Policy and regulation
Everything here comes from the Law Register. Each status shows its “as of” date; a record past its freshness window shows as “status under re-verification”.
| Name | Jurisdiction | Kind | Status | As of | Source |
|---|---|---|---|---|---|
| Cybersecurity Act | Singapore | Law | Cybersecurity Act: in force, As of 2026-10-12 | 2026-10-12 | Source link (opens in a new window) |
| Cybersecurity (Amendment) Act 2024 | Singapore | Law | Cybersecurity (Amendment) Act 2024: partly in force, As of 2026-10-12 | 2026-10-12 | Source link (opens in a new window) |
| Computer Misuse Act 1993 | Singapore | Law | Computer Misuse Act 1993: in force, As of 2026-10-12 | 2026-10-12 | Source link (opens in a new window) |
| Criminal Law (Miscellaneous Amendments) Act 2025 | Singapore | Law | Criminal Law (Miscellaneous Amendments) Act 2025 (Criminal Law (Miscellaneous Amendments) Act 2025 (No. 21 of 2025)): enacted, not yet in force, As of 2026-10-12 | 2026-10-12 | Source link (opens in a new window) |
| Personal Data Protection Act | Singapore | Law | Status under re-verification | 2026-10-05 | Source link (opens in a new window) |
| Cybersecurity Code of Practice for Critical Information Infrastructure 2026 | Singapore | Guidance or code of practice | Cybersecurity Code of Practice for Critical Information Infrastructure 2026 (The Cybersecurity Code of Practice for Critical Information Infrastructure 2026): Code of practice, As of 2026-10-12 | 2026-10-12 | Source link (opens in a new window) |
| Guide on Managing and Notifying Data Breaches under the Personal Data Protection Act | Singapore | Guidance or code of practice | Status under re-verification | 2026-10-05 | Source link (opens in a new window) |
| Telecommunications Cybersecurity Code of Practice (listed by IMDA as 'Telco Cybersecurity COP') | Singapore | Guidance or code of practice | Status under re-verification | 2026-10-05 | Source link (opens in a new window) |
| Cyber Security Act 2024 | Malaysia | Law | Cyber Security Act 2024 (Cyber Security Act 2024 [Act 854]): in force, As of 2026-10-12 | 2026-10-12 | Source link (opens in a new window) |
| Cyber Security (Notification of Cyber Security Incident) Regulations 2024 and related regulations | Malaysia | Law | Status under re-verification | 2026-10-12 | Source link (opens in a new window) |
| Personal Data Protection Act 2010 | Malaysia | Law | Personal Data Protection Act 2010 (Akta Perlindungan Data Peribadi 2010 [Akta 709]): in force, As of 2026-10-12 | 2026-10-12 | Source link (opens in a new window) |
| Personal Data Protection (Amendment) Act 2024 | Malaysia | Law | Personal Data Protection (Amendment) Act 2024 (Akta Perlindungan Data Peribadi (Pindaan) 2024 [Akta A1727]): in force, As of 2026-10-12 | 2026-10-12 | Source link (opens in a new window) |
| Computer Crimes Act 1997 (unofficial English translation of the name) | Malaysia | Law | Status under re-verification | 2026-10-05 | |
| Communications and Multimedia Act 1998 | Malaysia | Law | Communications and Multimedia Act 1998 (Communications and Multimedia Act 1998 [Act 588]): in force, As of 2026-10-12 | 2026-10-12 | Source link (opens in a new window) |
| Guidelines on Cross-Border Personal Data Transfer (unofficial English translation of the name) | Malaysia | Guidance or code of practice | Guidelines on Cross-Border Personal Data Transfer (unofficial English translation of the name) (Garis Panduan Perlindungan Data Peribadi Pemindahan Data Peribadi Rentas Sempadan (CBPDT)): Guidance, As of 2026-10-12 | 2026-10-12 | Source link (opens in a new window) |
| Guidelines on Personal Data Breach Notification (unofficial English translation of the name) | Malaysia | Guidance or code of practice | Guidelines on Personal Data Breach Notification (unofficial English translation of the name) (Garis Panduan Perlindungan Data Peribadi Pemberitahuan Pelanggaran Data): Guidance, As of 2026-10-12 | 2026-10-12 | Source link (opens in a new window) |
| Commissioner's Circular No. 2 of 2025 (Data Breach Notification) (unofficial English translation of the name) | Malaysia | Guidance or code of practice | Commissioner's Circular No. 2 of 2025 (Data Breach Notification) (unofficial English translation of the name) (Pekeliling Pesuruhjaya Perlindungan Data Peribadi Bilangan 2 Tahun 2025 (Pemberitahuan Pelanggaran Data)): Guidance, As of 2026-10-12 | 2026-10-12 | Source link (opens in a new window) |
