1. Introduction
In recent years, digital transformation has reshaped global trade law (Burri, Reference Burri, Mathis and Tor2023a, p. 387). The impacts of digitalisation on global trade make data a central issue in modern international trade law (Burri, Reference Burri2023b, p. 558). Data is politically sensitive and technically challenging; therefore, it is difficult to regulate (Wolfe, Reference Wolfe2019, p. 63). Various data-related issues, such as the free flow of data, data localisation measures, and privacy protection, have emerged as critical and contentious subjects at the World Trade Organization (WTO) and in modern preferential trade agreements (PTAs) (Burri, Reference Burri2023b, p. 558). Over the last few decades, the WTO has made slow progress in adapting to the new issues in digital trade (Mitchell and Mishra, Reference Mitchell, Mishra and Burri2021, p. 85). Its existing rules are relevant albeit inadequate for regulating cross-border data flows and other data-related issues in the digital economy today (Mitchell and Mishra, Reference Mitchell and Mishra2020, p. 1091). By contrast, PTAs compensate for the lack of progress of the WTO and address new issues from the data-driven economy (Burri, Reference Burri and Burri2021, p. 40). Since the early 2000s, global trade law has witnessed a proliferation of deeper and more comprehensive digital trade provisions across PTAs (Elsig and Klotz, Reference Elsig, Klotz and Burri2021, p. 42). As a result, PTAs are an important platform for rule-making in this area, where data-related provisions can be found in dedicated provisions in PTAs (Burri, Reference Burri, Chander and Sun2023c, p. 264).
Among PTAs, the Comprehensive and Progressive Agreement for Trans-Pacific Partnership (CPTPP) is highly acclaimed as a leading model for digital trade rule-making since its advent (Ni, Reference Ni2024, p. 1005). Compared with WTO rules, the CPTPP represents a significant advance beyond the General Agreement on Trade in Services (GATS) by facilitating cross-border data flows while preserving governments’ right to regulate in the public interest (Hodson, Reference Hodson2019, p. 579). Its success is shown in the diffusion of its digital trade norms across subsequent PTAsFootnote 1 (Burri, Reference Burri, Claussen, Elsig and Polanco2025, p. 153) and domestic regulatory frameworks, particularly in the Americas and the Asia-Pacific region (Gao, Reference Gao2024, p. 352). However, the CPTPP’s potential as a blueprint for a global digital trade framework remains questioned due to limitations in practice, especially insufficient inclusiveness for developing countries (Kelsey, Reference Kelsey2018, p. 274). As a result, it is argued that the CPTPP’s digital trade governance template is not yet fully suitable as a universal multilateral framework under the WTO (Ni, Reference Ni2024, p. 1005).
Although digital trade can contribute to developing countries by enhancing connectivity and economic inclusiveness (World Trade Organization, 2023, p. 21), many of them face barriers to fully engaging in the digital economy (Agarwal and Mishra, Reference Agarwal, Mishra, Brożek, Kanevskaia and Pałka2023, p. 297). While the global digital economy is dominated by developed economies (Murthy et al., Reference Murthy, Kalsie and Shankar2021, p. 1), developing countries face insufficient digital infrastructure, a lack of skilled workforce and limited regulatory capacity to gain economic value from data produced within their border (Mishra, Reference Mishra2024, p. 125). Developing countries become sources of raw data, while big tech companies based in developed countries gain greater benefits from collecting, processing, storing, and exploiting these data flows (Mishra, Reference Mishra2024, p. 129). This implies that data policies are directly linked to inequality if mandating unrestricted free flows of data risks positioning developing members into mere exporters of unprocessed data (Vásquez Callo-Müller and Kugler, Reference Vásquez Callo-Müller and Kugler2023, p. 120). Therefore, in the data-driven economy, developing countries lack a comparative advantage.
These asymmetries also extend to digital trade rule-making. There are three dominant data governance models (Burri, Reference Burri2023d, p. 94), including the United States’ market-driven approach, the European Union’s rights-based framework, and China’s state-centric model (Gao, Reference Gao2023b, p. 713). They act as rule-makers by incorporating their data regulatory preferences into trade and digital economy agreements, while developing countries, as rule-takers, have limited room to shape their own regulatory frameworks both nationally and internationally (Burri, Reference Burri2023e, p. 95). These competing data governance models primarily reflect the different national interests and policy priorities (Gao, Reference Gao, Chander and Sun2023a, p. 218), thereby triggering inequalities in the digital trade regulatory framework (Burri, Reference Burri, Askin and Stoll2024, p. 205). Developing countries, with less institutional and regulatory capacity, are required to align with stringent commitments on cross-border data transfer when joining such agreements (Aaronson and Leblond, Reference Aaronson and Leblond2018, p. 271).
Against this background, CPTPP aims to promote cross-border data flow, seeking to limit data protectionism (Burri, Reference Burri, Collins and Geist2023f, p. 14). In this context, how do developing members reconcile their domestic data measures with the CPTPP’s obligations on the free flow of data? The article uses doctrinal legal methods to analyse the domestic legal frameworks of three developing countries in Asia—Vietnam, Malaysia, and Brunei Darussalam—and examines how they fulfil obligations on cross-border data transfers while retaining regulatory autonomy through national security, public policy, and privacy protection. The article refers to the data restrictiveness typology developed by the Organization for Economic Co-operation and Development (OECD) and argues that although these state practices achieve CPTPP’s compliance, all three jurisdictions maintain a certain level of restrictiveness over cross-border data flows. Such restrictive tendencies are not fully in line with CPTPP’s objectives of facilitating the free flow of data, and may hinder digital trade liberalisation in the long term.
2. CPTPP: an advanced model of digital trade governance
The CPTPP was signed in 2018 by 11 nations, known as the first comprehensive template establishing hard and enforceable rules on cross-border data flow and data localisation.Footnote 2 This approach reflects the data governance model of the United States, emphasising the preferences and interests of big technology companies (Kelsey, Reference Kelsey2018, p. 273). Its digital trade rules are largely retained from the original Trans-Pacific Partnership (TPP) despite the United States’ withdrawal (Brzytwa et al., Reference Brzytwa, Cory, Ezell, Gantz and Huerta-Goldman2021, p. 452). This section examines the CPTPP’s far-reaching data-related provisions (Collins, Reference Collins, Collins and Vadi2025, p. 263), shown through three elements: cross-border data transfer (Article 14.11 CPTPP), data localisation requirements (Article 14.13 CPTPP), and its specific exception provisions.
2.1. Cross-border data transfers
Article 14.11 CPTPP is one of the core provisions promoting cross-border data transfers. It imposes a positive obligation on parties to “shall allow the cross-border transfer of information by electronic means, including personal information, when this activity is for the conduct of the business of a covered person.” Although the CPTPP does not specify what kind of data is covered, the reference to “including personal information” implies that the scope of the article covers all forms of data. Compared to the Regional Comprehensive Economic Partnership (RCEP), the coverage of the cross-border data transfer rules in the CPTPP is broader, whereas RCEP only mentions “information.”Footnote 3 In addition, Article 14.11 is binding and enforceable, “shall allow” meaning that CPTPP’s signatories are bound to align their domestic legal framework with the obligation to allow cross-border data transfer. Importantly, this obligation is enforceable through the CPTPP dispute settlement mechanism if a party adopt inconsistent measures, once the transitional phase expires.Footnote 4 The hard-law nature of cross-border data provisions reflects the major shift in both regulatory philosophy and approach in the new era of US FTAs (Gao, Reference Gao, Chaisse, Gao and Lo2017, p. 361; Gao, Reference Gao2018a, p. 68).Footnote 5 In contrast, the RCEP imposes a negative obligation whereby parties “shall not prevent cross-border transfer of information,”Footnote 6 meaning that RCEP prohibits states from creating barriers but does not require them to actively facilitate such data transfer, like “shall allow the cross-border data transfer” in CPTPP.Footnote 7 Moreover, regarding disputes over cross-border data transfer regulations, RCEP parties are required to consult in good faith, but there are no legal consequences if consultations fail, and no party can initiate a formal and binding dispute settlement mechanism under the CPTPP mechanism.Footnote 8 The RCEP’s approach to cross-border data transfer is more cautious and flexible, especially for developing countries (Zhai, Reference Zhai2025, p. 45).
