Philippine SMBs on Freshchat face RA 10173 Data Privacy Act, NPC, BSP InstaPay/PESONet/QR Ph, BIR e-invoicing, GCash/Maya. Real 2026 stack.
Before comparing features, a Philippine SMB owner in Metro Manila, Cebu, Davao, Iloilo or a provincial capital asks five compliance-plus-fit questions when selecting a messaging platform:
1. RA 10173 Data Privacy Act 2012 lawful basis and DPO channel. Does the platform let the SMB display Data Protection Officer contact details (required under Section 26 for controllers processing personal information above set thresholds — recommended for all)? Is there a documented consent capture flow under Section 12 for regular personal information and Section 13 for sensitive personal information (health, sexual life, government IDs, financial account details)? Is there a workflow for the 72-hour breach notification to NPC under Section 22 when a breach likely poses real risk of serious harm?
2. BSP-compliant payment layer with InstaPay, PESONet, QR Ph. Does the platform generate QR Ph dynamic code (national EMVCo-based standard operational since 2019) accepted interoperably across GCash, Maya and banks? Does it support InstaPay for real-time transfers below PHP 50,000 and PESONet for batch higher-value transfers? Does it integrate with GCash for Business, Maya Merchant, or a payment aggregator (PayMongo, Xendit Philippines, DragonPay)?
3. BIR e-invoicing under Revenue Regulations 8-2022 / 6-2023. For taxpayers within the phased rollout scope (top 100 large taxpayers effective July 2022 under Revenue Regulations 8-2022, e-commerce and export enterprises added by Revenue Regulations 6-2023, other categories to follow), does the software integrate with BIR's Electronic Invoicing/Receipting System (EIS) and Electronic Sales Reporting System (ESRS)? BIR e-invoicing uses XML format submitted to BIR portal near-real time.
4. Consumer Act RA 7394 and Internet Transactions Act RA 11967 compliance. Does the platform allow SMBs to display the mandated information under RA 11967 (Internet Transactions Act signed December 2023, implementing rules 2024): business identity, complaint mechanism, refund and delivery policy, consumer rights? Does the workflow route complaints to a human for DTI-required response timelines?
5. Filipino/English language handling and Metro Manila business-hours support. Are templates supported in English (primary business language) and Filipino/Tagalog (customer-facing preferred in many segments)? Does the BSP support Bisaya/Cebuano for Visayan markets? Is customer support available in Philippine Standard Time business hours (UTC+8)?
Freshchat is a product of Freshworks Inc. (San Mateo, California, Nasdaq FRSH since IPO September 2021), with significant engineering and support operations in Chennai, Bengaluru and other Indian cities. The Freshchat product line sits alongside Freshdesk (support tickets), Freshsales (CRM) and Freshservice (IT service management) in the broader Freshworks portfolio.
What Freshchat offers:
* Omnichannel inbox — WhatsApp Business Platform (via Meta-authorised BSP arrangement), Instagram Direct, Facebook Messenger, LINE, Apple Business Chat, web chat, email inbox, and integration with Freshdesk tickets.
* Visual bot builder (Freddy AI bot) — no-code chatbot flows with intent recognition and handoff to human.
* Agent productivity — canned responses, macros, agent collision detection, private notes.
* Reports — response time, resolution time, agent load, customer satisfaction (CSAT).
* Integration — CRM (Salesforce, HubSpot, Zoho), Freshsales, Freshdesk, Shopify, WooCommerce, custom via API.
Freshchat pricing 2026 (subject to Freshworks changes — check freshworks.com/live-chat-software/pricing):
* Growth plan approximately US$29/agent/month billed annually.
* Pro plan approximately US$59/agent/month.
* Enterprise plan approximately US$95/agent/month.
* WhatsApp Business Platform + conversation costs charged in addition per Meta pricing.
* USD billing (though Freshworks may offer PHP invoicing via regional partners).