| Risk Management in Technology (RMiT) | Malaysia | Guidance or code of practice | Risk Management in Technology (RMiT) (Risk Management in Technology (RMiT), BNM/RH/PD 028-98): Guidance, As of 2026-10-12 | 2026-10-12 | Source link (opens in a new window) |
| Law No. 27 of 2022 on Personal Data Protection (unofficial English translation of the name) | Indonesia | Law | Law No. 27 of 2022 on Personal Data Protection (unofficial English translation of the name) (Undang-Undang Nomor 27 Tahun 2022 tentang Pelindungan Data Pribadi): in force, As of 2026-10-12 | 2026-10-12 | Source link (opens in a new window) |
| Law No. 1 of 2024, second amendment to the Electronic Information and Transactions Law (unofficial English translation of the name) | Indonesia | Law | Law No. 1 of 2024, second amendment to the Electronic Information and Transactions Law (unofficial English translation of the name) (Undang-Undang Nomor 1 Tahun 2024 tentang Perubahan Kedua atas Undang-Undang Nomor 11 Tahun 2008 tentang Informasi dan Transaksi Elektronik): in force, As of 2026-10-12 | 2026-10-12 | Source link (opens in a new window) |
| Government Regulation No. 71 of 2019 on the Operation of Electronic Systems and Transactions (unofficial English translation of the name) | Indonesia | Law | Government Regulation No. 71 of 2019 on the Operation of Electronic Systems and Transactions (unofficial English translation of the name) (Peraturan Pemerintah Nomor 71 Tahun 2019 tentang Penyelenggaraan Sistem dan Transaksi Elektronik): in force, As of 2026-10-12 | 2026-10-12 | Source link (opens in a new window) |
| OJK Regulation No. 11/POJK.03/2022 on the Implementation of Information Technology by Commercial Banks (unofficial English translation of the name) | Indonesia | Law | OJK Regulation No. 11/POJK.03/2022 on the Implementation of Information Technology by Commercial Banks (unofficial English translation of the name) (Peraturan Otoritas Jasa Keuangan Nomor 11/POJK.03/2022 tentang Penyelenggaraan Teknologi Informasi oleh Bank Umum): in force, As of 2026-10-12 | 2026-10-12 | Source link (opens in a new window) |
| OJK Board Member Regulation No. 1 of 2026 on the Implementation of Information Technology by Commercial Banks (unofficial English translation of the name) | Indonesia | Law | OJK Board Member Regulation No. 1 of 2026 on the Implementation of Information Technology by Commercial Banks (unofficial English translation of the name) (Peraturan Anggota Dewan Komisioner OJK Nomor 1 Tahun 2026 tentang Penyelenggaraan Teknologi Informasi oleh Bank Umum): in force, As of 2026-10-12 | 2026-10-12 | Source link (opens in a new window) |
| Cybersecurity Act, B.E. 2562 (2019) (unofficial English translation of the name) | Thailand | Law | Cybersecurity Act, B.E. 2562 (2019) (unofficial English translation of the name) (Cybersecurity Act, B.E. 2562 (2019)): in force, As of 2026-10-11 | 2026-10-11 | Source link (opens in a new window) |
| Personal Data Protection Act, B.E. 2562 (2019) (unofficial English translation of the name) | Thailand | Law | Personal Data Protection Act, B.E. 2562 (2019) (unofficial English translation of the name) (พระราชบัญญัติคุ้มครองข้อมูลส่วนบุคคล พ.ศ. 2562): partly in force, As of 2026-10-12 | 2026-10-12 | Source link (opens in a new window) |
| Computer Crime Act, B.E. 2550 (2007), as amended (No. 2) B.E. 2560 (2017) (unofficial English translation of the name) | Thailand | Law | Computer Crime Act, B.E. 2550 (2007), as amended (No. 2) B.E. 2560 (2017) (unofficial English translation of the name) (พระราชบัญญัติว่าด้วยการกระทำความผิดเกี่ยวกับคอมพิวเตอร์ พ.ศ. 2550 (แก้ไขเพิ่มเติม ฉบับที่ 2 พ.ศ. 2560)): in force, As of 2026-10-12 | 2026-10-12 | Source link (opens in a new window) |
| Policies and Measures on Security of Information Technology Systems (unofficial English translation of the name) | Thailand | Guidance or code of practice | Policies and Measures on Security of Information Technology Systems (unofficial English translation of the name) (Bank of Thailand Notification No. SorNorChor. 11/2561 Re: Policies and Measures on Security of Information Technology Systems): Code of practice, As of 2026-10-12 | 2026-10-12 | Source link (opens in a new window) |
