that uses its own system to process personal data as a service must register if covered.[1]
A solo VA working inside a client's tools is far from these lines. An agency running payroll, patient intake or applicant screening for several clients on its own systems may cross them.
Getting paid through platforms and e-wallets
If you are paid through an e-marketplace or a digital financial services provider for services sold through digital platforms, RR 16-2023 has them withhold 1% on one-half of gross remittances, and you submit your BIR certificate to them.[2]
We did not confirm whether this covers pay from foreign freelance platforms or PayPal. Ask your Revenue District Office and keep records of every payout either way.
Picking your tax setup
A solo VA registers with the BIR as a self-employed individual. Compare the 8% income tax option with graduated rates before your first filing. If you also hold a salaried job, you are a mixed-income earner: the 8% is then on all your gross receipts, with no ₱250,000 reduction. Read our home-based business guide for barangay and city steps.[3]
VA setup checklist
- Register with BIR as self-employed and keep your certificate handy
- List which payment channels you use: banks, e-wallets, platforms
- Count how many people's personal data your team handles
- Write a short data handling policy for your team
- Keep a payout log with dates and amounts
- Use client tools instead of copying data to your own drives where you can
Questions people ask
- When must an NPC-covered business register?
- Within 20 days of starting the data processing system. The certificate is valid for one year.
- Do I need NPC registration as a freelancer?
- Only if you meet a threshold, such as processing sensitive personal information of 1,000 or more people, or you run a system that processes personal data as a service.
- Does the 1% withholding apply to my Upwork pay?
- Ask your Revenue District Office how the 1% withholding applies to pay from foreign platforms like Upwork.
Sources
Checked 14 November 2026. We link the agency's own page for every requirement. Rules change; confirm with the office before you pay.
- REMINDER ON MANDATORY DATA PROTECTION OFFICER AND DATA PROCESSING SYSTEM REGISTRATION · National Privacy Commission · 21 July 2023
- BIR: Online sellers must now pay withholding tax · Philippine Daily Inquirer · 17 July 2024
- Revenue Memorandum Order No. 23-2018 · Bureau of Internal Revenue · 21 May 2018
The extra permits, in one table
| Permit or registration | Agency | When it applies | Fee |
|---|---|---|---|
| Register Data Processing Systems and DPO with NPC[1] | National Privacy Commission | if 250+ employees, or processing sensitive personal information of 1,000+ individuals, or high-risk processing (or automated decision-making/profiling) | Not published |
| PIP using its own system as a service registers with NPC[1] | National Privacy Commission | if you process client personal data on your own systems as a service provider (and are covered) | Not published |
| BIR registration; give Certificate of Registration to the e-marketplace…[2] | BIR (RR 16-2023) | if paid for services through a digital platform/e-marketplace or DFSP | Not published |
| 1% creditable withholding tax on one-half of gross remittances by e-marketplaces / DFSPs[2] | BIR (RR 16-2023) | if remittances come through e-marketplace operators or DFSPs for services sold through digital platforms (in effect from 15 July 2024) | Not published |