Personal Data Governance in ASEAN Digital Public Services: A Comparative Analysis

Abstract

Cross-border and interoperable digital public services increasingly depend on personal-data exchange across agencies, vendors, and jurisdictions. This study compared the legal and operational governance architecture relevant to digital public services in seven ASEAN jurisdictions with overarching personal-data instruments in force by August 2026: Brunei Darussalam, Indonesia, Malaysia, the Philippines, Singapore, Thailand, and Vietnam. A comparative doctrinal method examined national legislation alongside ASEAN frameworks on personal data protection, data management, contractual clauses, anonymisation, and digital integration. The analysis found convergence around notice, security, accountability, individual rights, and cross-border safeguards, but material differences remained in statutory scope, public-sector application, supervisory arrangements, breach processes, and transfer mechanisms. Regional instruments supplied useful interoperability tools without replacing national law. The study developed a non-ranking governance workflow linking lawful basis, role allocation, data mapping, risk assessment, security, transfer controls, rights handling, incident response, and audit. The findings indicated that digital public-service interoperability depends less on identical statutes than on demonstrable operational equivalence and traceable accountability across the full data lifecycle.