Asian Business Law Institute

March 2025

Digital transformation is already a critical driver of innovation, efficiency, and competitiveness across industries in an increasingly inter-connected world. The ASEAN region is no exception to this wave. With rapid economic growth and digital adoption reshaping industries in ASEAN, governments and businesses alike are investing (more) in advanced technologies, such as cloud computing, to streamline operations and improve services. As demand for digital services continues to grow, ASEAN has already emerged as an attractive destination for global technology companies to establish data centres and expand infrastructure.

However, one major challenge in this evolving and dynamic landscape is the patchwork of laws and regulations governing data that move across borders in ASEAN and beyond. Public authority access to “exported data” is a key aspect in transfer risk assessments conducted by transferors globally, especially where national legal frameworks on data protection and cybersecurity vary (such as in ASEAN).

Believed to be the first-of-its-kind, this fully-cited, 68-page Compendium examines the legal frameworks governing public authority access to personal data in six ASEAN jurisdictions, a key aspect of the protection afforded to “exported data” during the delivery of technological services such as cloud services. The Compendium serves to present the lay of the land, identify divergence and commonalities among ASEAN member states, and lays the ground for further efforts towards designing a practical solution.