Regulations
Data protection law across Southeast Asia, in plain words.
Six laws. For each: who needs a data protection officer (DPO), how fast a breach must be reported and the penalties, linked to the law itself and dated.
Malaysia
Personal Data Protection Act 2010 (Act 709), as amended by Act A1727 (2024)
- DPO rule
- Required where you hold data on more than 20,000 people, more than 10,000 for sensitive data including financial information, or for regular and systematic monitoring. Register within 21 days of appointment.
- Breach clock
- A breach likely to cause significant harm: to the Personal Data Protection Commissioner (the Commissioner) within 72 hours (the guideline says "from the occurrence"; its examples count from awareness or confirmation), then to the people affected within 7 days after that.
- Penalties
- Up to RM1,000,000, up to 3 years' imprisonment, or both, for breaching a data protection principle (since 1 April 2025).
Read the lawAs of 21 Oct 2026
Singapore
Personal Data Protection Act 2012
- DPO rule
- Every organisation designates at least one individual responsible for compliance (often called the DPO) and publishes a business contact for one of them.
- Breach clock
- To the Personal Data Protection Commission (PDPC) no later than 3 calendar days after assessing a breach as notifiable; to affected individuals on or after that, where the breach is likely to cause them significant harm.
- Penalties
- Administrative fines up to 10% of annual Singapore turnover for organisations with turnover above S$10 million, otherwise up to S$1 million.
Read the lawAs of 21 Oct 2026
Vietnam
Law on Personal Data Protection No. 91/2025/QH15, with Decree 356/2025/ND-CP
- DPO rule
- Every organisation designates a capable data-protection unit or staff, or hires a provider. Small enterprises and startups may defer this for 5 years and micro-businesses are exempt, unless they sell data-processing services, process sensitive data, or process data on 100,000 or more people.
- Breach clock
- A violation that may harm national defence, national security or public order and safety, or a person's life, health, honour, dignity or property: report to the agency no later than 72 hours after discovering it.
- Penalties
- Administrative fines up to 5% of the previous year's revenue for cross-border transfer violations; 10 times the proceeds for trading in personal data; up to VND 3 billion for other violations.
Read the lawAs of 21 Oct 2026
Thailand
Personal Data Protection Act B.E. 2562 (2019)
- DPO rule
- Required for public authorities as the Committee prescribes; where collecting, using or disclosing data requires regular monitoring of personal data or systems because of a large amount of data, as the Committee prescribes; and where the core activity is processing sensitive data.
- Breach clock
- To the Office without delay and, where feasible, within 72 hours of becoming aware, unless the breach is unlikely to risk people's rights; to the people affected without delay if the risk is high.
- Penalties
- Administrative fines up to THB 1 million, 3 million or 5 million per offence, depending on the provision.
Read the lawAs of 21 Oct 2026
Indonesia
Law No. 27 of 2022 on Personal Data Protection
- DPO rule
- An officer is required for public-service processing, for core activities needing regular, systematic, large-scale monitoring, and for core activities processing specific (sensitive) personal data, or data on criminal offences, at large scale.
- Breach clock
- Written notice to the people affected and to the agency within 3 × 24 hours.
- Penalties
- Administrative fines up to 2% of annual income or revenue relating to the violation.
Read the lawAs of 21 Oct 2026
Philippines
Data Privacy Act of 2012 (Republic Act 10173)
- DPO rule
- Every controller designates someone accountable for compliance. With 250 or more employees, sensitive data on 1,000 or more people, or risky processing, register the DPO and processing systems with the National Privacy Commission (NPC) within 20 days.
- Breach clock
- For breaches that meet the notification conditions: the NPC and the people affected within 72 hours of knowing or reasonably believing it happened; the full report within 5 days.
- Penalties
- Administrative fines up to PHP 5 million per act: 0.5–3% of annual gross income for grave violations and 0.25–2% for major ones.
Read the lawAs of 21 Oct 2026
We work in Malaysia first. If you need help elsewhere in the region, tell us.
Not legal advice. Laws change; every fact shows the date we last checked it.