2.2. Data localisation requirements
While Article 14.11 governs the movement of data, Article 14.13 addresses the physical location where data is processed and stored, also known as data localisation. This is a measure which requires data to be stored within a specific jurisdiction and restricts the transfer of data across borders (OECD, 2023, p. 5). Data localisation measures are not a new phenomenon, and are increasingly adopted as they are subject to countries’ jurisdiction (Chander and Lê, Reference Chander and Lê2015, p. 708). Supporter of data localisation justify it to protect their citizens’ privacy, maintain national security, and pursue other public policy objectives (Han, Reference Han2024, p. 263). By contrast, it is also viewed as a form of trade barrier (Selby, Reference Selby2017, p. 215). The United States is a notable country consistently opposing data localisation requirements measures (Gao, Reference Gao2018b, p. 306). Under CPTPP, Article 14.13(2) prohibits party members from imposing data localisation requirements, providing that “No Party shall require a covered person to use or locate computing facilities in that Party’s territory as a condition for conducting business in that territory.”Footnote 9 While the level of restrictiveness varies across agreements, most data localisation provisions in contemporary PTAs are binding in nature (Burri, Reference Burri, Chander and Sun2023c, p. 270). By stipulating “No parties shall require…,” CPTPP establishes an explicit ban on data localisation, meaning that countries are not allowed to adopt data localisation measures as a condition for entering a country’s market to conduct business. Compared to the GATS disciplines, Article 14.13 goes beyond that as it prohibits a wider range of localisation measures, including those that might not otherwise violate national treatment or market access obligations (Hodson, Reference Hodson2019, p. 606). Therefore, the CPTPP’s approach to data localisation reflects the United States’ broader objective of seeking to curb data protectionism (Selby, Reference Selby2017, p. 218).
2.3. Specific exception provisions
Data localisation and cross-border data flows are interrelated (Potluri et al., Reference Potluri, Sridhar and Rao2020, p. 3). As such, the coverage of both Articles 14.11 and 14.13 in CPTPP may overlap, and both are therefore subject to certain exception mechanisms. In particular, both articles recognise a party’s regulatory autonomy (Burri and Kugler, Reference Burri and Kugler2024, p. 407), which allows them to maintain “its own regulatory requirements’ on cross-border transfers of information and the use of computing facilities.”Footnote 10 The CPTPP preserves the members’ right to regulate when allowing them to maintain domestic measures to restrict data flows and adopt data localisation, provided that such measures pursue a “legitimate public policy objective.”Footnote 11 Unlike other general exception provisions in Chapter 29, the article-specific exceptions in Articles 14.11(3) and 14.13(3) are novel and are not provided in previous FTAs (Hodson, Reference Hodson2019, p. 601). Therefore, it is unsurprising that the CPTPP does not define what constitutes a “legitimate public policy objective” or provide a list of accepted grounds.
Articles 14.11(3) and 14.13(3) set out two conditions, and their legal language is largely modelled on the WTO general exceptions. First, the measure must not be applied in a manner that constitutes “arbitrary or unjustifiable discrimination or a disguised restriction on trade.” This reflects the Chapeau test of Article XX of the GATT 1994 and Article XIV of the GATS 1994. Second, the measure must not impose “restrictions greater than those necessary to achieve its legitimate policy objective.” This proportionality test in the CPTPP is akin to the concept of the necessary test in the WTO jurisprudence. These non-discrimination conditions are similar to the WTO exception schemes (Mitchell and Mishra, Reference Mitchell, Mishra and Burri2021, p. 102), although the CPTPP exception provisions are more tailored (Burri and Kugler, Reference Burri and Kugler2024, p. 423).
The main difference is that the exception provisions in GATT/GATS provide a list of policy objectives, while the CPTPP’s ones are designed with more flexibility and subject to interpretation. Without a list of public policy objectives, the scope of the CPTPP exceptions is unclear, revealing a level of legal ambiguity (Burri, Reference Burri, Collins and Geist2023f, p. 14). As such, clarifying the scope of these exceptions helps CPTPP members not to feel threatened that a horizontal obligation on data flows or a ban on data localisation would restrain their ability to regulate the internet for legitimate purposes (Mitchell and Mishra, Reference Mitchell and Mishra2019, p. 407). However, this legal uncertainty is also deliberate to encourage CPTPP parties to accept binding commitments on cross-border data transfers and the location of computing facilities (Peng, Reference Peng, Bethlehem, McRae, Neufeld and Van Damme2022, p. 779). Compared to the RCEP exceptions, its members can also adopt restrictive data measures to achieve a legitimate public policy objective. However, RCEP retains a similar “chapeau” but replaces the “necessity test” with a “self-judging” mechanism, allowing members to determine for itself whether the measure is “necessary to achieve a legitimate public policy objective.”Footnote 12 The e-commerce chapter is also excluded from the binding dispute settlement mechanism under Chapter 19 of the RCEP, making its commitments unenforceable as a soft-law commitment.Footnote 13
In conclusion, data-related provisions are a relatively new phenomenon, appearing primarily in the dedicated e-commerce chapters of PTAs and in only a limited number of agreements (Burri and Polanco, Reference Burri and Polanco2020, p. 211). While CPTPP is not the first to include such data-related rules, it elevates them into a benchmark framework that has subsequently influenced later PTAs (Burri et al., Reference Burri, Vásquez Callo-Müller and Kugler2024, p. 207). Widely recognised as a benchmark model for digital trade governance, whether CPTPP’s provisions effectively contribute to global digital trade governance or pose implementation challenges for developing countries is an open question. The following sections will explore these issues in further detail.
3. Developing countries in CPTPP and the choice of jurisdictions
To examine how developing countries implement CPTPP’s obligations on free flow of data, this section first identifies which CPTPP members are regarded as “developing.” It then explains the study’s focus on Asian developing members among the 11 CPTPP parties. It is not straightforward to precisely determine which countries are developing or developed. In the international system, labelling them is sometimes controversial, contested, and heterogeneous (Farias, Reference Farias2024, p. 651). Classifying developed and developing countries varies across international institutions (Farias, Reference Farias2022, p. 7). Each organisation uses different criteria and indicators to classify its members in line with its specific objectives, operational mandates, and functions.
