SEA’s data laws chase investments, but will they protect data?

With additional reporting by Elyssa Lopez

In March, the global data center industry faced a hard lesson about putting all their proverbial eggs in one basket.

The lesson came in the form of Iranian drone strikes that hit a facility in the United Arab Emirates and another in Bahrain, knocking out services to government and banking sites in parts of the Middle East.

Image credit: Ulla

Both countries have strict policies on data sovereignty, which means sensitive data is kept secure and onshore. But in practice, this often leads to data being stored in a single location.

That runs contrary to another idea that’s usually central to how data centers operate: data redundancy. This refers to ensuring that multiple instances of data sit in enough places so it can still be accessed should a server go offline.

Sources in Bahrain tell Tech in Asia that after the drone attack, access to government web services, including basic processes like business registration, were unavailable for weeks.

The issue of balancing the practical needs of data redundancy with policy concerns of data sovereignty isn’t new. In 2022, Ukrainians repealed a data sovereignty law over concerns that the government wouldn’t be able to access its data if the country’s capital fell to Russian troops.

Who needs data sovereignty?

These issues have put current data policies in Southeast Asia under new scrutiny. Countries across the region, notably Indonesia and the Philippines, are proposing or have implemented data sovereignty laws following the data center boom that came after the rise of transformer architectures in late 2022.

Industry insiders who spoke with Tech in Asia say that many of the laws are solid policies, but there is also growing concern that some of the new rules are focused more on supporting businesses around the boom instead of protecting data.

The main sectors that require data sovereignty are regulated industries such as banking, telecommunications, healthcare, and the public sector, says Jan Wuppermann, a Singapore-based senior executive with NTT Data Asia Pacific.

Two markets dominate Southeast Asia’s data center industry: Malaysia, especially the state of Johor, which has about 897 megawatts (MW) of operational data center capacity, and Singapore, which holds about 1.04 gigawatts, according to Cushman & Wakefield. Malaysia is expected to increase its capacity to 2,055 MW by the end of 2026.

BW Digital’s NDP1 data center under construction in Batam, Indonesia. The country is on track to have 901 MW of data center capacity. / Photo credit: BW Digital

Balancing competing interests

Demand for localization

Competing for a bigger share