| Law on Cybersecurity (Law No. 116/2025/QH15) (unofficial English translation of the name) | Vietnam | Law | Law on Cybersecurity (Law No. 116/2025/QH15) (unofficial English translation of the name) (Luật An ninh mạng (Luật số 116/2025/QH15)): in force, As of 2026-10-12 | 2026-10-12 | Source link (opens in a new window) |
| Law on Cybersecurity (Law No. 24/2018/QH14) (unofficial English translation of the name) | Vietnam | Law | Status under re-verification | 2026-10-12 | Source link (opens in a new window) |
| Law on Personal Data Protection (Law No. 91/2025/QH15) (unofficial English translation of the name) | Vietnam | Law | Law on Personal Data Protection (Law No. 91/2025/QH15) (unofficial English translation of the name) (Luật Bảo vệ dữ liệu cá nhân (Luật số 91/2025/QH15)): in force, As of 2026-10-12 | 2026-10-12 | Source link (opens in a new window) |
| Data Law (Law No. 60/2024/QH15) (unofficial English translation of the name) | Vietnam | Law | Status under re-verification | 2026-10-05 | Source link (opens in a new window) |
| Decree No. 13/2023/ND-CP on personal data protection (unofficial English translation of the name) | Vietnam | Law | Status under re-verification | 2026-10-05 | Source link (opens in a new window) |
| Data Privacy Act of 2012 | Philippines | Law | Status under re-verification | 2026-10-05 | Source link (opens in a new window) |
| Cybercrime Prevention Act (research lead from the brief; official title and Republic Act number unverified) | Philippines | Law | Status under re-verification | 2026-10-05 | |
| Act on the Protection of Personal Information (unofficial English translation of the name) | Japan | Law | Act on the Protection of Personal Information (unofficial English translation of the name) (個人情報の保護に関する法律（平成十五年法律第五十七号）): in force, As of 2026-10-12 | 2026-10-12 | Source link (opens in a new window) |
| Act on Prevention of Damage from Unauthorized Acts against Critical Computers (active cyber defence law) (unofficial English translation of the name) | Japan | Law | Act on Prevention of Damage from Unauthorized Acts against Critical Computers (active cyber defence law) (unofficial English translation of the name) (重要電子計算機に対する不正な行為による被害の防止に関する法律（令和七年法律第四十二号）): partly in force, As of 2026-10-12 | 2026-10-12 | Source link (opens in a new window) |
| Basic Act on Cybersecurity (unofficial English translation of the name) | Japan | Law | Basic Act on Cybersecurity (unofficial English translation of the name) (サイバーセキュリティ基本法（平成二十六年法律第百四号）): in force, As of 2026-10-12 | 2026-10-12 | Source link (opens in a new window) |
| Economic Security Promotion Act (unofficial English translation of the name) | Japan | Law | Economic Security Promotion Act (unofficial English translation of the name) (経済施策を一体的に講ずることによる安全保障の確保の推進に関する法律（令和四年法律第四十三号）): in force, As of 2026-10-12 | 2026-10-12 | Source link (opens in a new window) |
| Telecommunications Business Act (unofficial English translation of the name) | Japan | Law | Telecommunications Business Act (unofficial English translation of the name) (電気通信事業法（昭和五十九年法律第八十六号）): in force, As of 2026-10-12 | 2026-10-12 | Source link (opens in a new window) |
| Act on the Prohibition of Unauthorized Computer Access (unofficial English translation of the name) | Japan | Law | Act on the Prohibition of Unauthorized Computer Access (unofficial English translation of the name) (不正アクセス行為の禁止等に関する法律（平成十一年法律第百二十八号）): in force, As of 2026-10-12 | 2026-10-12 | Source link (opens in a new window) |
| Act on Promotion of Research and Development and Utilization of AI-related Technologies (unofficial English translation of the name) | Japan | Law | Act on Promotion of Research and Development and Utilization of AI-related Technologies (unofficial English translation of the name) (人工知能関連技術の研究開発及び活用の推進に関する法律（令和七年法律第五十三号）): in force, As of 2026-10-12 | 2026-10-12 | Source link (opens in a new window) |
