Security Frameworks Decision Tree for Southeast Asia

Thailand's Personal Data Protection Act came into full enforcement in June 2022, but the compliance obligations it generates are not uniform across entities operating in the country. The branching begins with a single question that most companies answer correctly and then immediately stop asking: do you collect or process personal data? The affirmative answer triggers the PDPA baseline, but it is the second question , do you have EU customers or international clients , that determines whether a company sits in the Thailand Privacy Plus profile or the Thailand Privacy Core profile, and the difference between those two profiles is not cosmetic. Thailand Privacy Plus requires ISO 27001:2022 as the foundational controls standard, ISO 27701:2019 for privacy information management system implementation, and GDPR as a binding extraterritorial overlay under Article 3. The GDPR component is not optional or aspirational , any company processing personal data of EU data subjects from Thai operations falls within GDPR's material scope regardless of where it is incorporated.

Thailand Privacy Core substitutes ISO 27002:2022 for the GDPR overlay, which represents a fundamental shift from regulatory liability to implementation guidance. ISO 27002 is a code of practice , it provides the control implementation detail that ISO 27001 Annex A references, but it does not carry the legal weight that GDPR enforcement does. This distinction shapes how remediation roadmaps are structured: Privacy Core entities prioritize control maturity and audit readiness, while Privacy Plus entities must additionally satisfy data subject rights workflows, lawful basis documentation, and Article 28 processor agreement requirements. The Thailand Payment profile adds PCI DSS v4.0.1 to the ISO 27001 and ISO 27002 baseline for any entity processing card or payment data , and the 64 new requirements introduced in PCI DSS v4.0.1 that became mandatory in March 2025 represent a substantial uplift for processors previously certified under v3.2.1, particularly in the areas of targeted risk analysis, authenticated scanning, and phishing-resistant multi-factor authentication. Companies not collecting personal data at all land in the Thailand Foundation profile, which pairs ISO 27001:2022 with ISO 27002:2022 and NIST CSF v2.0 , a combination that provides defensible baseline security posture without the privacy-specific obligations.

Singapore's compliance architecture appears clean at first pass. The Personal Data Protection Act is a mature, well-drafted privacy law with clear obligations around data protection officer designation, breach notification within three days for significant harm scenarios, and Do Not Call registry compliance for direct marketing. Singapore Cyber Hygiene Practice provides a minimum technical baseline for smaller organizations, and ISO 27001:2022 certification satisfies the enterprise procurement expectations that are increasingly standard across the Singapore market. For most companies, those four elements , PDPA, Cyber Hygiene Practice, MAS TRM 2021, and ISO 27001:2022 , constitute the Singapore compliance profile. The critical qualifier is that MAS TRM 2021 only applies to entities under MAS supervision, but the scope of that supervision has expanded materially over the past three years.

MAS Technology Risk Management Guidelines 2021 are not a voluntary best practice document. They carry regulatory force through MAS's supervisory expectations and inspection regime, and their requirements in the domains of cyber resilience, system availability, access control architecture, and third-party risk management go substantially deeper than ISO 27001 Annex A in several areas that matter most to financial sector examiners. The incident reporting obligations are particularly unforgiving: severe service disruptions affecting payment systems or online banking must be reported to MAS within one hour of discovery, a requirement that mandates automated detection, pre-defined escalation chains, and templated regulatory communications to be operational before any incident occurs. Organizations that plan to address MAS TRM after achieving ISO 27001 certification consistently discover that the gap between the two frameworks requires more remediation effort than the ISO 27001 program itself , a sequencing error that an upfront gap analysis against both frameworks simultaneously would have prevented.

Malaysia's Personal Data Protection Act 2010 is among the oldest privacy laws in Southeast Asia, and its age shows in several respects. The law applies to personal data processed in Malaysia in connection with commercial transactions, but its sectoral exemptions , including for the federal government and credit reporting agencies , create asymmetric obligations that multinational companies with Malaysian public sector relationships must navigate carefully. The Malaysia compliance profile pairs the PDPA with ISO 27001:2022 and ISO 27002:2022, reflecting the practical reality that Malaysian regulators and enterprise clients increasingly treat ISO 27001 certification as the minimum evidence of control implementation rather than accepting policy documentation as a substitute. Malaysia's PDPA has no formal data breach notification obligation in its current form , an enforcement gap that the long-anticipated PDPA amendment bill is expected to close, and which companies should be designing their incident response programs to address now rather than after the amendment passes.

The Philippines Data Privacy Act of 2012 and its implementing rules create a compliance environment that tracks GDPR more closely than any other Southeast Asian framework, including mandatory data protection officer registration with the National Privacy Commission, privacy impact assessments for high-risk processing activities, and a 72-hour breach notification requirement for incidents involving sensitive personal information. The Philippines compliance profile adds NIST CSF v2.0 alongside the DPA and ISO 27001:2022, a combination that reflects the NPC's own guidance documents, which explicitly reference NIST frameworks in their technical recommendations. The extraterritorial reach of the Philippines DPA catches a significant number of regional SaaS providers who serve Filipino users from infrastructure outside the country and have not formally assessed their exposure , the NPC has demonstrated willingness to pursue enforcement actions against foreign entities, and the registration requirement for data protection officers applies regardless of where the controller is incorporated.

India's Digital Personal Data Protection Act 2023 is the most significant development in South Asian compliance since the IT Act's data protection provisions were introduced two decades ago. The DPDPA 2023 established the Data Protection Board of India as the enforcement authority and introduced penalties reaching INR 250 crore for violations involving failure to implement reasonable security safeguards , a penalty ceiling that places India among the more consequential enforcement regimes in the region. The India compliance profile layers DPDPA 2023 with ISO 27001:2022 and ISO 27701:2019, the latter being critical given DPDPA's emphasis on consent management architecture, data principal rights fulfillment workflows, and purpose limitation documentation. For companies with both Indian customers and EU operations, the intersection of DPDPA 2023 and GDPR requires careful control mapping because the two frameworks share surface-level similarity in their principles but diverge on lawful basis categories , DPDPA 2023 does not recognize legitimate interests as a standalone lawful basis, a gap that affects a substantial number of B2C processing activities that rely on legitimate interests under GDPR.

Companies with EU customers or EU operations regardless of their primary SEA jurisdiction trigger the GDPR and ISO 27001 profile as an overlay , GDPR, ISO 27001:2022, and ISO 27701:2019 , which sits above whatever country-specific stack applies. This overlay logic is where multi-market SEA operators face their most complex remediation challenges, because they must simultaneously satisfy country-specific legal obligations and the extraterritorial GDPR requirements, and the control architecture must be designed to address both without duplicating effort. For companies that cannot yet determine their dominant jurisdiction exposure , regional holding structures, platforms still mapping data flows, or organizations in early-stage SEA expansion , the SEA General profile provides the minimum defensible baseline: ISO 27001:2022, ISO 27002:2022, NIST CSF v2.0, and CIS Controls v8.1. This combination leverages NIST CSF v2.0's February 2024 Govern function addition, which elevated organizational roles, accountability structures, and cybersecurity strategy to a core function equal in weight to Protect, Detect, Respond, and Recover , and CIS Controls v8.1's implementation groups structure allows organizations to calibrate control depth to their actual risk profile and resource capacity. What the SEA General baseline cannot do is substitute for country-specific legal analysis: ISO 27001 certification is evidence of control maturity, not evidence of legal compliance with Thailand PDPA, Philippines DPA, or India DPDPA 2023.