Establishing a Trusted Data Corridor in ASEAN
Establishing a Trusted Data Corridor in ASEAN
Asian Business Law Institute (December 2024)
Please contact abli_info@abli.asia for queries relating to this publication.
This is the first deliverable under the ASEAN Framework on Cross-border Cloud Computing project (Project) ABLI was commissioned to undertake. The Project was proposed by Malaysia and approved by ASEAN. The implementing agency is Malaysia Digital Economy Corporation, a government agency under the purview of Malaysia’s Ministry of Digital.
All deliverables of the Project have been endorsed at the 6th ASEAN Digital Ministers Meeting held in Hanoi, Vietnam from 15 to 16 January 2026.
The digital economy is already a major economic growth engine. Central to the digital economy are data, a key input factor, and data centres which house the data and digital processing capabilities that power the systems, applications and services integral to essential activities worldwide.
Unsurprisingly, many states aspire to become data centre hubs for their geographical region, and businesses have also expressed wishes to see more data centres being constructed globally to cater to growing commercial needs. This convergence of interest is, however, not without competing interests. On the one hand, governments are under obligations to protect citizens’ data, enhance data security, and have a handle on data access for legitimate reasons such as investigation of crimes. On the other hand, commercial players want various assurances from governments before committing substantial investment to construct, operate and maintain a data centre. Specifically for legal assurance, commercial players require that the laws and regulations of a state that apply to data centres within its territory, and more generally to data hosted in those centres, be clear, uniform, transparent and in alignment with international and regional principles, standards and norms.
This report proposes a legal solution in the form of a Trusted Data Corridor (TDC) to provide the legal assurance desired by commercial players while respecting the sovereign duties and obligations of states. Connecting physical data centres located in two or more jurisdictions, a TDC is designed to operate within globally recognised frameworks such as the Framework on Personal Data Protection established in the Association of Southeast Asian Nations (ASEAN) and may be utilised to support a diverse range of business and technology use cases.
The TDC solution facilitates the transfer, storage and processing of data, including personal data, into, out of and within a TDC by developing and applying special rules in the TDC. These special rules apply exclusively in (the designated geographical areas of) the states participating in the TDC, where those states agree to lift or align domestic rules that would otherwise ordinarily apply in those geographical areas. Taking reference from the well-established concept of “special economic zone”, the TDC solution introduces policy and regulatory innovation to support digital economy activities that take place between participating states.