Where Freshchat's Philippine fit is weakest:
* RA 10173 explicit references. DPA templates are built primarily around GDPR and (increasingly) India's DPDP Act; explicit Philippine RA 10173 references, NPC Circular alignment and 72-hour breach notification workflow to NPC are not native and may require custom addendum.
* BIR e-invoicing integration. No native integration with BIR EIS/ESRS. If the SMB is within Revenue Regulations 8-2022/6-2023 scope, invoicing needs a separate BIR-registered solution.
* QR Ph, GCash for Business, Maya Merchant. No native integration; payment link requires Zapier + a Philippine aggregator (PayMongo, Xendit PH, DragonPay).
* Filipino/Tagalog UI. Freshchat interface is primarily English. Templates for customer-facing messages can be written in Filipino, but the admin interface remains English.
* Currency and billing. USD-quoted subscription pricing creates budgeting variability with peso volatility; local invoicing depends on regional partner arrangement.
Republic Act No. 10173 — Data Privacy Act of 2012 was enacted August 15, 2012 as the Philippines' comprehensive personal data protection law. The National Privacy Commission (NPC, privacy.gov.ph) is the regulator, operational since 2016. Highlights for a Philippine SMB running WhatsApp/messaging automation:
Section 3 definitions. Personal information = any information from which the identity of an individual is apparent or can reasonably and directly be ascertained. Sensitive personal information = information about race, ethnic origin, marital status, age, colour, religious/political affiliation, health, education, genetic/sexual life, offences, government-issued IDs, financial account details.
Section 4 scope. Applies to processing of personal information by natural or juridical persons in the Philippines, and outside the Philippines where the processing involves Philippine citizens' or residents' PII.
Section 11 general data privacy principles. Transparency, legitimate purpose, proportionality.
Section 12 lawful processing of personal information. Requires one of six grounds: (a) data subject consent; (b) necessary for a contract; (c) legal obligation; (d) protecting vital interests; (e) response to national emergency or public order and safety; (f) legitimate interests pursued by the controller.
Section 13 processing of sensitive personal information. Stricter grounds: (a) consent specifically for a specified purpose; (b) provided by law or regulation; (c) protecting life and health; (d) achieved by NGO/foundation of political, philosophical or religious ends within legitimate purpose; (e) necessary for medical treatment carried out by medical professional; (f) necessary for legal claims.
Section 20 security of personal information. Personal Information Controller (PIC) must implement reasonable and appropriate organisational, physical and technical measures as detailed in NPC Circular 16-01 (Security of Personal Data in Government Agencies) and NPC's guidance for private sector.
Section 22 notification requirement. PIC shall promptly notify the Commission and affected data subjects when sensitive personal information or other information likely to enable identity fraud has been acquired by an unauthorised person, and the PIC believes such unauthorised acquisition is likely to give rise to a real risk of serious harm. NPC Circular 16-03 specifies 72 hours from knowledge of the breach as the notification window.
Section 26 accountability. Appointment of a Data Protection Officer (DPO) required for entities processing personal information above set thresholds under NPC Circular 17-01 (recommended for all controllers). DPO responsibilities include monitoring compliance, providing advice on DPIA, being contact person for NPC and data subjects.
Sections 25-34 penalties. Escalating fines up to PHP 5,000,000 plus imprisonment up to 6 years for grave offences such as unauthorised processing of sensitive personal information, malicious disclosure, unauthorised access due to negligence. Additionally NPC can issue administrative fines and orders including cease and desist, ban on processing.
Key NPC Circulars. NPC Circular 16-01 security; NPC Circular 16-03 breach management; NPC Circular 17-01 DPO; NPC Circular 18-02 rules of procedure; NPC Advisory 2017-01 on cross-border transfer requiring adequate protection or contractual safeguards; NPC Advisory Opinions 2020-2024 series with sector-specific guidance including e-commerce and messaging platforms.
