You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

March 17, 2025

DNA: Data Protection and Cybersecurity Regulation in Southeast Asia

Tilleke & Gibbins has contributed the Cambodia, Myanmar, Thailand, and Vietnam chapters to Data Protection and Cybersecurity Regulation in Southeast Asia, a wide-ranging guide published by Drew Network Asia (DNA). The resource provides a comprehensive overview of data protection and cybersecurity laws across the region, offering practical insight into compliance requirements and regulatory developments affecting organizations that handle personal data or operate digital services in Southeast Asia.

The guide begins with a regional overview, including the broader ASEAN context and cooperation initiatives. Jurisdiction-specific chapters follow a consistent structure—covering data privacy and governance obligations, security requirements and breach notification, outsourcing and cross-border data transfers, and broader accountability and compliance measures. This format allows readers to compare regulatory approaches across markets such as Brunei, Indonesia, Malaysia, the Philippines, Singapore, and others.

In addition to the country chapters, the publication addresses cybersecurity and privacy engineering challenges, providing guidance for organizations and outlining obligations applicable to data controllers, processors, and intermediaries. A dedicated section on data breach management across ASEAN examines notification requirements, response considerations, and practical steps for managing incidents in a regional or global context.

The guide is intended to serve as a practical reference, and the authors note that specific legal requirements may vary depending on sector, processing activity, or evolving legislation. Readers seeking more detailed advice can contact the practitioners listed in each chapter.

The full guide is available for download using the button below or directly from the DNA website.

RELATED INSIGHTS​ 

March 8, 2022
On February 15, 2022, Thailand’s cabinet approved in principle a package of incentives to promote electric vehicle (EV) adoption in Thailand, with the aim of making the country an EV manufacturing hub in Asia. A week later, the cabinet approved further draft regulations including specific information on customs duty reductions and exemptions for certain types of imported EVs. The plan includes both tax and non-tax incentives from 2022 until 2025. In the first two years (2022–2023), the package incentivizes the widespread use of EVs in Thailand by providing exemption or reduction of import duties and excise tax, as well as subsidies to increase the demand for EVs and attract investment in the EV industry. These incentives will cover the importation of completely built up (CBU) cars and motorcycles, and the local manufacturing of completely knocked down (CKD) vehicles in Thailand. For the following two years (2024–2025), the plan promotes the use of domestically produced EVs by eliminating the exemption or reduction of import duties for CBU vehicles while maintaining the other incentives (e.g., reduced excise tax rates, and subsidies). The aim of this is to make the cost of CBU vehicles higher than locally produced vehicles to encourage operators to produce EVs in the country to meet increasing demand. Additional measures encourage the manufacturing of EVs in Thailand, including exemption of import duties for parts imported between 2022 and 2025, and treatment of the value of imported battery cells as a cost of local manufacturing (up to 15% of an EV’s retail price). This is beneficial to local manufacturers of EVs, as their activities will be entitled to a more generous incentive package than importation of EVs. At their meeting on February 22, 2022, Thailand’s cabinet further approved draft subordinate regulations, including specific reductions and exemptions of customs duty
February 21, 2022
On February 14, 2022, Thailand’s Securities and Exchange Commission (SEC) announced a public hearing period on proposed advertising regulations for digital asset businesses. The public hearing period is now open for general comments until March 15, 2022. In the announcement, the SEC expressed their intention to provide clear digital asset advertising principles that conform to regulations in other countries, such as Singapore, the UK, and Japan. The SEC, in a meeting on February 3, agreed that the principles to be developed should apply to all digital asset businesses operating in Thailand. During the public hearing period, any interested parties may comment on the SEC’s proposed principles, which include the following key points: Advertisements that educate, inform, or give facts about digital assets, investments or services, or that provide an overall picture of digital assets, must not exaggerate, distort, or conceal information, or otherwise mislead consumers. In addition, advertisements that refer to customer numbers must only indicate the number of customers who have received approval to open an account and who are ready to use the service. Advertisements must be clear and appropriate, provide a warning on investment risks, and include clear and noticeable SEC-mandated statements in the font size stipulated by the SEC. Advertisements that present positive information or suggest an opportunity to receive returns must provide a balanced view that also discloses negative information or states investment risks. Advertisements relating to cryptocurrencies can only be made via a business operator’s official channels (e.g., the operator’s website, app, or other official online channel), and cryptocurrency cannot be advertised in public areas (e.g., billboards, public transportation, websites, newspapers and periodicals, etc.). However, advertisements for the services of a digital assets business can still be made in public areas and other channels. For example, this can be understood as meaning that
February 15, 2022
The sale of counterfeit goods online is as damaging to government efforts and consumer safety as it is to the reputation of the e-commerce platforms and brand owners involved. In this guest piece, Andy Chua, senior vice president of the IP Rights Protection Team at e-commerce giant Lazada, joins Tilleke & Gibbins’ Suebsiri Taweepon and Ploynapa Julagasigorn to discuss how stakeholders can work together to combat the growing threat of counterfeits online – with recent efforts in Thailand a prime example of effective action. This article, which was first published in World Trademark Review, is the second in a two-part series about trademark enforcement against online counterfeits.   Technological developments, government policy and the covid-19 pandemic have brought about significant changes to the lifestyle and behaviour of ordinary consumers. Shopping increasingly takes place on e-commerce platforms as people become more familiar with online transactions, encouraging many sellers to turn their focus to online platforms. While this shift to online retail has brought benefits for many, it has also provided additional ways for sellers of counterfeit goods to peddle their wares. The sale of counterfeit goods online tarnishes the reputation of e-commerce platforms among users, compromises consumer trust in brand owners’ products and undermines public authorities’ efforts in enforcing anti-counterfeiting policies. This dynamic problem cannot be resolved by a single entity alone. Instead, all stakeholders need to work together to amplify their efforts in consumer and brand protection. Collaborating against counterfeits in Thailand We see such collaborations between stakeholders in regions such as Thailand, where the Department of Intellectual Property (DIP) has signed a memorandum of understanding (MOU) with various parties that are committed to combatting the spread of counterfeit products online. The inaugural signing ceremony for the MOU was held on 11 January 2021, with 20 initial signatories drawn