Within the WTO, there are no agreed-upon definitions of “developed” and “developing” countries. As a legal principle, the WTO grants special and differential treatment (SDT) to promote equitable and sustainable development, which provides developing members with concessions, such as a longer implementation period, more trading opportunities, and receiving capacity-building support and technical assistance… (World Trade Organization, 2026a). Although SDT provisions were not meant to completely exempt developing countries from obligations (Hegde and Wouters, Reference Hegde and Wouters2021, p. 571), and their effectiveness remains in question (Tania et al., Reference Tania, Atkins, Cunningham and Anawaratna2024, p. 123), developing countries tend to take priority in receiving such rights. Instead, the WTO has set a self-declaration mechanism, under which WTO members can self-determine whether they are “developed” or “developing” countries (World Trade Organization, 2026b). Therefore, it would be inadequate to determine the dichotomy based on one indicator. This study refers to other factors, such as income, economic development, and digital readiness, to ensure a more objective assessment. According to the International Monetary Fund (IMF), the World Economic Outlook divides the world into two groups only: “advanced economies” and “emerging and developing economies” (IMF, 2023). In contrast, the World Bank differentiates them by income level: Low-income, Lower-middle-income, Upper-middle-income, and High-income (The World Bank, 2026). In terms of digital connectivity, access and capacity, the International Telecommunication Union (ITU) measures the digital readiness based on four tiers: High ICT Development,Upper-middle ICT Development, Lower-middle ICT Development, and Low ICT Development (International Telecommunication Union, 2025, pp. 5–7).Footnote 14 This study uses these indicators to assess and categorise 11 countries of the CPTPP.
Despite different methodological approaches used by international institutions, their classification results are broadly consistent. As shown in Table 1, 6 out of the 11 CPTPP members can rationally be regarded as developing countries (Chile, Mexico, Peru, Brunei Darussalam, Malaysia, and Vietnam), constituting more than half of the membership. Across the four systems, the IMF, the World Bank, the WTO, and the ITU, six developing countries consistently rank in the lowest categories across all indicators. Even for a high-income economy like Brunei, its classification as developing is justified here by its WTO self-declaration and its specific digital infrastructure challenges noted by the ITU, which distinguish it from advanced counterparts like Singapore or Australia.
Mapping the CPTPP members as developed and developing countries
Table 1. Long description
A table comparing the economic status of various countries as classified by different international institutions. The table has 11 rows and 5 columns. The columns are labeled as Countries, IMF (World Economic Outlook Database 2023), World Bank (GNI 2023), WTO (self-declare status), ITU (digital readiness), and Overall. The rows list the countries and their respective classifications by each institution. Row 1: Australia, Advanced economy, High income, Developed, High, Developed. Row 2: Canada, Advanced economy, High income, Developed, High, Developed. Row 3: Japan, Advanced economy, High income, Developed, High, Developed. Row 4: New Zealand, Advanced economy, High income, Developed, High, Developed. Row 5: Singapore, Advanced economy, High income, Developed, High, Developed. Row 6: Chile, Emerging & developing, High income, Developing, Upper-middle, Developing. Row 7: Mexico, Emerging & developing, Upper middle income, Developing, Upper-middle, Developing. Row 8: Peru, Emerging & developing, Upper middle income, Developing, Upper-middle, Developing. Row 9: Brunei Darussalam, Emerging & developing, High income, Developing, Upper-middle, Developing. Row 10: Malaysia, Emerging & developing, Upper middle income, Developing, Upper-middle, Developing. Row 11: Vietnam, Emerging & developing, Lower middle income, Developing, Lower-middle, Developing.
Regarding the choice of jurisdictions, this study focuses on three Asian developing countries—Brunei Darussalam, Malaysia, and Vietnam—rather than the Latin American members (Chile, Mexico, and Peru), to examine how they navigate the CPTPP’s stringent obligations on cross-border data transfers and reconcile these commitments with domestic regulatory sovereignty. Latin American members have achieved a high degree of regulatory convergence of digital trade and data governance through decades of participation in PTAs (Polanco, Reference Polanco and Burri2021, p. 298). At the regional level, Latin American members set out regional rules for cross-border data transfer as a shared policy objective through their treaty practice (Vásquez Callo-Müller and Sucker, Reference Vásquez Callo-Müller and Sucker2026, p. 4). At the global level, Latin American states have pioneered the integration of digital trade and binding data flow disciplines in PTAsFootnote 15 (Polanco, Reference Polanco, Chehtman, Huneeus and Puig2025, p. 635). Even before joining CPTPP, Mexico incorporated such provisions into the Mexico–Panama FTA in 2014, which is the first agreement to include a binding provision on cross-border information flows (Polanco, Reference Polanco and Burri2021, p. 289). This approach was later solidified in the CPTPP and USMCA.Footnote 16 Chile is also a leading Latin American actor in shaping cross-border data transfer rules in bilateral and plurilateral digital trade negotiations as a founding member of the Digital Economy Partnership Agreement (DEPA), and Peru is in the process of acceding (Vásquez Callo-Müller and Sucker, Reference Vásquez Callo-Müller and Sucker2026, p. 6). The influence of Latin American countries is also shown in quantitative evidence. According to the Trade Agreement Provisions on Electronic-commerce and Data (TAPED) database, PTAs concluded by Latin American countries account for 33% of all trade agreements worldwide, containing digital trade provisions (Polanco, Reference Polanco and Burri2021, p. 271). Therefore, their domestic legal frameworks and treaty practices demonstrate that Latin American countries have acted as active rule-makers in digital trade rule-making, not just a rule-taker since joining CPTPP.
In contrast, when joining a typical US-led digital trade governance model like CPTPP, the Southeast Asian cluster (Brunei, Malaysia, and Vietnam), as norm takers, are required to adapt to externally driven digital trade and cross-border data transfer provisions. Compared to Latin American countries, the divergence and fragmentation in domestic data laws of Asian countries have hindered the free flow of cross-border data in Asia (Zhao, Reference Zhao2024, p. 504). They adopt cautious regulatory approaches to unrestricted data movements (van der Marel, Reference van der Marel, Kang, Helble, Avendano, Crivelli and Tayag2022, p. 103). As such, retaining its domestic laws on data, more sovereignty-oriented frameworks make them more suitable subjects for exploring the tension between international commitments and domestic regulatory autonomy.
4. Implementation of CPTPP data commitments: how do Asian developing members approach?
4.1. Vietnam
4.1.1. Vietnam’s domestic legal framework
The CPTPP entered into force in Vietnam in 2019, considered the first new-generation FTA in Vietnam. Accession required Vietnam to revise, supplement, and pass a wide range of domestic regulations to ensure compliance (VCCI, 2021). At the time of joining the CPTPP, Vietnamese laws on data governance were still nascent, fragmented, and unified (Hang, Reference Hang2024, p. 15). To examine how Vietnam implements its CPTPP commitments on cross-border data transfer, this section will divide it into two phases, before and after 2023, to highlight the development of data regulations in Vietnam.
-
a) Before 2023: Fragmented Regulations and Cybersecurity-driven Regulatory Approach
Prior to 2023, privacy and data protection rules existed but were fragmented across multiple sectoral legal regulations (Greenleaf, Reference Greenleaf2014, p. 361). There were no explicit regulations on cross-border data transfers. Instead of facilitating data flows, the Vietnamese legal framework this time reflected a state-centric and national security-driven approach. To illustrate, the Law on Cybersecurity 2018 and the Decree No. 53/2022/ND-CP on Guiding the Law on Cybersecurity introduce stringent data localisation requirements, applicable to both domestic and foreign enterprises.Footnote 17 To foreign companies providing online services in Vietnam,Footnote 18 if their services are used to violate Vietnam’s cybersecurity laws and they fail to cooperate with the Ministry of Public Security (MPS), such foreign enterprises are required to establish a local branch and representative office in Vietnam.Footnote 19 The MPS has the authority to issue a written request ordering data storage or local presence, and the enterprises must comply within 12 months.Footnote 20 Beyond privacy and personal data protection, the Law on Cybersecurity 2018 is political and underpinned by political ideology and commitments to national security (Bui and Lee, Reference Bui and Lee2022, p. 641). It also aims to prevent the use of the internet to disseminate information and ideas hostile to the State or contrary to the socialist ideology.Footnote 21 It is clear that this framework reveals a strategic approach that aligns with the concept of data sovereignty rather than viewing data from a digital trade liberalisation perspective under the CPTPP.