RA 11967 Internet Transactions Act 2023 signed December 2023 adds e-commerce-specific consumer protection obligations including transparency of business identity, mandatory complaint mechanisms, refund and delivery timelines. Implementing rules were issued 2024. DTI as regulator; overlaps with NPC on data aspects of e-commerce.
The Bangko Sentral ng Pilipinas (BSP, bsp.gov.ph) is the regulator of payment systems under Republic Act 7653 New Central Bank Act (as amended by RA 11211 in 2019) and the National Payment Systems Act (Republic Act 11127, 2018). The National Retail Payment System (NRPS) framework launched 2015 defines the operational structure.
InstaPay. Real-time low-value electronic funds transfer service launched April 2018. Transaction limit PHP 50,000 per transaction; participants include most commercial banks, e-money issuers (GCash, Maya), and rural banks. 24/7 real-time settlement.
PESONet. Batch electronic funds transfer service (evolved from the older MDS-BATCH system) launched November 2017. Higher values, batch processing (typically same business day for batches submitted before cut-off). Used for salary payroll, supplier payments, business-to-business.
QR Ph. National EMVCo-based interoperable QR code standard operational since November 2019 (Person-to-Merchant, P2M) with Person-to-Person (P2P) added 2021. Any QR Ph-compliant merchant can accept payments from any QR Ph-compliant consumer app (GCash, Maya, bank apps, DragonPay, PayMongo). MDR (Merchant Discount Rate) commonly zero or subsidised for micro-merchants; typical fee 1-2% for small merchants via aggregators.
BSP Circular 649 original e-money issuers framework, superseded and elaborated by BSP Circular 1122 (2021) on Electronic Money Issuers (EMI) licensing and consumer protection.
BSP Circular 1153 (2022) on Virtual Asset Service Providers (VASP) licensing, relevant to crypto-integrated platforms like Coins.ph.
Dominant consumer wallets:
* GCash (operated by Mynt, joint venture of Globe Telecom + Ant Group + others). Approximately 90 million registered users in the Philippines per Mynt disclosures, dominant mobile wallet. GCash for Business provides QR Ph acceptance, PESONet disbursement, and API integration.
* Maya (formerly PayMaya, rebranded 2022; operated by Maya Innovations/Voyager Innovations, majority owned by PLDT group). Similar consumer wallet + Maya Merchant + Maya Business.
* Coins.ph (crypto-first with fiat integration; acquired by Wormhole/Gojek in 2022, various ownership shifts).
* PayPal Philippines — international wallet with peso integration.
* LinkAja PH, ShopeePay PH, Lazada Wallet — smaller share.
Payment gateway aggregators (Philippines-focused):
* PayMongo (Manila, YC S19 backed, EMI-licensed via partnership) — cards + GCash + Maya + QR Ph + PayPal + GrabPay + billing.
* Xendit Philippines (Indonesian-founded, Philippine operations) — cards + wallets + QR Ph + PESONet.
* DragonPay (long-established Philippine gateway) — cards + over-the-counter bank + convenience store.
* Multisys, PayPal PH, Adyen PH, Stripe PH — other options for card acquiring.
The Bureau of Internal Revenue (BIR, bir.gov.ph) administers national taxes including value-added tax (VAT), income tax, and percentage tax. Framework under Republic Act 8424 National Internal Revenue Code of 1997 as amended by the TRAIN Act (Republic Act 10963, 2018) and CREATE Act (RA 11534, 2021).
VAT — 12% standard rate on sale of goods, services, and importation. VAT threshold for mandatory registration is PHP 3,000,000 gross annual sales/receipts. Below the threshold, taxpayer may opt for percentage tax at 3% on gross receipts (reduced from 3% to 1% between July 2020 and June 2023 under CREATE Act, back to 3% since July 2023).
