ABLI successfully completes ASEAN Framework on Cross-border Cloud Computing project

ABLI is delighted to report the successful completion of the ASEAN Framework on Cross-border Cloud Computing project (Project) to which it has served as consultant. The Project was proposed by ASEAN Member State (AMS) Malaysia and approved by ASEAN. The implementing agency is Malaysia Digital Economy Corporation (MDEC), a government agency under the purview of Malaysia’s Ministry of Digital.

The Project and all its deliverables were endorsed at the 6th ASEAN Digital Ministers Meeting held in Hanoi, Vietnam from 15 to 16 January 2026.

Background of the Project

The role of cloud computing as a foundational enabler of the economy is increasingly prominent in ASEAN. With over 420 million Internet users and a cloud market projected to reach $43.06 billion by 2030, ASEAN is on course to become a major player in global cloud adoption. The wide commercial availability of cloud-based solutions has allowed both the private and public sectors across AMSs to leverage the cloud to drive innovation, improve productivity, and optimize operations.

As cloud usage accelerates, there is a pressing need for an interoperable governance framework to ensure the trusted and secure development of cloud in accordance with the law. This is the context in which the Project (or ASEAN Cloud Computing Framework or Framework) was conceived and developed.

Components of the Framework

The ASEAN Cloud Computing Framework targets two key pillars of legal and regulatory governance for cloud computing, i.e., cross-border data flow and protection of exported data. It begins with six General Principles that signal ASEAN-wide commitments to advancing cloud development and adoption in a trusted and secure manner. These include commitments to:

• provide assurances for cross-border data transfers for business purposes while limiting data localization requirements to narrowly defined exceptions;
• develop special rules for cloud services providers where necessary; and
• enhance cross-border cooperation to reduce incidents of conflict of laws and regulatory conflicts.

To operationalize these high-level commitments, the Framework introduces a policy innovation called Trusted Data Corridor (TDC) where participating AMSs agree to adopt special rules within designated areas in place of their ordinary national regulations. In a TDC, data can flow freely between designated data centers as long as:

• the data protection standards of the participating AMSs are comparable to each other and in line with international standards; and
• the powers of the public authorities of the participating AMSs to access private sector entity data are aligned with international standards.

These features of a TDC are embodied in four Specific Principles, which are accompanied by step-by-step guidance on implementation, such as guidance on conducting a mapping exercise by AMSs to benchmark their applicable laws and regulations against neutral international and/or regional principles, standards and practices.

This tiering structure is an innovation by the Framework in recognition of the diverse national conditions of AMSs and is aimed at encouraging adoption by AMSs.

An accompanying Addendum explores how the Framework can be applied to finance and health, two critical regulated industries where requirements on data protection and storage are particularly stringent.

Process and deliverables of the Project

The Project took around 15 months to complete, during which ABLI conducted extensive consultation with private sector businesses such as data center operators, cloud services providers and cloud services users, as well as public sector stakeholders from AMSs and ASEAN Dialogue Partners via self-organized engagement sessions and workshops held under the auspice of the ASEAN Secretariat. Written consultation was also conducted for each of the deliverables listed below.

The Project has produced three deliverables.

• Establishing a Trusted Data Corridor in ASEAN (December 2024). This document details the proposal of a legal solution in the form of a TDC to provide the legal assurance desired by commercial players while respecting the sovereign duties and obligations of states. Connecting physical data centers located in two or more AMSs, a TDC is designed to operate within globally recognized frameworks such as the ASEAN Framework on Personal Data Protection and may be utilized to support a diverse range of business and technology use cases.
• Landscape Study of ASEAN Framework on Cross-border Cloud Computing – Protection of Exported Data in Cloud Services Delivery (March 2025). This document contains a mapping of the legal frameworks governing public authority access to personal data in six AMSs, a key aspect of the protection afforded to “exported data” during the delivery of technological services such as cloud services. It serves to present the lay of the land, identify divergence and commonalities among AMSs, and lay the ground for further efforts towards designing a set of common principles.
• Principles of ASEAN Framework on Cross-border Cloud Computing (September 2025). This document proposes and explains the General Principles and the Specific Principles mentioned above.

The deliverables can be found on platforms such as ABLI’s ASEAN Framework on Cross-border Cloud Computing tab, MDEC’s social media, and the ASEAN portal.

Next steps

ABLI expresses its gratitude to MDEC for its partnership throughout the Project, as well as all experts and contributors (some of whom prefer to remain anonymous) for their generosity in lending their wise counsel.

ABLI will actively engage private and public sector partners to advocate for the implementation of the policy designs of the Framework (whether on a bilateral or multilateral basis). Stakeholders interested in working with ABLI can contact us at [email protected].