Personal Data Governance in ASEAN Digital Public Services: A Comparative Analysis
DOI:
https://doi.org/10.65310/9yxyqt46Keywords:
ASEAN, data governance, digital public services, personal data protection, cross-border data.Abstract
Cross-border and interoperable digital public services increasingly depend on personal-data exchange across agencies, vendors, and jurisdictions. This study compared the legal and operational governance architecture relevant to digital public services in seven ASEAN jurisdictions with overarching personal-data instruments in force by August 2026: Brunei Darussalam, Indonesia, Malaysia, the Philippines, Singapore, Thailand, and Vietnam. A comparative doctrinal method examined national legislation alongside ASEAN frameworks on personal data protection, data management, contractual clauses, anonymisation, and digital integration. The analysis found convergence around notice, security, accountability, individual rights, and cross-border safeguards, but material differences remained in statutory scope, public-sector application, supervisory arrangements, breach processes, and transfer mechanisms. Regional instruments supplied useful interoperability tools without replacing national law. The study developed a non-ranking governance workflow linking lawful basis, role allocation, data mapping, risk assessment, security, transfer controls, rights handling, incident response, and audit. The findings indicated that digital public-service interoperability depends less on identical statutes than on demonstrable operational equivalence and traceable accountability across the full data lifecycle.
Downloads
References
ASEAN Secretariat, & European Commission. (2024). Joint guide to ASEAN model contractual clauses and EU standard contractual clauses. ASEAN Secretariat.
ASEAN. (2016). ASEAN framework on personal data protection. ASEAN Secretariat.
ASEAN. (2018). Framework on digital data governance. ASEAN Secretariat.
ASEAN. (2021a). ASEAN data management framework. ASEAN Secretariat.
ASEAN. (2021b). ASEAN model contractual clauses for cross border data flows. ASEAN Secretariat.
ASEAN. (2025a). ASEAN guide on data anonymisation. ASEAN Secretariat.
ASEAN. (2025b). Joint guide to ASEAN MCCs and Ibero-American Data Protection Network MCCs. ASEAN Secretariat.
ASEAN. (2026). ASEAN digital masterplan 2030. ASEAN Secretariat.
Aurelia, J., & Lewiandy. (2025). The challenge of harmonizing cross-border data transfer regulations among ASEAN member states. Kertha Semaya: Journal Ilmu Hukum, 13(3), 287–300. https://doi.org/10.24843/KS.2025.v13.i03.p01
Bradford, A. (2020). The Brussels effect: How the European Union rules the world. Oxford University Press.
Brunei Darussalam. (2025). Personal Data Protection Order, 2025.
Cai, Q. (2026). ASEAN consumer data protection in e-commerce. Journal of Consumer Policy. https://doi.org/10.1007/s10603-026-09630-8
European Union. (2016). Regulation (EU) 2016/679 (General Data Protection Regulation). Official Journal of the European Union, L119, 1–88.
Gellert, R. (2018). Understanding the notion of risk in the General Data Protection Regulation. Computer Law & Security Review, 34(2), 279–288. https://doi.org/10.1016/j.clsr.2017.12.003
Greenleaf, G. (2021). ASEAN model contractual clauses: Low and ambiguous data privacy standards. Privacy Laws & Business International Report, 174, 22–24. https://doi.org/10.2139/ssrn.4027670
International Organization for Standardization. (2019). ISO/IEC 27701:2019 security techniques—Extension to ISO/IEC 27001 and ISO/IEC 27002 for privacy information management.
Kuner, C., Bygrave, L. A., & Docksey, C. (Eds.). (2020). The EU General Data Protection Regulation (GDPR): A commentary. Oxford University Press.
Malaysia. (2010). Personal Data Protection Act 2010 (Act 709).
Malaysia. (2024). Personal Data Protection (Amendment) Act 2024 (Act A1727).
National Institute of Standards and Technology. (2020). NIST privacy framework: A tool for improving privacy through enterprise risk management, Version 1.0. U.S. Department of Commerce.
OECD. (2026). Digital trade review of the Association of Southeast Asian Nations: Maximising the benefits of cross-border data flow regulation. OECD Publishing.
Republic of Indonesia. (2022). Law No. 27 of 2022 concerning personal data protection.
Republic of the Philippines. (2012). Republic Act No. 10173: Data Privacy Act of 2012.
Safitri, M. Y., & Mahfud, M. (2023). The ASEAN cross-border personal data transfer instrument: Has Indonesia’s personal data protection law followed it? Jurnal Magister Hukum Udayana, 12(3), 553–564. https://doi.org/10.24843/JMHU.2023.v12.i03.p06
Sholehuddin, N., Miskam, S., Mohd Shahwahid, F., Raja Abdul Aziz, T. N., & Mansor, N. (2024). A comparative legal analysis on personal data protection laws in selected ASEAN countries. Journal of Muwafaqat, 7(1), 23–38. https://doi.org/10.53840/muwafaqat.v7i1.166
Singapore. (2012). Personal Data Protection Act 2012.
Sukerta, P. A. D., & Sutrisno, A. (2024). Personal data protection in ASEAN: A critical comparison between Indonesia’s and Malaysia’s legal frameworks. Constitutional Law Review, 3(2), 133–147. https://doi.org/10.30863/clr.v3i2.5605
Thailand. (2019). Personal Data Protection Act B.E. 2562 (2019).
Vietnam National Assembly. (2025). Law No. 91/2025/QH15 on personal data protection.
World Bank. (2021). World development report 2021: Data for better lives. World Bank. https://doi.org/10.1596/978-1-4648-1600-0
Downloads
Published
Issue
Section
License
Copyright (c) 2026 Fitrahtul Saahira Khairunnisa, Mufidah binti Mastor, Khodijah Asshofiah, Maryam Maryam, Desilva D. R. U. (Author)
This work is licensed under a Creative Commons Attribution-ShareAlike 4.0 International License.
