The OECD has released a substantial report on flow of personal data, and data localisation, in the ASEAN (Association of Southeast Asian Nations) countries.(1) It covers all ten countries in detail,(2) and much of the country detail is very valuable and hard to find elsewhere.

However, the OECD has clear policy preferences in favour of “Data Free Flow with Trust” (DFFT) and the “Global Cross-border Privacy Rules system” (Global CBPRs), and against “Data Localisation”. This paper casts a critical eye on these OECD policies and aims to show where they are ill-supported.

The report’s executive summary asserts that: “The Philippines, Singapore, Malaysia and Thailand have domestic regulations aligned with the principle of Data Free Flows with Trust (DFFT), enabling safeguarded and open transfers of data across borders. However, Brunei Darussalam, Indonesia and Viet Nam have adopted more restrictive, ad-hoc, approaches to cross-border data flows. Cambodia, Myanmar and Lao PDR have yet to adopt regulation in this area.”