Philippines software delivery: privacy registration, payments and support hours that overlap

OutsourcingVN is operated by Netbase JSC, so this guide is written by a supplier that would like your project. It draws on Netbase's published web-to-print storefront work in the region and on official Philippine references for the privacy, payment and invoicing questions your own advisers must confirm. The guides index lists the guides for other markets.

Contents

• What decisions shape a Philippines-facing build?
• Does your organisation need to register with the National Privacy Commission?
• The nearest published record for this kind of store
• How do you decide which payment methods to support?
• How do you prepare for Bureau of Internal Revenue e-invoicing?
• Worked scenario: a support ticket that crosses two time zones
• Which questions should you ask a supplier?
• What usually goes wrong?
• How this guide is sourced and where it stops
• Common questions
• Plan the first phase

What decisions shape a Philippines-facing build?

Four choices recur in a Philippines-facing brief, and each needs an owner on the buyer's side.

• Privacy registration. The Data Privacy Act of 2012 gives the National Privacy Commission authority over personal information controllers and processors, some of which must register their data processing systems and data protection officer.
• Payment methods. E-wallets and direct bank transfers sit alongside cards at many Philippine checkouts, and each integration has its own settlement and dispute process.
• Electronic invoicing. The Bureau of Internal Revenue's Electronic Invoicing System rules apply first to larger taxpayers, with a defined technical format for invoice data.
• Support-hour overlap. A helpdesk serving Philippine customers needs a rostering plan, not just a translated script, if it is staffed from another time zone.

Scoping all four as one "localisation" line item hides the registration and invoicing work behind the parts of the brief that read as pure engineering.

Does your organisation need to register with the National Privacy Commission?

The National Privacy Commission's own guidance sets out which personal information controllers and processors must register their data processing systems, their data protection officer, and any automated decision-making, rather than requiring every organisation to do so regardless of size or activity. The registration itself, and the certificate that follows it, belongs to your organisation, not to a supplier building on your behalf.

That distinction shapes a proposal. A supplier can build the account model, the consent records and the data subject request workflow a registration decision requires, but who holds the registration, appoints the data protection officer and answers the Commission's questions should be settled with your advisers before development starts, not discovered at launch.

The nearest published record for this kind of store

The web-to-print stores in four countries record is the closest published example of a comparable build: online storefronts with a design tool that Netbase built for print businesses in Singapore, France, the Netherlands and South Korea. The South Korean store puts three different product types, banners, logos and book covers, behind one design tool, which is the same kind of configuration challenge a catalogue-plus-personalisation build usually raises wherever it launches.

Custom Product Engineering scopes that kind of build for the Philippines in the same way: a catalogue, an account and order system, and a configuration layer in front of checkout, with the privacy, payment and invoicing decisions above added as their own tasks.

How do you decide which payment methods to support?

Treat each method as its own integration with its own settlement and dispute path, not a single "payments" task.

Our guide to data security and compliance in outsourcing lists the contract questions that sit around who can see payment and personal data once these integrations are live.

Worked scenario: a support ticket that crosses two time zones

A Philippine online retailer's support desk is staffed partly from a remote delivery team. A customer reports a failed e-wallet payment late in the Manila afternoon.

The scenario shows why a rostering plan matters as much as translated scripts: the ticket needed an engineering check that had to happen inside a shift that overlaps with Manila hours, not after it.

Which questions should you ask a supplier?

• Who holds our National Privacy Commission registration and data protection officer role? It should be your organisation, with the supplier building what that role requires.
• How do you reconcile e-wallet, bank transfer and card settlements against our orders? Expect a named process for each method, not one generic answer.
• Are you ready for Bureau of Internal Revenue e-invoicing if we become a covered taxpayer? Look for an invoice data model that can add structured transmission without a rebuild.
• How do support shifts overlap with Manila hours? Expect a named roster, not a promise to "cover the time zone".
• What happens when e-invoicing transmission fails? Look for a designed fallback that does not block a sale.
• Where is customer and payment data stored, and who can see it? Expect one written answer, not a description scattered across several systems.

What usually goes wrong?

• Privacy registration confused with a technical setting. Signal: nobody outside engineering knows the organisation's registration status. Owner: the business sponsor.
• Only one payment method tested end to end. Signal: e-wallet failures are unhandled because only card payments were tested. Owner: the product owner.
• Invoice data modelled after the fact. Signal: adding structured e-invoicing later means reworking the billing system. Owner: engineering, with the tax adviser involved early.
• Support coverage assumed rather than rostered. Signal: tickets wait overnight for an engineering check that never had an overlapping shift. Owner: the operations lead.

How this guide is sourced and where it stops

This guide uses the National Privacy Commission's Data Privacy Act page and its guidance on registering data processing systems, and the Bureau of Internal Revenue's digest of Revenue Regulations No. 11-2025 on electronic invoicing, all accessed on 2026-09-29, alongside a Netbase delivery record approved in the OutsourcingVN claim register. It is written for founders, product and operations leads preparing a brief. It does not decide your organisation's registration or taxpayer status; those conclusions belong to your advisers. Netbase JSC's head office is in Hanoi, Vietnam, and it is the company's only office, so Philippines-facing projects are delivered remotely, with delivery communication in English.

Plan the first phase

Bring your registration decision, your payment-method shortlist, your invoicing timeline and the names of your legal, finance and support owners. The customer support automation solution shows how a support desk can hand off routine tickets while keeping the overlap windows above staffed, and our page on time-zone collaboration from Vietnam explains how the overlap with Manila hours is planned. The total software delivery cost worksheet helps you compare proposals line by line, and the methodology page explains how the records on this page are sourced. For other markets, the Indonesia guide covers a neighbouring data-privacy and payments regime, and the Singapore guide covers phased redevelopment and identity data.

Custom Product Engineering is the service for a bounded build, and global delivery explains how remote delivery is organised. OutsourcingVN is Netbase's own outsourcing-services platform: submit a project with your registration and payment decisions, and a person will reply with whether discovery or a bounded implementation is the right next step.

Related services and solutions