The Philippines has signed and ratified the United Nations (UN) Convention on the Use of Electronic Communications in International Contracts.

The Philippines has adopted national legislation based on or influenced by the United Nations Commission on International Trade Law (UNCITRAL) Model Law on Electronic Commerce.

The Philippines has not adopted national legislation based on or influenced by the United Nations Commission on International Trade Law (UNCITRAL) Model Law on Electronic Signatures.

In 2017, the Philippine government enacted the Philippine National Strategic Goods List Annex 2, regulating the strategic dual-use items for both export and import for national security reasons. Some of these dual-use items are electronics and computers that reach a specific technical level that qualifies them as fit for military use.

Self-declaration of conformity is not allowed in the Philippines. Audio and video products such as TVs and LCD panels marketed in the Philippines are required to be certified according to the relevant Philippine PNS safety standard, which is equivalent to the international IEC 60065:2007. There are two options:
- a voluntary license to use the Philippine Standard PS-mark on manufactured products as granted by the Bureau of Product Standards (BPS); or
- use of stickers with the mandatory Import Commodity Clearance (ICC)-mark on imported products.
Products must be tested within the Philippines, and applications must be submitted through a local representative. Additionally, periodic factory audits are required for the PS-mark.
Certification of some telecom equipment types requires testing at the incumbent telecom carrier laboratories, while approval is based on a review of foreign standard test reports for other categories. The Philippines' National Telecommunication Commission (NTC) also issues certifications for telecom equipment that is connected to public network services.

According to List A of the Twelfth Regular Foreign Investment Negative List and Section 5 of the Retail Trade Liberalisation Act, as amended by Republic Act No. 11595, foreign investment in small retail enterprises is restricted to Philippine nationals. Retail trade businesses with capital below USD 500,000 are exclusively reserved for Filipino citizens. In addition, Section 3 of Rule III of the Implementing Rules and Regulations of the Retail Trade Liberalisation Act explicitly stipulates that this limitation extends to foreign retailers operating solely through online platforms.

The Philippines' de minimis threshold, which is the minimum value of goods below which customs do not charge duties, has increased from PHP 10 (approx. USD 0.17) to PHP 10,000 (approx. USD 180) since the Customs Modernization and Tariff Act (Art. 423) was passed in 2016. This is below the 200 USD threshold recommended by the International Chamber of Commerce (ICC).

In 2017, the Philippine government enacted the Philippine National Strategic Goods List Annex 2, regulating the strategic dual-use items for both export and import for national security reasons. Some of these dual-use items are electronics and computers that reach a specific technical level that qualifies them as fit for military use.

It is reported that corruption and irregularities in customs processing are widespread, encompassing unwarranted and costly delays, discrepancies in valuation procedures, the routine imposition of full inspection and testing on certain goods, and inconsistent fee assessments.

Section 21 of the Data Privacy Act and Section 50 of the Implementing Rules and Regulations impose responsibility on the controller to ensure the confidentiality, integrity, and accessibility of the personal information transferred. Controllers are required to use contractual or other means to ensure that the third-party entity to whom the personal information is to be transferred for processing provides a comparable level of protection as that of the Philippines. In addition, data transfers to third parties, including transfers to an affiliate or parent company, require the consent of the data subject.

According to Circular No. 899, offshore outsourcing of a bank's domestic operations is permitted only when the service provider operates in jurisdictions which uphold confidentiality. When the service provider is located in other countries, the bank should take into account and closely monitor, on a continuing basis, government policies and other conditions in the countries where the service provider is based during the risk assessment process.
The Bangko Sentral ng Pilipinas (the Central Bank of Philippines) examiners shall be given access to the service provider and those relating to the bank's outsourced domestic operations. Such access may be fulfilled by on-site examination through coordination with host authorities, if necessary.

The Philippines has not joined any agreement with binding commitments to open transfers of data across borders. Art. 12.15 of the Regional Comprehensive Economic Partnership (RCEP) recognises that each party may maintain its own regulatory requirements governing cross‑border transfers of information by electronic means and stipulates that such transfers shall not be restricted when undertaken for the conduct of business by a covered person; however, the article simultaneously allows parties to adopt or maintain any measures they themselves deem necessary to achieve a legitimate public policy objective, as well as any measures necessary to protect essential security interests, with the parties expressly affirming that the determination of such necessity lies solely with the implementing party and that such measures shall not be subject to dispute. It is reported that this formulation enables the parties to preserve their domestic data‑control regime under the rubric of national security without risking inter‑state disputes, and that the relative weakness of Chapter 12 renders its provisions largely ineffectual in facilitating the liberalisation of cross‑border data flows, particularly because the clause entrusting necessity assessments to the implementing party effectively permits any measure to be characterised as legitimate at that party’s discretion.

The Data Privacy Act, together with its Implementing Rules and Regulations, establishes a comprehensive framework for the protection of personal data in the Philippines. The regulatory authority, the National Privacy Commission, was instituted in 2016.

RA 10175 mandates that “traffic data and subscriber information relating to communication services shall be kept, retained, and preserved by a service provider for a minimum period of six months from the date of the transaction.” This minimum data retention requirement, while under judicial or investigative procedure, is costly for the service provider.

The National Telecommunications Commission (NTC) regulations require telecommunications entities to retain call traffic data on the origin, destination, date, time and duration of communications and to retain data within the following periods: two months for non-metered services with fixed monthly charges; four months for other telecommunications services; or until excused by the NTC for records requested in connection with pending complaints.