-
b) From 2023: A Dedicated but State-Centred Governance Framework
Vietnam has the first comprehensive and dedicated legal document for personal data protection since the advent of the Decree No. 13/2023 ND-CP on Personal Data Protection (Decree No. 13/2023 ND-CP). However, rather than promoting individual freedom and the integrity of information flows, the Decree also prioritises state oversight and centralised control over information flows with the goal of consolidating national security and policy objectives (Huynh, Reference Huynh2024, p. 553). Accordingly, cross-border transfer of personal data is allowed but not freely under a stringent notification-based mechanism.Footnote 22 Personal data can be transferred abroad only after the data controller or processor completes a dossier to assess the cross-border data transfer (known as Data Protection Impact Assessment—DPIA), and then submits it to the MPSFootnote 23 to assess and require the completion of the dossier.Footnote 24 This administrative monitoring mechanism places a burden of proof on businesses and raises the compliance costs of conducting cross-border data transfers. Furthermore, Decree No. 13/2023 empowers the MPS with a broad discretionary authority to evaluate, inspect, or suspend data transfers if they are deemed to violate the national interests and national security.Footnote 25 While legally permissible, cross-border data transfer remains conditional, reflecting a state’s oversight over the free movement of data.
Seven years after the CPTPP entered into force, Vietnam has carried out substantial digital regulatory reforms by introducing a new generation of data-related laws, including the Law on Data 2024, Personal Data Protection Law 2025 (Vietnamese Personal Data Protection Law [PDPL] 2025), and Law on Cybersecurity 2025. These new legal regimes provide clearer legal basis for cross-border data transfer mechanisms and introduce more transparent regulatory procedures.
In particular, Article 23(1) of the Law on Data 2024 sets out a principle allowing organisations and individuals to transfer data to and from Vietnam, with their lawful rights and interests protected by the State.Footnote 26 However, transfers abroad impose strict conditions on two types of data to protect legitimate policy objectives,Footnote 27 which are important data Footnote 28 and core data. Footnote 29 Accordingly, the transfer of two categories of data must ensure the protection of national interests, public order, and the legitimate rights of data subjects,Footnote 30 and both are determined based on lists issued by the Prime Minister.Footnote 31 Similarly, the Vietnamese LPDP 2025 also permits cross-border transfers of personal dataFootnote 32 but sets a conditional regulatory approach by mandating both domestic and foreign entities must prepare and submit a DPIA dossier to the specialised data protection authority within 60 days from the first cross-border transfer.Footnote 33 The DPIA dossier is submitted only once throughout the operation of the organisation and must be updated only when significant changes arise.Footnote 34 There is an important change in that the new law replaces the intensive dossier-reviewing approach in Decree No. 13/2023 NC-CP with a post-monitoring mechanism. In this context, businesses are permitted to conduct transfers after fulfilling notification and filing obligations, thereby substantially reducing administrative burdens for cross-border data transfer. Nevertheless, the State retains supervisory and intervention power where national security and interests are implicated, including periodic (no more than once a year) and ad hoc inspections in cases of violations or data breachesFootnote 35 and the transfers are suspended immediately if “they may cause harm to national defense or security.”Footnote 36 Another regulatory change lies in the institutional calibration of the data governance framework. The new LPDP 2025 introduces a more independent and dedicated institution, “specialized data protection authority” to supervise cross-border data transfer transactions rather than the MPS under Decree No. 13/2023. However, this appears to be a strategic legal design rather than a shift towards an independent public authority mechanism like the EU,Footnote 37 since Article 33 explicitly defines this authority as “an agency affiliated with the Ministry of Public Security.” Importantly, this institutional choice reinforces the central role of the state in the regulation of cross-border data flows. With regards to data localisation requirements, the newly enacted Cybersecurity Law 2025 continues imposing an explicit obligation requiring certain categories of data to be stored in Vietnam and requiring foreign service providers within its scope to establish a branch or representative office to ensure network information security.Footnote 38
In conclusion, after 2023, Vietnam has established a more comprehensive and dedicated legal regime governing cross-border data flows. Despite these regulatory developments, the state-centric data governance model remains unchanged, in which cross-border data transfers are plainly allowed but still subject to strict state oversight to safeguard national interests and national security. At the same time, Vietnam continues to impose data localisation requirements for specified categories of data and local presence requirements under the cybersecurity regime. These measures reflect a specialised data governance model that prioritises regulatory sovereignty and national security over the liberalisation of data flows in digital trade.
4.1.2. Vietnam’s implementation
Vietnam’s implementation of the CPTPP’s strict data-related obligations reflects a gradual progress of legal and institutional adaptation rather than full liberalisation. At the beginning, Vietnam’s domestic data legal framework for cross-border data flow appeared to conflict with CPTPP’s obligations, which prohibit members from requiring businesses to use or locate computing facilities as a condition for market access. However, Vietnam initially utilised the transitional mechanism under Article 14.18(2), which provides a temporary exemption from state-to-state dispute settlement for two yearsFootnote 39 since the CPTPP entered into force in Vietnam.Footnote 40 In addition, Vietnam reached bilateral agreements with CPTPP members to extend the grace period from two to five years.Footnote 41 CPTPP signatories also agreed not to initiate disputes over Vietnam’s cybersecurity measures on data localisation requirements. During this period, Vietnam has undertaken substantial legislative reforms governing cross-border data transfers. The PDPL 2025 shifted to a post-monitoring mechanism which greatly reduces administrative barrier and provides more predictable legal framework. These arrangements do not ease Vietnam’s obligation on cross-border data transfer but meaningfully allow Vietnam more time to align its domestic legal framework with the CPTPP’s obligation to permit cross-border transfers. The extension underscores Vietnam’s regulatory capacity constraints and reveals how important regulatory cooperation is in the early stage of implementing sensitive digital commitments.
Against this backdrop, Vietnam still maintains state control over cross-border data flow by mandating the submission of a DPIA dossier and retaining broad supervisory authority to suspend the data transfers if causing risks to national defence or security. In addition, Vietnam continues reaffirming mandatory data localisation requirements for specific categories of data and covered foreign service providers on the ground of cybersecurity protection.
The question is whether such domestic measures are inconsistent with the CPTPP’s obligations concerning the free flow of information across borders and data localisation prohibition. The answer is not straightforward as the CPTPP also allows parties to adopt or maintain measures necessary to achieve legitimate public policy objectives.Footnote 42 Vietnam relies heavily on these exception provisions by framing its data localisation and regulatory oversight requirements as necessary to safeguard national security and cybersecurity. Such reliance can be justifiable. In international trade law, national security has been long recognised as legitimate regulatory justification (Van Den Bossche and Zdouc, 2021, p. 591) and WTO jurisprudence has uncovered the State’s right to invoke security interest to justify trade-restrictive measures (Prazeres, Reference Prazeres2020, p. 137). Beyond the WTO, national security exceptions have been more replicated and tailored in trade and investment agreements with broader scopes to address non-traditional security challenges nowadays and the need for the state to have enough policy space (Esplugues, Reference Esplugues2018, p. 115). Therefore, Vietnam’s inconsistent measure to restrict data flow can be justifiable if not applied in an arbitrary or unjustifiably discriminatory manner and do not impose restrictions greater than are necessary to achieve those objectives.Footnote 43
In conclusion, the analysis reveals that although Vietnam’s legal framework provides a clearer and more predictable mechanism for cross-border data flows, it continues to maintain data localisation and local presence requirements for specified categories of data under the cybersecurity regime. These reforms still remain a level of restriction to the free flow of data in practice, reflecting Vietnam’s cautious balancing between regulatory sovereignty with its international commitments to digital trade liberalisation. However, such an approach will not sustain the liberalisation of digital trade envisaged by the CPTPP.
