Home › Business kits › Professional and online services
We found no sector licence for web design or digital agencies. Your extra rules depend on what you do. If you sell digital services online, RA 11967 asks you to publish your business details and meet quality and privacy duties. If you host or process client data on your own systems, the National Privacy Commission may require registration. Many agencies miss the second one, since client forms and mailing lists are personal data.[1,2]
Client data on your servers
A personal information processor that uses its own system as a service to process personal data must register with the NPC if it meets the thresholds, such as 250 or more employees or sensitive personal information of 1,000 or more individuals.[1]
Treat hosted contact forms, email lists and client customer databases on your servers as personal data processing. Write down which client data sits on your systems and how many people it covers.
Selling services online
Under RA 11967, e-retailers publish their business name, address and contact details on their homepage and submit them to the E-Commerce Bureau. Digital services must have the qualities and performance features the provider advertises, and e-retailers must protect consumers' data privacy under RA 10173.[2]
Put your business details in your site footer and in proposals. Spell out in each contract what "done" means, what browsers you test and who pays for hosting.
Freelancer or agency
A solo designer registers like any self-employed professional. Once you hire, add the employer steps in our first employee guide, and see the virtual assistant kit for platform payout rules.
Agency setup checklist
- List every system where you store client or end-user data
- Count the people whose data you hold for each client
- Add your business name, address and contact details to your site
- Write a contract template with scope, testing and hosting terms
- Set up access controls and remove ex-staff accounts quickly
- Write a short data breach plan
Questions people ask
- When must I register with the NPC?
- Within 20 days of starting a covered data processing system. The registration certificate is valid for one year.
- Is there a licence for web designers in the Philippines?
- The national rules cited on this page set no licence for web designers. Your permits are the usual business ones plus the rules on this page.
- Do I have to fix a website I sold if it breaks?
- RA 11967 says digital services must have the qualities and performance features advertised. Clear contracts about scope and support help avoid disputes.
Sources
Checked 13 November 2026. We link the agency's own page for every requirement. Rules change; confirm with the office before you pay.
- REMINDER ON MANDATORY DATA PROTECTION OFFICER AND DATA PROCESSING SYSTEM REGISTRATION · National Privacy Commission · 21 July 2023
- Republic Act No. 11967 (Internet Transactions Act of 2023) · Congress of the Philippines (via Lawphil) · 5 December 2023
The extra permits, in one table
| Permit or registration | Agency | When it applies | Fee |
|---|---|---|---|
| Register Data Processing Systems and DPO with NPC[1] | National Privacy Commission | if 250+ employees, or processing sensitive personal information of 1,000+ individuals, or high-risk processing (or automated decision-making/profiling) | Not published |
| PIP using its own system as a service registers with NPC[1] | National Privacy Commission | if you process client personal data on your own systems as a service provider (and are covered) | Not published |
Rules and exemptions
Selling rules that apply
- Publish business name, address, contact details on homepage and submit…: RA 11967 Sec. 23(f): e-retailers publish their business name, address and contact details and submit them to the Bureau with a government ID or registration document[2]
- Digital services must meet standard quality/functionality as advertised: RA 11967 Sec. 23(d): digital goods/services providers must ensure functionality, compatibility, interoperability, accessibility, continuity and security standard for that type[2]
- Data privacy precautions under RA 10173: RA 11967 Sec. 23(f)(2): e-retailers must protect consumers' data privacy per RA 10173[2]