According to List A of the Twelfth Regular Foreign Investment Negative List and Section 5 of the Retail Trade Liberalisation Act, as amended by Republic Act No. 11595, foreign investment in small retail enterprises is restricted to Philippine nationals. Retail trade businesses with capital below USD 500,000 are exclusively reserved for Filipino citizens. In addition, Section 3 of Rule III of the Implementing Rules and Regulations of the Retail Trade Liberalisation Act explicitly stipulates that this limitation extends to foreign retailers operating solely through online platforms.

The Philippines' de minimis threshold, which is the minimum value of goods below which customs do not charge duties, has increased from PHP 10 (approx. USD 0.17) to PHP 10,000 (approx. USD 180) since the Customs Modernization and Tariff Act (Art. 423) was passed in 2016. This is below the 200 USD threshold recommended by the International Chamber of Commerce (ICC).

Section 21 of the Data Privacy Act and Section 50 of the Implementing Rules and Regulations impose responsibility on the controller to ensure the confidentiality, integrity, and accessibility of the personal information transferred. Controllers are required to use contractual or other means to ensure that the third-party entity to whom the personal information is to be transferred for processing provides a comparable level of protection as that of the Philippines. In addition, data transfers to third parties, including transfers to an affiliate or parent company, require the consent of the data subject.

According to Circular No. 899, offshore outsourcing of a bank's domestic operations is permitted only when the service provider operates in jurisdictions which uphold confidentiality. When the service provider is located in other countries, the bank should take into account and closely monitor, on a continuing basis, government policies and other conditions in the countries where the service provider is based during the risk assessment process.
The Bangko Sentral ng Pilipinas (the Central Bank of Philippines) examiners shall be given access to the service provider and those relating to the bank's outsourced domestic operations. Such access may be fulfilled by on-site examination through coordination with host authorities, if necessary.

The Philippines has not joined any agreement with binding commitments to open transfers of data across borders. Art. 12.15 of the Regional Comprehensive Economic Partnership (RCEP) recognises that each party may maintain its own regulatory requirements governing cross‑border transfers of information by electronic means and stipulates that such transfers shall not be restricted when undertaken for the conduct of business by a covered person; however, the article simultaneously allows parties to adopt or maintain any measures they themselves deem necessary to achieve a legitimate public policy objective, as well as any measures necessary to protect essential security interests, with the parties expressly affirming that the determination of such necessity lies solely with the implementing party and that such measures shall not be subject to dispute. It is reported that this formulation enables the parties to preserve their domestic data‑control regime under the rubric of national security without risking inter‑state disputes, and that the relative weakness of Chapter 12 renders its provisions largely ineffectual in facilitating the liberalisation of cross‑border data flows, particularly because the clause entrusting necessity assessments to the implementing party effectively permits any measure to be characterised as legitimate at that party’s discretion.

The Data Privacy Act, together with its Implementing Rules and Regulations, establishes a comprehensive framework for the protection of personal data in the Philippines. The regulatory authority, the National Privacy Commission, was instituted in 2016.

RA 10175 mandates that “traffic data and subscriber information relating to communication services shall be kept, retained, and preserved by a service provider for a minimum period of six months from the date of the transaction.” This minimum data retention requirement, while under judicial or investigative procedure, is costly for the service provider.

The National Telecommunications Commission (NTC) regulations require telecommunications entities to retain call traffic data on the origin, destination, date, time and duration of communications and to retain data within the following periods: two months for non-metered services with fixed monthly charges; four months for other telecommunications services; or until excused by the NTC for records requested in connection with pending complaints.

RA 10173 requires that “any natural or juridical person or other body involved in the processing of personal data [to] designate an individual or individuals who shall function as data protection officers.” This requirement can impose additional trade costs on firms since data privacy compliance is a horizontally-applied measure.

A basic legal framework on intermediary liability for copyright infringement is absent in Philippine law and jurisprudence. Arguably, safe harbour clauses are present in the Electronic Commerce Act of 2000 (RA 8792) and the Cybercrime Prevention Act of 2012 (RA 10175). However, the definition of an intermediary in these laws limits its capacity to provide a safe harbour. Particularly, RA 8792’s scope is limited to electronic documents, while RA 10175 is limited to cybercrimes defined under the law. This makes safe harbours in Philippine law sectoral or content-specific.

A basic legal framework on intermediary liability beyond copyright infringement is absent in Philippine law and jurisprudence. Arguably, safe harbour clauses are present in the Electronic Commerce Act of 2000 (RA 8792) and the Cybercrime Prevention Act of 2012 (RA 10175). However, the definition of an intermediary in these laws limits its capacity to provide a safe harbour. Particularly, RA 8792’s scope is limited to electronic documents, while RA 10175 is limited to cybercrimes defined under the law. This makes safe harbours in Philippine law sectoral or content-specific.

According to Art. 5 of the Subscriber Identity Module (SIM) Card Registration Act, the Philippines imposes an identity requirement for SIM registration. Anyone wanting to purchase a SIM card has to provide their national ID card or a passport in case of foreigners to activate a new prepaid SIM card.

Section 46.m of the Anti-Terrorism Act of 2020 (Republic Act No. 11479) provides that the Anti-Terrorism Council (ATC) may require government agencies, offices and entities, together with their officers and employees, as well as non-governmental organisations, private entities and individuals, to render assistance in the discharge of its mandate. Pursuant to this provision, the National Security Adviser, who under Section 45 of the Act serves as Vice-Chairperson of the ATC, requested in June 2022 that the National Telecommunications Commission (NTC) block 26 websites. In response, the NTC issued a memorandum directing internet service providers to restrict access to websites alleged to have links to “communist terrorist groups”. The affected websites included Philippine news outlets Bulatlat and Pinoy Weekly, United States based publications CounterPunch and Monthly Review, and several sites affiliated with the Communist Party of the Philippines. In November 2025, however, a court declared the NTC memorandum void on the basis that the Commission lacked legal authority to issue it, observing that to interpret Section 46.m as empowering the ATC to compel such measures would unduly expand the scope of the law and sanction acts beyond the statutory limits of administrative competence, with the result that access to all the affected websites was restored.

The indicator "7.2.4 - Government Internet shut down in practice" of the V-Dem Dataset, which measures whether the government has the technical capacity to actively make internet service cease, thus interrupting domestic access to the internet or whether the government has decided to do so, has a score of 3 in Philippines for the year 2025. This corresponds to "Rarely but there have been a few occasions throughout the year when the government shut down domestic access to Internet."

The Foreign Investment Act requires the publication of the Foreign Investment Negative List (FINL) every two years, which outlines sectors in which foreign investment is restricted. According to List A of the 2022 FINL, advertising is limited to 30% foreign equity.