4.2. Malaysia
4.2.1. Malaysia’s domestic legal framework
The Personal Data Protection Act 2010 (PDPA) is the applicable law governing data privacy and cross-border data transfers in Malaysia. PDPA 2010 came into force in 2013, as the first comprehensive legislation on personal data protection. In the region, the advent of the PDPA 2010 makes Malaysia the first ASEAN country to adopt a specific law on data protection (Yusoff, Reference Yusoff2011, p. 132). One of the salient features of PDPA 2010 is its reference to international frameworks and soft-law instruments including the EU Data Protection Directive (95/46/EC), the OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data, and the APEC Privacy Framework (Prasetyoningsih et al., Reference Prasetyoningsih, Ismail Nawang, Putri, Amirullah and Moallem2024, p. 161). However, being established before the CPTPP, PDPA 2010 was not originally designed to accommodate cross-border data rules under the CPTPP or adequately address emerging data-related issues nowadays (Dhali et al., Reference Dhali, Hassan, Zulhuda and Bt Ismail2022, p. 143).
The core legal tension is in Section 129 (S.129) PDPA 2010, which prohibits the transfer of personal data outside Malaysia unless the conditions are met. In principle, transfers are permitted where the destination jurisdiction appears on an Adequate Protection List, publicly gazetted by the Minister.Footnote 44 This mechanism mirrors the adequacy approach adopted in the EU data protection regime (Tee, Reference Tee2002, p. 265), whereby transfers are allowed only to countries providing an equivalent level of protection.Footnote 45 However, since the enactment of the PDPA in 2010, no adequate protection list of approved jurisdictions has ever been issued. As a result, most data transfers must rely on narrow exceptions under S.129(3), including explicit consent, contractual necessity, public interest, reasonable precautions, and safeguards.Footnote 46 In general, PDPA 2010 imposes a restriction on the free movement of data across borders, reflecting a sovereignty-based regulatory model that prioritises sovereign control over data mobility and trade facilitation. The ministerial approval model and a non-existent whitelist stand in tension with CPTPP commitments on cross-border data transfer.
However, since 2020, Malaysia has reformed PDPA 2010 to align with international standards, which also facilitates the implementation of its commitments under the CPTPP with the amendment of the PDPA in 2024 and the issuance of the Cross-Border Data Transfer Guidelines No.3/2025 (CBPDT Guidelines) under Section 48(g) PDPA 2010. While the amended PDPA 2024 sets out the updated legal framework for cross-border data transfer outside of Malaysia, the Guidelines provide detailed and procedural guidance to ensure compliance under S.129 PDPA. In general, the new framework provides a clearer legal basis for cross-border data flow with two substantive changes. First, the previous whitelist-based adequate protection mechanism has been removed. Although the explicit public interest exception has been removed, the Minister retains discretionary authority in determining permitted transfers under the revised framework. Instead, under the amended regime, cross-border data transfers are now permitted if one of the prescribed statutory conditions or recognised exceptions under S.129(2)–(3) is satisfied, as further elaborated in the CBPDT Guidelines 2025:
First, similar law or adequate protection. A transfer is permitted if the destination jurisdiction falls within one of two statutory grounds: (i) it has laws in force which are “substantially similar” to the PDPA; or (ii) it ensures an “adequate level of protection” for personal data, at least equivalent to the level of protection provided by the PDPA.Footnote 47 Regarding the former, to determine substantial similarity, data controllers need to conduct a risk assessment of the legal framework of the receiving countries (similar to a transfer impact assessment—TIA).Footnote 48 The assessment aims to ensure the personal data protection regimes in the recipient jurisdiction.Footnote 49 Findings of the TIA are valid up to three years. After that, if the relevant foreign law changes during that period, the data controller must review whether the amended law remains substantially similar to the PDPA.Footnote 50 Unlike Vietnam’s DPIA regime, which prioritises consideration of national defence and security, and public interests,Footnote 51 Malaysia focuses on the protection of personal data in commercial transactions and private sectors (Prasetyoningsih et al., Reference Prasetyoningsih, Ismail Nawang, Putri, Amirullah and Moallem2024), modelled on international data protection frameworks (Yusoff, Reference Yusoff2011). About the latter condition, to determine whether receiving countries have an adequate level of protection for the Malaysian PDPA, data controllers also must conduct a TIA.Footnote 52 The purpose of this is to examine factors such as security measures and policies; legally enforceable obligations; data protection law enforceability and compliance mechanism; regulatory authority comparable to Malaysia’s Department of Personal Data Protection…Footnote 53 Findings also last up to three years and must be reassessed if foreign laws change.Footnote 54
Second, exceptions for cross-border data transfers under PDPA 2010. Besides two statutory principles for cross-border data transfers, the PDPA also recognises multiple exceptions under Section 129(3). These exceptions are elaborated through the CBPDT Guidelines 2025 with interpretation and procedural guidance to ensure compliance.
-
I. Consent of the Data Subject: A transfer proceeds if the data subject has given explicit consent.Footnote 55 The data subject is provided with a written notice which details (i) the class of third parties who will receive the data and (ii) the purpose of the transfer. The consent must be recorded and stored by the data controller as proof of compliance. If the data subject cannot give consent, a transfer may still be permitted to mitigate harm to the data subject, provided that reasonable efforts have been made to obtain consent.Footnote 56 In limited cases where consent cannot be obtained, transfers remain possible to mitigate harm.
-
II. Necessary for Contract or Vital Interests: Transfers are allowed necessary for performing or concluding a contract to which the data subject is a party, or to protect the data subject’s vital interests.Footnote 57 The CBPDT Guidelines interpret the term “necessary” as not meaning “absolutely essential” but denotes a transfer made for a specific purpose directly connected with the contractual obligations of the data controller.Footnote 58 The transfer must not be routine or general but linked to the core purpose of the contract. Data controllers are expected to assess whether the purpose of the transfer could reasonably be achieved by other means.Footnote 59 Where the transfer is for the conclusion or performance of a contract with a third party at the data subject’s request or in their interest, the request must be in writing or recorded. The data controller must ensure that the interest of the data subject is clear, direct, targeted, and substantial, such as travel arrangements, ensuring a data subject’s family holiday.Footnote 60
-
III. Legal Purposes: Data is transferred abroad when necessary for legal proceedings and for obtaining legal advice, or for establishing, exercising, or defending legal rights.Footnote 61 The CBPDT Guidelines also broaden this to include proceedings before courts, tribunals, administrative bodies, and regulatory authorities, as well as alternative dispute resolution such as mediation or arbitration.Footnote 62 However, this ground does not apply to speculative or potential cases; it covers only ongoing or imminent legal matters, or situations involving pre-action correspondence and formal regulatory requests.
-
IV. Reasonable Precautions and Due Diligence: Under S.129(3)(f) PDPA 2010, transfers are permissible where data controllers take reasonable precautions and exercise due diligence to ensure compliance with PDPA standards.Footnote 63 Furthermore, the CBPDT Guidelines 2025 clarify this as a flexible safeguard mechanism, allowing data controllers to rely on recognised frameworks, such as binding corporate rules, standard contractual clauses, or certification schemes that demonstrate equivalent protection standards.Footnote 64 For example, an intra-group transfer under a Binding Corporate Rules (BCRs) is valid if the policy is legally binding, sets out the applicable jurisdictions, ensures equivalent protection, and grants enforceable data-subject rights and complaint mechanisms. This exception reflects Malaysia’s shift towards a risk-based accountability approach, enabling organisations to justify cross-border transfers through demonstrable compliance measures rather than prior government authorisation.