8% flat income tax option. Self-employed individuals and professionals with gross sales/receipts up to PHP 3M may opt for 8% flat tax on gross sales in lieu of graduated income tax and percentage tax combined. Election exercised in first quarterly return.
TIN (Taxpayer Identification Number). Mandatory for any person or entity earning income in the Philippines. Registration via BIR RDO (Revenue District Office) or ORUS (Online Registration and Update System).
BIR Certificate of Registration (COR, BIR Form 2303). Issued upon TIN registration; identifies tax types, filing obligations. Required to be displayed at place of business.
e-Invoicing rollout under Revenue Regulations 8-2022 (effective July 2022 for top 100 large taxpayers). Uses BIR Electronic Invoicing/Receipting System (EIS) — invoices and receipts issued in XML format, submitted to BIR near-real-time with unique reference numbers. Extended progressively:
* Revenue Regulations 6-2023 — added e-commerce enterprises, exporters, taxpayers previously classified as top withholding agents.
* Ongoing extensions — BIR plans phased inclusion of smaller taxpayers through subsequent regulations.
Electronic Sales Reporting System (ESRS) complements EIS for reporting sales data.
BIR-registered accounting/invoicing software. BIR maintains a list of accredited invoicing software providers. For Philippine SMBs common options include:
* Xero Philippines localised
* QuickBooks Philippines
* Fresco / Freshbooks
* Zoho Books Philippines
* JuanTax (Philippine-native cloud tax filing)
* Taxumo (Philippine-native)
* RTOplus
* SAP Business One Philippines with EIS module
* Odoo Philippines with EIS module
* Bind ERP (Philippine localisation)
Consequences of e-invoicing non-compliance. Once within scope, failure to comply attracts BIR penalties including surcharge, interest, and compromise penalties per RR 5-2000 as amended. Repeated non-compliance can lead to closure orders under the Oplan Kandado programme.
Beyond privacy and payments, a Philippine SMB operating a messaging channel is subject to consumer-protection framework administered by the Department of Trade and Industry (DTI) and increasingly by NPC and DTI jointly.
Republic Act 7394 Consumer Act of the Philippines (1992). Long-standing consumer-rights framework covering product quality, safety, fair packaging, credit transactions, and deceptive/unfair/unconscionable sales acts. Enforced by DTI's Fair Trade Enforcement Bureau (FTEB) for most product/service categories, with DOH for health-related, DA for agricultural, and other sector-specific regulators.
Republic Act 11967 Internet Transactions Act 2023 signed December 2023, implementing rules 2024. Key provisions:
* Chapter III — Rights of e-commerce consumers. Right to clear pre-transaction information, right to complain, right to cancel/return with clear policy, right to redress.
* Chapter IV — E-marketplace operator responsibilities. Verify seller identity, provide complaint mechanism, cooperate with DTI on complaints, mandatory display of business identity, return/refund policy, delivery timelines.
* Chapter V — Online merchant obligations. Similar to Consumer Protection E-Commerce Rules 2020 in India: legal identity, GSTIN-equivalent tax registration display, product information accuracy, complaint mechanism.
* DTI as primary regulator with power to issue takedown orders, blacklist non-compliant merchants, coordinate with e-marketplace operators.
E-Commerce Act 2000 (RA 8792) — earlier framework providing legal recognition of electronic documents and signatures; still in force for digital-signature validity.
DPA/RA 10173 overlap. WhatsApp marketing messages to consumers require consent under Section 12 RA 10173 and Section 13 for sensitive information categories. Repeated unsolicited marketing (spam) can attract NPC complaints and DTI complaints under both frameworks.
Sector-specific regulators:
* SEC (Securities and Exchange Commission) — for corporations; SMB registration via DTI (sole proprietorship) or SEC (corporation/partnership).
* BOI (Board of Investments) — investment incentives.
* DOF (Department of Finance) — parent of BIR.
* DICT (Department of Information and Communications Technology) — infrastructure and cybersecurity.
