Six Asian countries brought in data laws before India.
Here's what happened next.

What regulators found going wrong

Across more than a decade of published decisions, the same nine kinds of failure come up again and again. Organisations are described here by type, as the regulators described them.

Two more patterns from the region

• Data trading is treated as a crime, not a compliance gap. Vietnam and Indonesia prosecuted people selling personal data, including insiders. Thailand found 139 incidents of officials selling citizens' data in a review of over 31,000 government units.
• Government bodies are not exempt from mistakes. Thailand's monitoring found 4,801 of 15,820 agencies' websites leaking data in seven weeks; Indonesia's national data centre was hit by ransomware in 2024 with only about 2% of its data backed up.

What this means: almost every failure on this list is an ordinary operational gap that a front-desk procedure, an IT checklist or a vendor contract would have prevented. Very few turned on a fine legal point.

Lessons from implementation

What organisations found hardest

• Fitting it into daily work, not understanding the law. In Thailand's 2021 survey of 136 firms, the top challenges were building new processes into operations (75%), interpreting the law (68%) and staff knowledge (63%). After a year of the law in force, putting the right technology in place and finding skilled staff became the bigger hurdles.
• Vendors and breach plans were the weakest links. In a 2021 survey of Vietnamese firms, 52% had no process for managing third parties that receive personal data, 52% had no breach response procedure, and 66% had no compliance roadmap.
• Smaller firms started late. In the same Thai survey, 70% of firms with fewer than 50 staff had not started. Vietnamese smaller firms struggled most with the short window, and hotels and airlines with deletion requests.
• Understanding was the first barrier in Indonesia, where almost half of 135 digital businesses surveyed in 2021 said they did not understand the rules.

What made it easier

• Practical guidance and templates. Singapore published 18 guides in its first year, including sector guides for telecoms, property, education, healthcare and social services, and worked through 65 trade associations to reach over 8,000 people.
• A named owner and a readiness check. In Thailand, firms with an in-house data protection officer rose from 56% to 72%, and firms that had done a readiness assessment from 45% to 80%.
• Training as a budget line. Thai firms naming training as a top budget area rose from 31% to 46% once the law was in force.
• Self-assessment tools. Thailand's regulator now offers a maturity model and a privacy index for organisations to check themselves.

The order that worked

Across the guidance we reviewed, the same sequence recurs: make people aware, name an owner, list what data you hold and why, find the gaps, write the few policies that matter (requests, retention, notices, consent), then train. Sri Lanka's regulator set out exactly these six steps for its public sector in August 2026.

Lessons for businesses that hold data

Customers noticed, and used their new rights

• Over 792,000 phone numbers were added to Singapore's Do Not Call registry in its first year or so. By 2015, 9 in 10 people said they received fewer telemarketing messages.
• Thailand's complaints grew from 204 in one year to 616 the next, reaching 2,672 in total by January 2026. Breach reports roughly doubled over the same period.

The front desk changed

• When Singapore restricted the collection of national ID numbers in 2019, cinemas moved to booking references and SMS, shops asked for a phone number or email instead, and condominium gates switched to electronic visitor systems recording only a partial ID. The regulator gave a year's notice, template notices and a list of approved systems, and a government grant could cover up to 70% of new system costs.
• Regulators also corrected myths the other way. Two days after Thailand's law took effect, the government clarified that personal photos with people in the background, home CCTV and processing on legal grounds other than consent were all allowed.

It paid back

• In Thailand, firms expecting significant benefits from compliance rose from 45% to 58% once the law was in force.
• In Singapore in 2014, 70% of firms said compliance would build consumer confidence and 68% said it would make cross-border data transfers safer.
• In Cisco's 2022 survey of Asia-Pacific organisations, 91% said customers would not buy from a company that protects data poorly.

Help was available, especially for smaller firms

• Singapore's starter package for small firms covered policies, a data inventory, a breach plan, a named officer and training, from S$2,500, with a S$1,600 grant toward it.
• Malaysia's general code of practice includes ready-made consent templates for retailers, travel agents, private schools and others.
• Vietnam exempts household and micro businesses from impact assessments and from appointing an officer, and gives small firms and startups five years, unless they handle large volumes or sensitive data.

Lessons for solution providers

Software vendors, IT and managed-service firms, cloud and SaaS providers, implementers.

Regulators looked at what the vendor did, not only what the contract said

• Singapore, 2016: in the very first batch of decisions, a karaoke chain's IT vendor was penalised alongside its client, even though its contract never described it as handling personal data.
• Singapore, 2019: a public health group's IT agency was fined S$750,000, three times its client's S$250,000, for poorly managed servers, untested controls and known weaknesses left unfixed.
• Singapore, 2023: a healthcare provider's vendor was penalised for no periodic security reviews of an internet-facing drive; being a social enterprise was given no weight.
• Thailand, 2025: a toy company's booking-system vendor was fined THB 3 million, six times its client, for not containing the incident, not telling the client, and not helping the people affected. A state agency's software developer was penalised for building without access controls or risk assessments.
• Malaysia, from April 2025: processors are directly bound by the security duty, not only through their contracts.

What regulators expect from a vendor (Singapore's guide, echoed elsewhere)

1. A written contract that limits what the vendor may do with the data.
2. Reasonable security, such as encryption and access controls.
3. Telling the client about any incident without undue delay, and helping it respond.
4. No sub-contracting without the client's approval, with the same duties passed down.
5. Returning or deleting the data when the work ends.
6. Letting the client audit.