Although the PDPA 2024 amendments on cross-border data transfer remain limited in scope and institutional design (Greenleaf, Reference Greenleaf2025, p. 1), the amendment to the PDPA 2010, as well as the CBPDT Guidelines 2025, establishes a clearer, comprehensive, risk-based framework for cross-border personal data transfers. By grounding transfers in protection standards rather than prior ministerial approval, Malaysia enhances legal certainty and better facilitates the modern digital economy.
4.2.2. Malaysia’s implementation
CPTPP became effective for Malaysia in late 2022, while the PDPA 2010 had been enacted more than a decade before. Interestingly, implementing the CPTPP requires modest adjustments to Malaysian domestic law in line with the CPTPP’s e-commerce regulations (Azmi and Jeong, Reference Azmi and Jeong2020, p. 66). With an updated legal regime in 2024, Malaysia’s applicable legal framework is broadly compatible with the CPTPP cross-border data obligations.
Although PDPA does not impose explicit data localisation requirements, it regulates cross-border data transfers through conditions under S.129. The PDPA retains its regulatory autonomy to restrict cross-border data flows overseas and sets out conditions for that. However, its regulatory sovereignty serves as a mechanism of accountability rather than state control, as it aims to protect the privacy and personal data of citizens. The ultimate purpose of these conditions set out in S.129 PDPA is to assess risks and ensure accountability in data transfer abroad. Under the amended PDPA, data controllers have the burden of proof to demonstrate that a transfer meets the standards of “substantially similar law” or “an equivalent level” of protection in the recipient jurisdictions. This regulatory calibration avoids imposing restrictions greater than are required to achieve the objective, thus satisfying the necessity and proportionality tests under Articles 14.11 and 14.13 of the CPTPP.
Additionally, domestic measures such as TIA, BCRs, Standard Contractual Clauses (SCCs), or certification schemes are equally applied in a non-discriminatory manner to both foreign and domestic businesses when conducting cross-border data transfers. This fair application helps Malaysia to avoid an arbitrary or discriminatory treatment or constitutes a disguised restriction on trade under Articles 14.11(3) and 14.13(3) CPTPP. On the one hand, the Malaysian legal regime remains restrictive by stipulating a prohibitive default rule rather than being fully free for data flow. On the other hand, Malaysia’s legal framework on cross-border personal data transfers basically fulfils the obligations and does not conflict with the CPTPP’s commitments. From a restrictive, ministerial-control model to a risk-based framework, Malaysia’s recently revised data protection regime demonstrates its effort to reconcile domestic privacy regulations with international trade obligations. These reforms bring Malaysia closer to the CPTPP’s objectives of facilitating digital trade.
4.3. Brunei Darussalam
4.3.1. Brunei’s domestic legal framework
The CPTPP entered into force for Brunei Darussalam in 2023. Unlike Malaysia, Brunei has not enacted dedicated legislation governing personal data before the CPTPP. In 2025, Brunei introduced the Personal Data Protection Order (PDPO) as the country’s first comprehensive data protection regime. The PDPO 2025 applies to individuals, private entities, and non-governmental organisations operating in Brunei that process personal data in the course of their activities,Footnote 65 while government agencies are not.Footnote 66 In particular, under S.24 PDPO 2025, the transfer of personal data outside Brunei is permissible but subject to statutory conditions. No organisation is allowed to transfer data abroad unless it ensures that the foreign recipient provides a level of protection comparable to that under the PDPO.Footnote 67 This provision reflects the principle of “adequacy,” similar to the EU GDPRFootnote 68 and Malaysia’s PDPA 2010, which requires equivalence in protection standards rather than allowing unrestricted data flows. Accordingly, the organisation transferring data abroad must ensure the recipient provides a standard of protection equivalent to Brunei’s PDPO 2025 (comparable level of protection).Footnote 69
Furthermore, S.24(2)-(4) PDPO 2025 sets out discretionary exemptions from the “prescribed requirements” through an administrative mechanism, Technology Industry of Brunei Darussalam (AITI Authority).Footnote 70 This state agency holds the power to grant an exception on a case-by-case basis upon written application.Footnote 71 The organisation applying for the exemption must justify the request by showing that it has taken suitable measures to protect the data and that the transfer will not undermine the level of protection guaranteed under the PDPO. This exemption mechanism raises critical concerns regarding legal certainty and transparency. Specifically, S.24(3)(a) stipulates that such exemptions “need not be published in the Gazette” and may be revoked “at any time.” These powers emphasise a broad administrative discretion of the AITI Authority to determine conditions for exemptions, which may include restrictions on the type of data, duration of transfer, or specific security measures. Lack of publication on exceptions reduces transparency and predictability for other organisations seeking similar exemptions, thereby creating legal uncertainty for ongoing data flows. Furthermore, the AITI Authority also has the power to “add to, vary or revoke any condition” or the exemption itself “at any time.”Footnote 72 On the one hand, this mechanism gives the data protection state agency strong control to adapt to new challenges and norms without amending the PDPO itself. On the other hand, Section 24.4 PDPO also implies continuous regulatory oversight since the exemption is not permanent but subject to ongoing administrative review rather than operating as permanent approvals. While this promotes accountability, it escalates burdens and compliance costs for organisations.
4.3.2. Brunei’s implementation
Regarding data location requirements, the PDPO 2025 does not explicitly impose data localisation mandates, which indicates alignment with CPTPP Article 14.13. Regarding Brunei’s implementation of cross-border data transfer regulations, Brunei’s framework does not appear to create a legal conflict with Article 14.11 CPTPP that obligation “shall allow the cross-border transfer of information by electronic means,” as cross-border transfers outside Brunei remain legally permissible although subject to conditions, particularly where the receiving jurisdiction provides a comparable level of protection. This adequacy requirement can be justified to pursue the legitimate public policy objective under the CPTPP exception framework to protect the fundamental right to privacy and the personal data of its citizens. Accordingly, Brunei’s compliance with cross-border data flows ensures compatibility with the CPTPP’s rule on data flows.
However, the discretionary exemption mechanism in S.24(2)–(4) raises concern about whether such measures are arbitrary, discriminatory, and more restrictive than necessary when the AITI Authority can “grant, modify, or revoke exemptions at any time” and its decisions “need not be published in the Gazette.” Applying these conditions reveals a potential risk of non-compliance with the CPTPP, that such domestic measures must be applied in a manner that does not constitute an arbitrary or unjustifiable discrimination or a disguised restriction on trade, especially where exemptions are granted on a case-by-case basis by the AITI Authority without clear public criteria or procedural safeguards. This administrative discretion and exceptions under S.24(2)–(4) may constitute an element of arbitrariness. In addition, the CPTPP transparency obligation mandates that each party shall ensure that its laws, regulations, procedures, and administrative rulings of general application are promptly published or made available.Footnote 73 In this context, the unpublished and discretionary exception mechanism makes it difficult to assess whether Brunei’s framework satisfies the CPTPP requirements that restrictions on cross-border data transfers should not be applied more restrictively than necessary to achieve legitimate public policy objectives.
In conclusion, Brunei’s domestic legal framework for cross-border data governance does not violate the provisions in the CPTPP. The country preserves national sovereignty and administrative discretion to regulate cross-border data transfers. The lack of legal clarity and procedural transparency in its implementation could expose Brunei to risks of inconsistency or non-compliance with data commitments in CPTPP.
