You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

March 17, 2025

DNA: Data Protection and Cybersecurity Regulation in Southeast Asia

Tilleke & Gibbins has contributed the Cambodia, Myanmar, Thailand, and Vietnam chapters to Data Protection and Cybersecurity Regulation in Southeast Asia, a wide-ranging guide published by Drew Network Asia (DNA). The resource provides a comprehensive overview of data protection and cybersecurity laws across the region, offering practical insight into compliance requirements and regulatory developments affecting organizations that handle personal data or operate digital services in Southeast Asia.

The guide begins with a regional overview, including the broader ASEAN context and cooperation initiatives. Jurisdiction-specific chapters follow a consistent structure—covering data privacy and governance obligations, security requirements and breach notification, outsourcing and cross-border data transfers, and broader accountability and compliance measures. This format allows readers to compare regulatory approaches across markets such as Brunei, Indonesia, Malaysia, the Philippines, Singapore, and others.

In addition to the country chapters, the publication addresses cybersecurity and privacy engineering challenges, providing guidance for organizations and outlining obligations applicable to data controllers, processors, and intermediaries. A dedicated section on data breach management across ASEAN examines notification requirements, response considerations, and practical steps for managing incidents in a regional or global context.

The guide is intended to serve as a practical reference, and the authors note that specific legal requirements may vary depending on sector, processing activity, or evolving legislation. Readers seeking more detailed advice can contact the practitioners listed in each chapter.

The full guide is available for download using the button below or directly from the DNA website.

RELATED INSIGHTS​ 

January 19, 2022
Thailand has completed the establishment of the Personal Data Protection Commission (PDPC), the regulator under the country’s Personal Data Protection Act B.E. 2562 (PDPA), strongly indicating that the planned full enforcement of the PDPA on June 1, 2022, is likely to proceed as scheduled. The establishment of the PDPC was finalized on January 18, 2022, when the Announcement of the Prime Minister’s Office on the Appointment of Chairperson and Honorary Members of the PDPC was published in the Government Gazette. As stipulated in the PDPA, the PDPC consists of: The chairperson, appointed based on knowledge, skills, and experience; The vice-chairperson, who is the permanent secretary of the Ministry of Digital Economy and Society; Five commission members, designated based on their positions in certain government agencies (as prescribed under the PDPA); and Nine honorary commission members appointed based on knowledge, skills, and experience in personal data protection, consumer protection, technology and telecommunication, social science, law, health, finance, or other relevant fields. As the vice-chairperson and the five commission members are appointed to the PDPC based on their positions, the January 18 announcement appointing the chairperson and the nine honorary commission members completes the formation of the PDPC. The full enforcement of the PDPA has been previously postponed, and many businesses had expressed concern that another extension would be forthcoming before the current enforcement date. However, the successful establishment of the PDPC is a fundamental prerequisite to enforcement and indicates that the effective date of the PDPA on June 1, 2022, is unlikely to be further postponed. In addition, the PDPA’s draft subordinate regulations that were the subject of a series of public hearings last year are likely to be issued in the near future. Companies and other organizations that are not yet compliant with the PDPA should now assess their
January 12, 2022
Thailand’s Board of Investment (BOI) recently published BOI Notification No. Sor. 8/2564, which extends the scope of investment promotion covering electronic vehicle (EV) industry manufacturers to include the production of “automotive platforms” for electric vehicles, and creates a new category of BOI promoted activities covering the manufacture of electric bicycles (E-bikes). Automotive Platforms The following investment promotion categories have been extended: 4.24 – Manufacture of Battery Electric Vehicles 4.26 – Manufacture of Electric Battery Tricycles 4.27 – Manufacture of Electric Battery Busses and Trucks These categories now include the manufacture of “automotive platforms”—which must include an energy storage system, charging module, and front and rear axle module—benefiting from similar tax incentives and subject to additional conditions, as detailed below. New BOI Promotional Category for E-Bike Production The BOI has also introduced a new category, No. 4.28, covering the manufacture of E-bikes. Projects under this category will be eligible for a three-year CIT exemption with an additional one-year exemption if certain criteria are met. Applications for this category must cover the manufacture of E-bikes, the manufacture or sourcing of electric batteries, and a management plan for used batteries. In addition to the general conditions for EV projects (industrial standards, manufacturing timelines, etc.), the BOI has also imposed the following conditions specific to E-bike projects: E-bike frames must be produced from light-weight materials such as aluminum alloy, chromium–molybdenum alloy steel (chrome moly), titanium alloy, and carbon fiber; and E-bike batteries must adopt environmentally-friendly technology. Interestingly the BOI allows E-bike production lines to jointly use manufacturing lines for ordinary bicycles. However, the sale of ordinary bicycles is regarded as non-BOI-promoted income and will not be entitled to BOI tax incentives. These new provisions, intended to stimulate both local and foreign investments in the electric automotive industry, seem to complete the BOI promotion
December 8, 2021
On February 9, 2021, Vietnam’s Ministry of Public Security (MPS) released the full text of the Draft Decree on Personal Data Protection (“Draft PDPD”) for public consultation, after having released an outline in December 2019, with an ambitious goal for the Draft PDPD to be promulgated and take effect on December 1, 2021. This date has now passed and the Draft PDPD remains unissued, with no concrete details on when the situation will change. Many new contents have been introduced in the Draft PDPD (please see our previous articles here and here). In this article, we take a deeper look at the issues that have attracted the most attention from national and international stakeholders as they wait for the draft to be finalized and promulgated. Please click below to read the full article.  
November 29, 2021
On November 25, 2021, the Myanmar Investment Commission (MIC) issued a list of investment sectors that will receive priority attention in order to encourage national development and state building. The investment activities that MIC will prioritize are the following: Fertilizer manufacturing Cement manufacturing Iron and steel manufacturing Agriculture and livestock farming and related industries Value-added manufacturing of foodstuffs Electric vehicle manufacturing Pharmaceutical and medical device manufacturing Public transportation services Both foreign investors and local investors may invest in these sectors, and the MIC, ministries, and relevant state and regional governments will provide necessary assistance to the investors under the Myanmar Investment Law 2016. For more details on the new requirements, please contact Tilleke & Gibbins at [email protected] or +95 9 772 440 001.