Where software helped most

• Consent records that show when, how and for what purpose consent was given. Vietnam now requires this proof and bans pre-ticked boxes; Malaysia's code requires consent and deletion records open to inspection.
• Records of processing. Indonesia's 2026 rules require a 13-item record; Thailand flags missing records as a common gap.
• Request handling and breach logs, so a client can show what it did and when.
• Packaged offers for small firms. Singapore channels small businesses to a short list of approved providers for a fixed-price starter package.

The opportunity: in Singapore's 2015 survey, about 30% of firms wanted help with IT systems and about 60% with policies and procedures. Providers who combined the two, a working process plus the tool that records it, met the larger need.

Lessons for legal and advisory teams

Lawyers, chartered accountants, company secretaries, data protection officers.

Regulators moved away from consent-for-everything

• Singapore's 2020 amendments added deemed consent by notification, a legitimate-interests exception and a business-improvement exception, each requiring an assessment of the effect on people, and none available for marketing.
• Thailand's 2022 guidelines set out what valid consent and a clear notice look like: a clear positive act, given before or at collection; plain language; the legal basis stated; a prominent link to the full policy is acceptable.
• Indonesia's 2026 rules signal that consent buried in general terms and conditions may no longer count.

The data protection officer role settled into something practical

• Singapore published the first competency framework for the role in 2019, with three levels, and trained officers through partners including the accountants' institute.
• Malaysia (from June 2025) requires an officer above 20,000 people's data, or 10,000 for sensitive data; one person may serve several organisations, and the role can be outsourced.
• Vietnam sets qualifications for in-house and outsourced officers, and exempts the smallest businesses.
• For CAs and CSs: the outsourced and shared officer models in Malaysia and Vietnam are close to how many Indian firms already buy compliance support.

What regulators gave credit for

• Prompt notification, cooperation, quick fixes and admitting the problem.
• Singapore's expedited route closes a case in about five to six months, against up to eighteen for a full investigation, when liability is admitted up front.
• Voluntary undertakings, instead of a penalty decision, for organisations with good accountability practices such as a certified data protection programme.
• In Thailand, prompt help to the people affected was noted in a company's favour.

The lesson for advisers: the documents mattered less than whether staff followed them. Several failures in the list above came where practice on the ground differed from the paper: a karaoke chain that did not enforce its own password policy, a sports federation working from an unwritten procedure.

Lessons for regulators and policymakers

Observations from the region, not recommendations to any government.

What worked

• Guidance before enforcement. Singapore spent its 18-month run-in on workshops, sector guides and outreach through trade associations. Readiness rose from about half of firms to over 80% within a year of the start date.
• Free, practical tools. A data protection notice generator, templates, an assessment tool and a fixed-price starter package for small firms (Singapore); a maturity model and self-assessment index (Thailand).
• Sector codes. Malaysia's codes for hospitals, utilities, finance, telecoms, insurance and aviation, plus a general code covering eleven more types of business, gave each sector its own worked examples.
• Lighter routes for those who own up. Undertakings and expedited decisions in Singapore; corrective orders before fines in Thailand. Singapore accepted undertakings from small firms that had not known the rules, on condition they engaged outside help.
• Published decisions as teaching material. Singapore publishes its decisions in plain terms, with what went wrong and what should have been done, so other organisations can learn from them.
• Clear notice for front-line changes. Singapore's ID-number guidelines gave a year's notice, with templates and approved systems, before they applied.

What caused problems

• A regulator not ready on the start date. Thailand's committee was appointed months before its law took full effect; Sri Lanka withdrew its start date four days before it was due; Indonesia's law has been enforceable since 2024 without its agency.
• Rules late or without consultation. Indonesia's detailed rules arrived nearly two years after the law became enforceable, without a public draft. Businesses learned of them weeks after signing.
• Unclear thresholds and formulas. Commentators flagged Indonesia's fine method (up to 2% of revenue, no formula) and its breach-reporting clock as hard to plan around.
• Very short windows. Vietnam's first decree gave businesses about two months to comply.

What this means for India

Most DPDP duties apply from May 2027. The countries before India point to a short, practical list for each group.

Businesses that hold data

1. Name one person who owns data protection, even part-time.
2. List what personal data you hold, where it sits (including spreadsheets and messaging apps) and why you need it.
3. Fix the security basics: strong passwords, two-step sign-in, updates, nothing left open online.
4. Fix the front desk: collect only what the purpose needs, and record consent where you rely on it.
5. Write down how you would handle a breach and a customer request, and who does what.

Solution providers

1. Expect clients to ask for a processing contract, breach support and security evidence; have them ready.
2. Build consent records, request handling and breach logs into the product, not as add-ons.
3. Treat your own security as your client's compliance: in the region, vendors were penalised alongside clients.

Legal and advisory teams

1. Help clients turn notices and consent forms into front-desk and website steps staff will follow.
2. Review vendor contracts for the six points regulators expect.
3. Consider the shared or outsourced officer model for clients too small for a full-time role.

For the Data Protection Board and policymakers, the regional record suggests that templates, sector guidance, small-business toolkits, published decisions and clear dates did more for compliance than penalties alone.

Appendix A: Country profiles