5. Measuring the level of data restrictiveness: compliance, but at what cost?
In recent years, data-restrictive measures have been increasingly adopted across jurisdictions (see Figure 1). In other words, adopting domestic data measures is not a recent trend. According to the OECD, there were nearly 100 data localisation measures adopted across 40 countries by 2023. Notably, these measures are more prevalent in non-OECD countries, many of which are developing countries (OECD, 2023, p. 13). Governments not only have the right but also the responsibility to protect the privacy and security of the data of their citizen as it flows across borders (Chander and Lê, Reference Chander and Lê2015, p. 739). Beyond privacy, they have adopted data localisation measures on many grounds, such as to ensure access to information for regulatory purposes, safeguard national security, strengthen digital security by keeping processing domestic, and promote data protectionism to build domestic capacity in the data-driven economy (OECD, 2023, pp. 6–7). While the United States frequently views data localisation measures as barriers to digital trade and the free flow of information, several competing states employ such measures as instruments of digital sovereignty to challenge US dominance in the global digital economy (Selby, Reference Selby2017, p. 227).
More importantly, domestic data measures are becoming more restrictive (OECD, 2023, p. 13). The analysis in Section 4 shows that the legal frameworks of Vietnam, Malaysia, and Brunei all impose restrictions on cross-border data flow, albeit at different levels. To evaluate it, this article refers to several analytical frameworks, focusing on two forms of data regulations: data localisation and cross-border data transfers.
5.1. First, data localisation regulations
The analysis begins with a general classification based on the agent-based model (ABM), which divides data localisation regulations into three types: (i) no restrictions, (ii) less restrictive, (iii) highly restrictive (see Table 2) (Potluri et al., Reference Potluri, Sridhar and Rao2020, p. 3). Under this model, the legal frameworks of Malaysia, Vietnam, and Brunei fall within the less restrictive category as none of these jurisdictions impose explicit data localisation requirements or completely prohibit cross-border data flows. Instead, cross-border data transfers are permitted, albeit under a conditional mechanism. However, this classification remains so broadly general and relative that it cannot fully capture the different levels of data restrictiveness across all jurisdictions. Although Malaysia, Vietnam, and Brunei all allow cross-border data transfers, the legal conditions, administrative mechanisms, and scope of exceptions established are divergent.
When regulating cross-border data transfer, states rely on conditional transfer mechanisms and discretionary oversight at varying levels. As discussed earlier, Malaysia, Vietnam, and Brunei have different approaches to cross-border data localisation. To further analyse these defferences, this paper refers to a more specific analytical framework, “A typology of data localization measures and requirements for data flow,” which was developed in 2023 by OECD experts (see Figure 2 and Table 3) (OECD, 2023). It assesses restrictiveness along three key theoretical dimensions: (i) whether localisation obligation exists, (ii) the legal and practical restrictiveness of cross-border data transfer, and (iii) the degree of regulatory discretion and transparency governing such transfers. The result shows different national approaches to domestic data localisation regulations: Brunei’s prohibitive sovereignty model, Vietnam’s conditional sovereignty approach, and Malaysia’s liberal compliance-based framework.
Vietnam’s recent post-2025 legislative framework, including the Law on Data 2024, the LPDP 2025, and the new Law on Cybersecurity 2025, maintains explicit mandatory data localisation requirements, while establishing conditional data flow mechanisms, moving away from Category 3. Accordingly, cross-border data transfers are permitted but subject to clearly defined legal conditions, including DPIA filing obligations, regulatory supervision, and the possibility of suspension where national security or national interests are implicated. At the same time, the Law on Cybersecurity 2025 maintains mandatory data localisation requirements for specified categories of data and requires certain foreign service providers to establish a local branch or representative office. Although these requirements may be justified under the CPTPP’s legitimate public policy exceptions, they nevertheless preserve a high degree of state control over cross-border data flows. Therefore, I place Vietnam within Category 2, but at its restrictive end, where conditional transfer mechanisms coexist with regulatory discretion.
Malaysia falls within Category 2, but its approach is different from Vietnam’s. Following PDPA amendments 2024 and the issuance of the Guidelines 2025, Malaysia has moved from ministerial approval mechanisms to a risk-based framework. Transfers are permitted where substantial similarity or adequacy is demonstrated through TIA. The Guidelines further elucidate clear statutory exceptions (e.g., consent, contractual necessity, and law enforcement purposes). As such, Malaysia remains within Category 2 but represents its liberal approach where conditional transfers are regulated by more predictable and transparent legal procedure.
Brunei is placed in Category 3 because the PDPO 2025 regulates cross-border data transfer through a prohibitive default rule and broad administrative discretion. The AITI Authority may grant exemptions on a case-by-case basis, without publication, and may revoke them at any time. The absence of procedural transparency and the reliance on ad hoc exemptions show that Brunei maintains a data sovereignty approach where localisation and discretionary authorisation restrict cross-border data flows.
5.2. Second, cross-border data transfer regulations
Regarding regulations on cross-border data transfer, the paper also adopts the OECD analytical framework, which provides a more systematic taxonomy for evaluating the degree of restriction of cross-border data regulations and state intervention in cross-border data flows (OECD and WTO, 2025, p. 16). This framework divides four groups from no regulation to conditional or ad hoc authorisation mechanisms as illustrated in Figure 3 and Table 4.
Applied to Vietnam, Malaysia, and Brunei, this taxonomy reveals that all three legal regimes embed varying degrees of restrictiveness. Malaysia is placed in Category 2, as its amended PDPA 2010 and the Guidelines 2025 permit data transfers abroad under predefined statutory and contractual conditions. Transfers are allowed if the receiving jurisdiction provides “substantially similar” or “adequate” protection or falls within one of the specified exceptions, such as consent or contractual necessity. This rule-based, risk-assessment approach no longer requires prior ministerial authorisation, thus representing a conditional but liberal model consistent with the pre-authorised safeguard category. In contrast, Vietnam and Brunei fall within Category 3 due to their reliance on state-centric and discretionary approval mechanisms. Vietnam’s current framework permits cross-border data transfers subject to mandatory compliance obligations, including DPIA filing requirements, regulatory notification, and post-transfer supervisory powers. The competent authority retains broad powers to inspect, suspend, or restrict transfers on grounds of national security or public interest. Similarly, Brunei’s PDPO 2025 establishes a default prohibition on cross-border transfers. Cross-border data transfers are permitted when the adequacy level of protection is ensured. However, the AITI Authority can grant case-by-case exemptions issued by it.
6. Concluding remarks
Based on the legal analysis of the CPTPP cross-border data framework and the domestic implementation of its cross-border data flow obligations by Vietnam, Malaysia, and Brunei, as well as the assessment of data restrictiveness according to the OECD analytical framework, I put forward several key observations to conclude this paper.
First, the CPTPP’s binding digital trade rules pave the way for domestic data regulatory reforms in all jurisdictions. Consistent with the principle that treaty commitments require good-faith implementation,Footnote 74 each state has introduced or revised its legal frameworks to address cross-border data transfers and localisation to ensure its compliance. Malaysia amended its long-existing Personal Data Protection Act 2010 in 2024 and introduced detailed Cross-Border Data Transfer Guidelines 2025 to align with modern international standards, shifting its cross-border data transfer mechanism towards risk and compliance. Vietnam, after the expiry of its transitional phases, conducted a comprehensive legal reform by formally removing mandatory data localisation requirements and setting out procedural rules for data transfer, strategically reducing overt conflict with CPTPP obligations. Similarly, Brunei enacted its first comprehensive Personal Data Protection Order 2025 to regulate personal data protection and how data is transferred outside the country. Data flows more freely than ever before, making it harder for individuals to protect their privacy, leading to public demand for governments to act. But when data goes beyond a sovereign territory, governments cannot act alone without international cooperation, which, for the moment, leads to trade agreements (Wolfe, Reference Wolfe2019, p. 65). Implementation of hard rules in PTAs has catalysed the adoption of domestic privacy legislation, albeit at varying speeds and degrees of sovereignty sensitivity (Burri, Reference Burri2023e, p. 94). These state practices collectively illustrate the CPTPP’s normative influence over domestic rule-making in the data-driven sector and show how trade disciplines can precede, and accelerate, the construction of national privacy and data-protection regimes.
Second, all countries have consistently sought to retain their regulatory autonomy and to tailor the conditions governing cross-border data transfers in accordance with their national priorities. In international trade law, trade is not always superior. In certain situations, states have some room to deviate from established rules to achieve other priorities, such as national security, public health, public morality, and environmental protection. This regulatory space is commonly referred to as the “right to regulate” in international investment law (Titi, Reference Titi2014), allowing States to exercise their sovereign powers and impose measures on investments in the interest of public welfare (Baltag et al., Reference Baltag, Joshi and Duggal2023, p. 385). Interpretive practice in international trade law reveals that the right to regulate is a principle of regulatory autonomy (Mitchell, Reference Mitchell2023, p. 465). Nowadays, this principle is embedded in modern digital trade agreements, which recognise that sovereign states allow them to adopt measures necessary to achieve legitimate public policy objectives (Burri and Kugler, Reference Burri and Kugler2024, p. 423).
In this context, Vietnam, Malaysia, and Brunei strategically refer to exceptions provided in CTPPPFootnote 75 to set out conditions for cross-border data transfers under a conditional mechanism. Malaysia relies on the privacy exception to implement a compliance-based framework focused on accountability and legal equivalence. Vietnam focuses on national security considerations, prioritising state control and cybersecurity through discretionary oversight by the MPS. Brunei applies an adequacy requirement with a discretionary administrative authorisation mechanism. While the legality of these domestic measures remains open to interpretation and application, such practices demonstrate how developing members exercise their regulatory autonomy within the permissible bounds of the CPTPP’s digital trade framework. This also reflects their ongoing efforts to reconcile sovereignty with international compliance and to balance the liberalisation of cross-border data flows with the protection of domestic policy objectives.
Third, despite regulatory reforms conducted to ensure compatibility with the CPTPP data obligations, domestic data laws across all jurisdictions reveal a varying level of restriction on data flow. Cross-border data transfers are allowed but subject to certain conditions, such as procedural complexity, security-driven conditions, case-by-case approval mechanisms, and low administrative transparency. Although legally justifiable under CPTPP’s general exception provisions,Footnote 76 these measures cause persistent tensions between the commitments to facilitate digital trade and the national policy space to regulate digital industries. In practice, restrictive or uncertain transfer conditions may increase compliance costs and reduce legal predictability, which will not sustain digital trade in the long term and go against the spirit of seamless digital trade within the CPTPP framework. The differing and non-uniform approaches governing cross-border data transfers in Malaysia, Vietnam, and Brunei show both the flexibility and the limitations of the CPTPP’s digital trade model. On the one hand, the CPTPP provides members sufficient regulatory space to design their own transfer mechanisms, reflecting the Agreement’s respect for national policy priorities. On the other hand, the absence of common standards or mutual recognition mechanisms has resulted in fragmented implementation and uneven levels of restrictiveness across jurisdictions.
Number of data localisation measures worldwide 1976–2022 Source: OECD (2026)
A typology of data localisation measures and requirements for data flow Sources: OECD (2023)
Types of cross-border data flow regulations Source: OECD and WTO (2025, p. 16)
Assessment of data localisation regulations of Malaysia, Vietnam, and Brunei
Table 2. Long description
A table titled ‘Assessment of data localisation regulations of Malaysia, Vietnam, and Brunei’ with three rows and three columns. The columns are labeled ‘Categories’, ‘Descriptions’, and ‘Countries’. The rows are as follows: Row 1: Categories, No restriction; Descriptions, No restrictions where there is no data localisation restriction. This allows free and unconditional flow of data; Countries, empty. Row 2: Categories, Less restrictive; Descriptions, Less restrictive where countries allow data flows, but subject to specific conditions; Countries, Malaysia, Vietnam, and Brunei. Row 3: Categories, Highly restrictive; Descriptions, Highly restrictive means countries impose explicit data localisation measures and prohibit cross-border data flows; Countries, empty.
Assessment of domestic data localisation regulations in Malaysia, Vietnam and Brunei
Table 3. Long description
A table categorizing data localization regulations in Malaysia, Vietnam, and Brunei. The table has three columns: Categories, Descriptions, and Countries evaluated. It contains four rows of data. Row 1: Category 0: No local storage requirement, but condition on access or protection/security, No obligation to store data domestically, but conditions may apply to access, security, or protection. Row 2: Category 1: Local storage requirementNO flow restriction, Measures requiring that data be stored or retained domestically, while permitting unrestricted cross-border storage or processing. The objective is to ensure local availability without limiting international data flows. Row 3: Category 2: Local storage requirementWITH clearly defined transfer or access condition, Frameworks imposing local storage or processing obligations but allowing data transfer abroad under specified and transparent legal or technical conditions. The flow of data is conditional but not prohibited, Malaysia and Vietnam. Row 4: Category 3: Local storage and processing requirementWITH flow prohibition (or ad hoc exceptions), Highly restrictive regimes mandating domestic storage and processing while prohibiting or severely limiting cross-border transfers, subject only to discretionary or case-by-case exemptions. These reflect sovereignty-centered or security-driven control over data flows, Brunei.
Assessment of cross-border data flow regulations of Malaysia, Vietnam, and Brunei
Table 4. Long description
A table comparing cross-border data flow regulations in Malaysia, Vietnam, and Brunei. The table has four rows and three columns. The columns are labeled Categories, Descriptions, and Countries evaluated. The rows are labeled as follows: Row 1: Category 0: No regulation, No cross-border data flow regulation because there is no privacy and data protection law. This implies no restriction on data movement, but may affect firms willingness to transfer data. Row 2: Category 1: Open safeguards, Transfers are allowed with greater discretion to the private sector. Mechanisms include ex post accountability, contracts governing data flows, or private sector-led adequacy decisions. Row 3: Category 2: Pre-authorised safeguards, Transfer allowed but subject to a pre-determined and transparent public sector approval mechanism established by public authorities. In the absence of an adequacy decision, transfers still proceed through contractual clauses or using binding corporate rules, or among other mechanisms. Malaysia. Row 4: Category 3: Conditional/ad hoc authorisation, Transfers permitted only on a case-by-case basis, subject to review and approval by relevant authorities. Applies to personal data for privacy reasons and also to broader categories of important data, including national security. Vietnam and Brunei.
Acknowledgements
The author expresses sincere gratitude to the Centre for International Law at the National University of Singapore (CIL NUS) for organizing the “AI Sovereignty and International Law” conference, and the speakers for their insightful comments. The author would like to thank the anonymous reviewers for their constructive comments and valuable suggestions. The author is also grateful to Associate Professor Imogen Saunders of the Australian National University for her careful reading of the manuscript and insightful feedback.
Financial support
This research has been done under the research project number “DHL-25.19.QT” of the University of Law, Vietnam National University, Hanoi.
Open access
