Southeast Asia’s digital economy is booming, but its borders remain a challenge for businesses trying to scale. A growing network of cloud and AI infrastructure must navigate data regulations that differ sharply between countries.
The region’s digital economy is projected to reach $368 billion in gross merchandise value (GMV) in 2026, up 17% year over year, according to an October 21 report from Google, Temasek and Bain & Company. The growth reflects expanding digital commerce and AI adoption, even as national data-transfer rules complicate cross-border operations.
Companies deploying regional cloud services and AI workloads face different requirements for storing, processing and transferring information. Those obligations can shape infrastructure decisions as much as computing capacity or cost.
AI adoption accelerates digital growth
The 2026 e-Conomy SEA report forecasts $226 billion in e-commerce GMV, an 18% annual increase. Generative AI adoption has reached 243 million people, equivalent to 58% of the region’s working population.
AI is also influencing purchasing decisions. According to the report, 69% of shoppers use AI to compare complex products, while early business case studies indicate improved conversion rates. Those results, however, may not extend to every retailer.
Private capital deal value in AI computing and digital infrastructure reached $20 billion over the preceding 12 months, including an $11 billion deal involving ST Telemedia Global Data Centres.
Five Singapore-headquartered operators accounted for approximately 98% of Southeast Asian data center equity funding disclosed through August 25, 2026. Meanwhile, new facilities are expanding into neighboring markets, including Indonesia and Malaysia. Their locations affect computing availability, power requirements and compliance with national data regulations.
National data rules complicate regional expansion
A May 2026 OECD review identified significant differences in Southeast Asia’s cross-border data regulations. Singapore, Malaysia, Thailand and the Philippines generally allow international transfers under established safeguards, while Indonesia, Vietnam and Brunei have more restrictive arrangements.
Cambodia, Laos and Myanmar had limited dedicated cross-border transfer frameworks under the OECD’s assessment. Such differences complicate regional cloud deployments, customer analytics and AI training involving information from multiple jurisdictions.
Indonesia issued implementing regulations for its Personal Data Protection Law on July 16, 2026, detailing requirements for international transfers and other processing activities. Government Regulation No. 33 of 2026 takes effect January 16, 2027, giving businesses time to prepare for the additional compliance requirements.
Lawmakers are separately considering rules for government data that could affect cloud providers and public-sector contractors. Vietnam also imposes requirements for certain sensitive data categories, with international transfers of data classified as core generally requiring prior approval, subject to specified exceptions.
ASEAN is pursuing greater consistency through its Digital Economy Framework Agreement (DEFA). Officials concluded negotiations in May 2026, with the agreement targeted for signing in November 2026. DEFA covers cross-border data flows, digital identity, electronic payments and cybersecurity cooperation.
Regional interoperability efforts also include a Singapore-Vietnam digital credentials initiative exploring faster trade-document verification. The project remains at the proposed proof-of-concept stage, with no demonstrated operational results.
DEFA could eventually simplify some cross-border operations, but national requirements remain in place. Companies must continue assessing data-transfer safeguards and cloud architectures against applicable local laws as the region’s digital economy expands.
Read more: Southeast Asia’s computing expansion could accelerate with 22,000 Nvidia Blackwell Ultra GPUs planned for Malaysia and the Philippines in 2027, although commercial availability and deployment details remain unconfirmed.