On July 30, 2025, Myanmar’s Cybersecurity Law No. 1/2025 came into effect with the State Administration Council’s issuance of Notification 113/2025. The law, which was enacted on January 1, 2025, aims to regulate various aspects of digital security and online activities. Below are some key provisions, implications, and penalties under the Cybersecurity Law. Extraterritorial penalties. The law contains an important provision that authorizes penalties against Myanmar citizens who are found guilty of violations, even if these occur outside the country’s borders. VPN definition and regulation. Virtual private networks (VPNs) are defined by this law as specific systems that function as backup networks by using technological means in order to ensure the safety of linking networks to each other. This definition sets the framework for subsequent regulations and penalties associated with VPN usage. The law does not restrict individuals or entities from using VPNs; it regulates VPN service providers. Penalties for unapproved VPN services. Establishing a VPN or providing VPN services without approval from the designated ministry (to be appointed later by the government) can result in significant penalties. For individuals, the punishment may be imprisonment for 1–6 months, a fine of MMK 1–10 million (approx. USD 476–4,760), or both, with the proceeds of the violation being confiscated. If the violator is a company or organization, the minimum fine will be MMK 10 million, and the proceeds will be confiscated. Government oversight. The ministry designated by the government is authorized to investigate and take control of cybersecurity services and digital platform services for national defense and security purposes, or upon request from a government department or organization in accordance with respective laws. Licensing requirements. The Cybersecurity Law introduces two types of licenses, valid for a period of 3–10 years, for (1) cybersecurity services and (2) digital platform providers. Digital platforms with

Tilleke & Gibbins has contributed the Vietnam chapter to Corporate Governance 2025, part of the International Comparative Legal Guides (ICLG) series published by Global Legal Group. This respected guide offers comprehensive, jurisdiction-specific overviews of corporate governance laws and practices around the world. Each jurisdictional chapter follows a clear Q&A format, providing practical insights into critical issues such as: Sources of corporate governance regulation Shareholders’ rights, powers, and responsibilities Structure and duties of management bodies Stakeholder involvement in governance Transparency and reporting requirements ESG and sustainability-related obligations Cybersecurity and technology-related disclosures The Vietnam chapter was authored by Tram Ngoc Bich Nguyen, Truc Thi Thanh Tran, Dung Thi Phuong Le, and Quang Minh Vu, members of Tilleke & Gibbins’ corporate and commercial team in Ho Chi Minh City. The authors provide detailed analysis of Vietnam’s corporate governance framework, including recent developments such as the 2025 amendments to the Law on Enterprises requiring disclosure of ultimate beneficial ownership and the increasing emphasis on sustainable business practices and responsible corporate conduct. The chapter also discusses practical considerations for foreign investors in Vietnam, such as overlapping signing authorities between key company officers, enforcement of shareholders’ agreements, and disclosure obligations related to ownership and management roles. The complete Vietnam chapter is available as a PDF below. The Vietnam chapter—and the full Corporate Governance 2025 guide—are also freely available on the ICLG website.

On July 21, 2025, Thailand’s National Cyber Security Agency (NCSA) released a draft amendment to the Cybersecurity Act B.E. 2562 (2019) for public hearing, aiming to address the rapid evolution of technology and increasing complexity of cyber threats. The proposed changes to the country’s cybersecurity framework would extend regulatory oversight to cloud service providers and data center operators hosting data for critical information infrastructure (CII) organizations regulated under the Cybersecurity Act. The NCSA will accept comments on the draft until August 5, 2025. Following the close of the public consultation period, the draft amendment will be subject to further revision during the legislative process. Key proposed amendments are discussed below. Expanded Critical Infrastructure Scope The Cybersecurity Act currently applies only to state agencies, supervising or regulating organizations, and designated CII organizations as announced by the National Cyber Security Committee (NCSC). It defines CII organizations as public or private organizations related to or providing national security, significant public services, banking and finance, information technologies, telecommunications, transportation and logistics, energy and public utilities, or public health. The draft amendment expands the scope of CII organizations to include public and private organizations related to or providing industrial work (to be further defined in subregulations) as well as service providers that store or possess data for CII organizations, such as cloud and data center service providers. CII organizations must comply with cyber threat reporting requirements and are subject to the NCSA’s interception powers. Updated Definitions and New Terminology The draft amendment more clearly distinguishes between “cyber threats” (which have yet to occur but have the potential of causing damage or impact) and “cyber incidents” (which have already occurred and have caused or are expected to cause damage or impact). The draft amendment also expands the definition of “cybersecurity” to explicitly cover both prevention

The Madrid System for international trademark registration provides the opportunity for a simplified and cost-effective way to register trademarks in multiple countries through a single application. Indonesia joined the Madrid System in 2018, and in 2024 alone, it received over 8,600 applications through this system. Despite the system’s effectiveness, it is important for trademark owners to be aware of the potential risks of refusal that can arise during the process of registration. Trademark applicants must pay close attention to these critical points when designating Indonesia. Appointing a Local Representative to Respond An applicant or representative of an international registration (IR) application that has been provisionally refused must appoint a local Indonesian representative in order to submit a response to the provisional refusal. This appointment is solely for the purpose of responding to the refusal in Indonesia; it is not necessary if the IR has not received any rejection. Furthermore, the local representative should not be registered with WIPO, as doing so would affect representation across all designated countries. Timing When it comes to calculating the deadline for responding to a provisional refusal, there is a discrepancy between the methods used by the DGIP and WIPO. Under the Indonesian Trademark Law, trademark owners can file a response within 30 working days, excluding weekends and national holidays. However, the WIPO cover letter accompanying the DGIP’s provisional refusal notice specifies both the start date and the deadline for responding to the notification, which is calculated as 30 calendar days, including weekends and national holidays. Therefore, a response to the provisional refusal of IR should be submitted in accordance with the WIPO cover letter to prevent any formality issue. Grounds for Refusal After an IR application is published in Indonesia’s Trademark Gazette, it undergoes substantive examination by the Directorate General of Intellectual Property (DGIP) examiners. The