Resources · Regulatory watch: Southeast and East Asia
Compliance regulations in Southeast Asia 2026: where each law and scheme stands now
Privacy, AI and financial technology rules in Singapore, the Philippines, Malaysia, Thailand, Indonesia, China and Japan, plus the cross-border privacy certification that links several of them, each with its current status.
Where things stand
Most of the region now has a data protection law in force. Few offer a certificate.
Every law listed here is in force, and several reach organisations abroad: Thailand, Indonesia, the Philippines and China extend theirs to foreign processors of their residents' data. A fintech in India with users in Jakarta and Bangkok can answer to two regulators at once.
Compliance is shown through evidence, not a certificate: notices, consent records, breach procedures and transfer terms. Where a voluntary scheme exists, an appointed or recognised body assesses you. Sterling does not certify; expert and experienced consultants build the programme and its evidence.
Regulations and schemes
One page per law or scheme, each with its current status
Start with the country where you collect personal data or hold a licence.
- Philippine Data Privacy Act Compliance ConsultingRA 10173 dates from 15 August 2012; NPC registration and 72-hour breach notification rules are in force.
- BSP Circulars Compliance and Requirements: IT Risk and ContinuityIT risk, continuity and outsourcing rules sit in the MORB; Circular No. 1203 (2024) adds operational resilience.
- Singapore PDPA Compliance ConsultingBreach notification to the PDPC is mandatory; the data portability right starts only when its regulations are issued.
- MAS TRM and Outsourcing Compliance: Technology and Third-Party RiskTRM Guidelines revised 18 January 2021; the 2023 outsourcing guidelines took effect on 11 December 2024.
- Singapore Model AI Governance Framework Implementation & RequirementsThe voluntary 2020 edition is now joined by frameworks for generative AI (2024) and agentic AI (22 January 2026).
- PDPA Malaysia Compliance and Requirements: Act 709 as AmendedThe 2024 amendments came into operation in phases from 1 January to 1 June 2025.
- Thailand PDPA Compliance and Requirements: Consent, Rights, EvidenceIn force, with breach notice to the Office within 72 hours where feasible under section 37.
- Indonesia PDP Law Compliance and Requirements: Evidence That Holds UpIn force since 17 October 2022; the two-year adjustment period ended on 17 October 2024.
- PIPL Compliance and Requirements: China's Personal Information LawIn force since 1 November 2021; cross-border certification measures applied from 1 January 2026.
- APPI Compliance and Requirements: Japan's Privacy Law in Practice2020 amendments in full effect since 1 April 2022; a reform policy was adopted on 9 January 2026.
- APEC CBPR Certification and Requirements: Global CBPR and PRP GuideGlobal CBPR went live on 2 June 2025; updated Program Requirements apply from 1 April 2027.
Each status line is as the linked page confirms at its last update. Regulators issue new rules often, so confirm the current position with the regulator before acting on it.
- 60+countries where Sterling has delivered certification
- 21countries with a Sterling office, eight regions, one coordinated team
- 2003the year the group began implementing ISO management systems; the same method, refined, since
- 8,100+client engagements across the group, from single-site SMEs to multinationals
FAQs
Regulations in Southeast Asia: common questions
Short answers; each linked page goes into detail.
Which data protection laws apply to a company operating across Southeast Asia?
Usually more than one. Several laws reach foreign organisations: Thailand's PDPA covers those offering goods or services to people in Thailand, and Singapore's applies whether or not you have a presence there. Map where your data subjects are first.
Is there a certificate that proves compliance with these laws?
Not under most of them. Voluntary schemes exist: Singapore's Data Protection Trustmark, assessed by certification bodies appointed by IMDA; Global CBPR, through recognised Accountability Agents; and China's certification for cross-border transfers. Sterling does not certify; it prepares you for the body that does.
What changed in 2026, and what is coming next?
China's cross-border certification measures took effect on 1 January 2026, Japan adopted a reform policy for a further APPI amendment on 9 January 2026, and Singapore issued its agentic AI framework on 22 January 2026. Updated Global CBPR Program Requirements apply from 1 April 2027.
Talk to a consultant
Know which Asian regulators you answer to before a client asks.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice