Vietnam's Law on Artificial Intelligence (Luật Trí tuệ nhân tạo, No. 134/2025/QH15) gives AI systems that were already running before it took effect 12 months from its effective date to comply, and 18 months if they operate in health, education or finance. The law took effect on 1 March 2026, which puts the two deadlines at 1 March 2027 and 1 September 2027. Those two dates are our calculation from the law's effective date and the periods in its transition article. The law itself prints neither.
Of the six markets below, Vietnam is the only one where we verified an AI statute in force. Elsewhere, data protection law does the binding work, and the six laws differ in the places an AI incident tests first.
Last verified: 13 October 2026, against official texts for Vietnam (scanned government PDFs), Malaysia and Indonesia; against Internet Archive copies of the National Privacy Commission's own files for the Philippines, whose live site blocked access; and against the PDPC and MAS websites for Singapore, where statute section numbers were not re-read today. Thailand's Royal Gazette, law.go.th and the regulator's site, pdpc.or.th, could not be reached, so every Thai data protection point rests on an unofficial English translation and law firm notes, not the official text. Indonesia's implementing regulation is reported from a law firm note only.
What does each of the six markets require?
| Market | Data protection law | Regulator | Breach clock, and when it starts | Cross-border transfer rule | Automated-decision rule | AI instrument, status as of October 2026 |
|---|---|---|---|---|---|---|
| Singapore | Personal Data Protection Act 2012 | Personal Data Protection Commission (PDPC) | 3 calendar days, after determining the breach is notifiable | Protection must be comparable to the PDPA | Not re-verified for this post; see our Singapore post | MAS Guidelines on AI Risk Management: issued 7 Oct 2026, effective 7 Oct 2027 |
| Malaysia | Personal Data Protection Act 2010 (Act 709), amended by Act A1727 | Personal Data Protection Commissioner | Act: "as soon as practicable". Guideline: 72 hours "from the occurrence" | A place with a "substantially similar" law or adequate protection, or a listed exception | No statutory rule; a final guideline of 30 Apr 2026 | No AI statute found. Voluntary guidelines; consultation closes 23 Oct 2026 |
| Indonesia | Law No. 27 of 2022 on Personal Data Protection | Agency to be designated by the President; not confirmed | 3 x 24 hours, in writing, to the data subject and the agency | Equal or higher protection; else binding safeguards; else consent | Right to object to solely automated decisions (Art. 10) | Ministerial Circular No. 9 of 2023 on AI ethics |
| Vietnam | Law 91/2025/QH15 and Decree 356/2025/NĐ-CP, effective 1 Jan 2026 | Ministry of Public Security (focal agency) | 72 hours, from detecting the violation | Impact assessment filed within 60 days of the first transfer | Tell the person, explain the algorithm, offer an opt-out | Law 134/2025/QH15, in force since 1 Mar 2026; Decree 142/2026/NĐ-CP, since 1 May 2026 |
| Thailand (from secondary sources; not checked against the official text) | Personal Data Protection Act B.E. 2562 (2019), per an unofficial translation | Personal Data Protection Committee, per the translation | Per the translation: without delay and, where feasible, within 72 hours of becoming aware | Per the translation: an "adequate data protection standard", with exceptions | None found in the translation | A draft AI Act, per Tilleke & Gibbins; stage not confirmed |
| Philippines | Data Privacy Act of 2012 and its Implementing Rules and Regulations (IRR) | National Privacy Commission (NPC) | 72 hours, from knowledge or reasonable belief (IRR s. 38) | Controller stays accountable; comparable protection by contract | Notify the NPC; register the system (IRR s. 48; Circular 2022-04) | NPC Advisory No. 2024-04, 19 Dec 2024 (advisory) |
What does Vietnam's AI Law require, and of whom?
Two points in Article 35 get lost in summaries. It binds both the provider and the deployer of a system already in operation, so a company that only buys and runs an AI tool is named beside the one that built it. And the grace period is conditional: systems may keep operating during it, unless the state AI authority finds a risk of serious harm, in which case it may order suspension or termination.
Article 9 sets three risk tiers: high, medium and low. Not four.
Under Article 10, providers classify their own systems before use, and must notify a medium or high-risk result to the Ministry of Science and Technology, the law's focal agency, first. High-risk systems also need a conformity assessment (Article 13).
The incident duty already applies. Decree 142/2026/NĐ-CP, issued on 30 April 2026 and effective the next day, sets the clock in Article 19. A serious incident that is urgent needs a preliminary report within 72 hours of the moment it is confirmed. Other serious incidents get 5 working days. A final report follows within 15 days of the preliminary one. Filing on time, the decree says, is not an admission of fault.
What the law lacks is a fine amount. Article 29 provides for administrative penalties or criminal liability, plus civil compensation, and leaves the detail to the Government. We could not confirm any AI penalty decree as of October 2026.
What does Vietnam's data law add for AI?
The Personal Data Protection Law, No. 91/2025/QH15, in force since 1 January 2026, has an article on AI systems. Article 30(4) requires AI processing of personal data to be classified by risk level. Its decree, 356/2025/NĐ-CP, treats AI inference outputs that can identify a person as personal data, and requires controllers to tell people about automated processing, explain the algorithm's operating principles and effects, and let them decline.
Article 20 requires a cross-border transfer impact assessment dossier, with one original sent to the specialized data protection agency within 60 days of the first transfer. That is a filing after the fact, not a prior approval.
Why do the breach clocks start at different moments?
Five of the six clocks read 72 hours or three days. They do not start together.
Singapore's PDPC wants notice "no later than three (3) calendar days after determining the breach is notifiable", and the triggers are significant harm or 500 or more individuals. Malaysia's breach guideline says "no later than seventy-two (72) hours from the occurrence of the personal data breach". Vietnam's Law 91, Article 23(1), counts from detecting the violation. The Philippine IRR counts "upon knowledge of, or when there is reasonable belief" that a notifiable breach has occurred, and Indonesia's Article 46 wants written notice to the data subject as well as the agency.
Run one event through them. A vendor's chatbot exposes conversation records for customers in all six markets, and the vendor tells you four days later. On the Malaysian guideline's wording, the 72 hours ran from the occurrence, so that window may have closed before you knew. The guideline's own worked examples start counting when the controller is informed; plan for the stricter reading. In Singapore the three days have not begun. In the Philippines the wording reaches a reasonable belief held by the processor as well as the controller, so your vendor's four days may count.
Vietnam can add a second report. If an AI system is at fault, Decree 142 has its own trigger, confirmation of a serious AI incident, separate from the data breach notice under Law 91. Same event, two filings.
So set the internal clock to the earliest start and the shortest window, and write into every AI vendor contract how fast the vendor must tell you.
What stands out in the other five markets?
Malaysia
The amended Act arrived in three stages, not two. Gazette notice P.U. (B) 522 appointed 1 January 2025, 1 April 2025 and 1 June 2025 for different sections of the amending Act. The June group brought the data protection officer duty, breach notification and data portability. The April group deleted the old ministerial whitelist for transfers.
Remember where the 72 hours lives. It is in a guideline, not in the Act.
Three guidelines published on 30 April 2026 are final, not consultation drafts. They cover automated decision-making and profiling, impact assessments, and data protection by design. The first is candid: Act 709 "does not currently provide specific provisions" on the subject. So Malaysians have no statutory right over automated decisions. They have a regulator's guideline that applies the Act's existing principles.
On 5 October 2026 the department published Public Consultation Paper No. 1/2026 on an AI and Personal Data Protection Framework. Feedback "must be made on or before 23 October 2026". We found no AI statute, and the National Guidelines on AI Governance and Ethics are voluntary.
The Philippines
NPC Advisory No. 2024-04, dated 19 December 2024, applies the Data Privacy Act to AI systems that process personal data, "including its training and testing". It creates no new registration or license. It does ask for meaningful human intervention and a way to contest automated decisions.
The binding rule sits in the IRR. Section 48 requires a controller to notify the Commission when automated processing becomes the sole basis for decisions that would significantly affect a person, and bars decisions with legal effects made solely by automated processing without consent. NPC Circular No. 2022-04 adds that a system involving automated decision-making or profiling must be registered "in all instances". On breach timing, the Act says "promptly"; the 72 hours is in IRR section 38.
Indonesia
Law No. 27 of 2022 was promulgated on 17 October 2022, with a two-year adjustment period under Article 74. Article 56 sets a three-step ladder for transfers. Article 10 gives a right to object to decisions based solely on automated processing, profiling included, where they have legal or significant effects; it is not a ban.
The implementing regulation we can only report. According to a note by the law firm FWP, Government Regulation No. 33 of 2026 was promulgated on 16 July 2026 and takes effect six months after promulgation. We did not find the official text. On AI, the verified instrument is a ministerial circular on AI ethics dated 19 December 2023.
Singapore
Our post on Singapore's agentic AI governance framework covers the PDPA duties, the PDPC's advisory guidelines and the voluntary agentic framework. For this table we re-checked the breach window and the Transfer Limitation Obligation. The MAS Guidelines on AI Risk Management, issued on 7 October 2026, take effect on 7 October 2027, with Sections 5 and 6 due by 7 October 2028. Our financial services AI security playbook has the wider sector map.
Thailand (secondary sources only)
Nothing here was checked against the official Thai text. According to an unofficial English translation of the Personal Data Protection Act B.E. 2562 (2019), section 28 requires a destination country to have an "adequate data protection standard", subject to listed exceptions, and the translation contains no automated-decision or profiling right that we could find. The law firm HLC reports that eight administrative fines in five cases were announced on 1 August 2025; secondary sources disagree on the amounts, so we print none.
On AI, Tilleke & Gibbins reports a new draft Act on Artificial Intelligence released in July 2026. Reports conflict on its dates, and we could not confirm its current stage.
Do the ASEAN guides bind anyone?
No. The ASEAN Guide on AI Governance and Ethics, published in February 2024, says "adoption of the framework laid out herein is voluntary". An expanded guide on generative AI supplements it. We found no ASEAN guide on agentic AI.
What should a regional headquarters do now?
- Build one inventory of AI tools and agents, by market. 82% of organizations discovered previously unknown AI agents in the past year, a Cloud Security Alliance and Token Security survey reported in April 2026.
- Mark every system that was live in Vietnam before 1 March 2026. Classify it, and write the incident runbook now.
- Write one breach matrix. Per market: trigger, start, window, and who must be told.
- Map where each AI vendor processes data. Every transfer rule in the table depends on it.
- List automated decisions about people. The Philippines wants registration, Indonesia an objection route, Vietnam notice and an opt-out.
Our AI vendor security questionnaire is useful here because transfer and breach duties in all six markets turn on what each AI vendor does with the data and where, and those answers are better collected in writing before an incident than during one.
Where does software help, and where does it stop?
Classifying a system under Vietnam's law or deciding that a breach is notifiable is a judgment for your legal and privacy teams. No product makes it, and none makes you compliant with any law in this table.
Software can supply the facts those judgments rest on. AccuroAI discovers 1,400+ AI tools, which is the inventory step. It applies 40+ data classifiers to prompts and responses and redacts or blocks personal data in line, at the point of use and without TLS interception, so one market's data can be kept out of a tool you have not assessed. Every event is logged against a user and a tool; our piece on what an agent audit log should capture explains the fields that matter when a clock starts. The AI compliance hub covers other jurisdictions.
Frequently asked questions
Are 1 March 2027 and 1 September 2027 printed in Vietnam's AI Law?
No. Article 35 gives 12 months and 18 months from the date the law takes effect, and Article 34 sets that date as 1 March 2026. We added the months.
How much of the Thailand row can we rely on?
Treat it as a pointer until counsel checks the official text, which we could not reach.
This is not legal advice. Ask counsel in each market how these rules apply to your systems.
Sources
- Vietnam: Law 134/2025/QH15; Decree 142/2026/NĐ-CP; Law 91/2025/QH15; Decree 356/2025/NĐ-CP
- Malaysia: P.U. (B) 522; Act A1727; breach guideline; ADMP guideline; Consultation Paper No. 1/2026
- Indonesia: Law No. 27 of 2022; Circular No. 9 of 2023; secondary: FWP note
- Philippines: Republic Act No. 10173; archived IRR, Advisory No. 2024-04 and Circular No. 2022-04
- Singapore: PDPC on breach reporting and obligations; MAS release, 7 October 2026
- Thailand, secondary only: unofficial PDPA translation; Tilleke & Gibbins on the draft AI Act; HLC note
- ASEAN: Guide on AI Governance and Ethics; expanded guide