* NTC (National Telecommunications Commission) — telecom operators and SMS/voice regulation.
Alternatives to Freshchat for a Philippine SMB, organised by regional presence and specialisation:
Regional/ASEAN presence:
International BSPs active in Philippines:
Payment gateway integrations (complementary to any BSP):
Meta pricing for Philippines 2026. Per Meta public pricing (business.whatsapp.com/products/business-platform/pricing), Philippines is one of the higher-cost markets at approximately US$0.0783 per marketing conversation and around US$0.0203 per utility conversation on the 24-hour window. Utility templates (order confirmation, appointment reminder, e-invoice delivery, GCash payment link) are priced lower than marketing. Service conversations initiated by customer typically have $0 cost under Meta's current pricing model.
Combining the layers above, the messaging stack a Philippine SMB can defend before NPC, BSP, BIR and DTI in 2026:
1. WhatsApp Business Platform via a BSP with Philippine or ASEAN operations and DPA referencing RA 10173. Preference for Sanuker, Sleekflow, Botmaker or Sprout Solutions Philippines integrations — regional presence, NPC-adjacent practices, familiar with 72-hour breach notification. International BSPs (Wati Hong Kong, Respond.io Malaysia, Kommo US/UK) require cross-border transfer clauses under NPC Advisory 2017-01 and can generate NPC audit friction.
2. Meta-approved templates reviewed under RA 10173 consent + RA 11967 Internet Transactions Act + RA 7394 Consumer Act. Utility templates (order confirmation, appointment reminder, e-invoice delivery, GCash/QR Ph payment link) are the majority and Meta-priced lower. Marketing templates require Section 12 or Section 13 (sensitive) consent under RA 10173 and cannot violate consumer-protection rules on transparency or unfair/deceptive practices.
3. BIR-registered e-invoicing software integrated with EIS and ESRS for taxpayers within Revenue Regulations 8-2022/6-2023 scope. Xero Philippines, QuickBooks Philippines, Zoho Books Philippines, JuanTax, Taxumo, RTOplus, SAP Business One Philippines with EIS module, Odoo Philippines with EIS module, or Bind ERP. Software generates XML e-invoice with unique reference number, submits to BIR EIS near-real-time. VAT returns filed via eFPS (Electronic Filing and Payment System) or eBIRForms.
4. Payment in the chat via QR Ph dynamic + GCash/Maya + PayMongo/Xendit/DragonPay + PESONet fallback. QR Ph dynamic code from GCash for Business, Maya Merchant, or aggregator (PayMongo/Xendit PH/DragonPay). PESONet for larger amounts. Card acquiring via aggregator. Settlement callback triggers e-invoice generation for taxpayers within EIS scope.
5. Written internal policy on what is NOT automated. Grievance escalation to NPC or DTI → always human with DPO or authorised officer. Discussion of sensitive personal information under Section 13 RA 10173 → always human. Medical, legal, financial advice → always the appropriate licensed professional (PRC-registered). Complaint under RA 11967 Internet Transactions Act → human with response within DTI-mandated timelines.
Five documents that separate a compliant Philippine SMB from those without an audit trail:
For a small Philippine SMB (single proprietor, less than PHP 3M gross annual sales, below VAT threshold, below EIS scope), free WhatsApp Business app (Meta) + GCash for Business direct QR + Taxumo or JuanTax for 8% flat-tax filing covers most needs. A paid BSP platform (Sanuker, Sleekflow, Wati, BossBot, Kommo — approximately US$29-$99/month) justifies itself for SMBs with 3+ agents, VAT-registered status, larger customer volume, or e-commerce operation subject to RA 11967 requirements.
Data + numbers referenced in this article are sourced from these public documents:
Multichannel WhatsApp + Telegram + Viber. 7-day free trial, no credit card. Peso-friendly via regional partners.
Start Free TrialNot ready to sign up yet? Try the free demo →