| Guidelines on Cybersecurity in the Financial Sector (unofficial English translation of the name) | Japan | Guidance or code of practice | Guidelines on Cybersecurity in the Financial Sector (unofficial English translation of the name) (金融分野におけるサイバーセキュリティに関するガイドライン): Guidance, As of 2026-10-12 | 2026-10-12 | Source link (opens in a new window) |
| Basic Act on the Development of Artificial Intelligence and the Establishment of a Trustworthy Foundation | South Korea | Law | Basic Act on the Development of Artificial Intelligence and the Establishment of a Trustworthy Foundation (Basic Act on the Development of Artificial Intelligence and the Establishment of a Trustworthy Foundation (AI Basic Act)): in force, As of 2026-10-12 | 2026-10-12 | Source link (opens in a new window) |
| Personal Information Protection Act | South Korea | Law | Personal Information Protection Act (Personal Information Protection Act (개인정보 보호법)): in force, As of 2026-10-12 | 2026-10-12 | Source link (opens in a new window) |
| Act on Promotion of Information and Communications Network Utilization and Information Protection (unofficial English translation of the name) | South Korea | Law | Status under re-verification | 2026-10-05 | Source link (opens in a new window) |
| Act on the Protection of Information and Communications Infrastructure (unofficial English translation of the name) | South Korea | Law | Status under re-verification | 2026-10-12 | Source link (opens in a new window) |
| Protection of Critical Infrastructures (Computer Systems) Ordinance | Hong Kong | Law | Protection of Critical Infrastructures (Computer Systems) Ordinance (Protection of Critical Infrastructures (Computer Systems) Ordinance (Cap. 653)): in force, As of 2026-10-12 | 2026-10-12 | Source link (opens in a new window) |
| Personal Data (Privacy) Ordinance | Hong Kong | Law | Status under re-verification | 2026-10-05 | Source link (opens in a new window) |
| Computer-crime provisions of the Crimes Ordinance and the Telecommunications Ordinance (unofficial English translation of the name) | Hong Kong | Law | Computer-crime provisions of the Crimes Ordinance and the Telecommunications Ordinance (unofficial English translation of the name) (Crimes Ordinance (Cap. 200) ss.60 and 161; Telecommunications Ordinance (Cap. 106) s.27A): in force, As of 2026-10-12 | 2026-10-12 | Source link (opens in a new window) |
| Code of Practice (Generic), Version 1.0 | Hong Kong | Guidance or code of practice | Code of Practice (Generic), Version 1.0 (Code of Practice Pursuant to the Protection of Critical Infrastructures (Computer Systems) Ordinance, Version 1.0): Code of practice, As of 2026-10-12 | 2026-10-12 | Source link (opens in a new window) |
| Supervisory Policy Manual TM-C-1: Supervisory Approach on Cyber Risk Management | Hong Kong | Guidance or code of practice | Supervisory Policy Manual TM-C-1: Supervisory Approach on Cyber Risk Management: Guidance, As of 2026-10-12 | 2026-10-12 | Source link (opens in a new window) |
| Cybersecurity Law (Law No. 13/2019) | Macao | Law | Cybersecurity Law (Law No. 13/2019) (Lei n.º 13/2019 — Lei da cibersegurança / 第13/2019號法律《網絡安全法》): in force, As of 2026-10-12 | 2026-10-12 | Source link (opens in a new window) |
| Personal Data Protection Act (Law No. 8/2005) (unofficial English translation of the name) | Macao | Law | Personal Data Protection Act (Law No. 8/2005) (unofficial English translation of the name) (第8/2005號法律《個人資料保護法》 / Lei n.º 8/2005 — Lei da Protecção de Dados Pessoais): in force, As of 2026-10-12 | 2026-10-12 | Source link (opens in a new window) |
| Law on Combating Computer Crime (Law No. 11/2009) (unofficial English translation of the name) | Macao | Law | Law on Combating Computer Crime (Law No. 11/2009) (unofficial English translation of the name) (第11/2009號法律《打擊電腦犯罪法》 / Lei n.º 11/2009 — Lei de combate à criminalidade informática): in force, As of 2026-10-12 | 2026-10-12 | Source link (opens in a new window) |
| Guideline on Technology and Cyber Risk Management | Macao | Guidance or code of practice | Guideline on Technology and Cyber Risk Management (Circular No. 017/B/2023-DSB/AMCM: Guideline on Technology and Cyber Risk Management): Guidance, As of 2026-10-12 | 2026-10-12 | Source link (opens in a new window) |
| Cyber Protection Act, 2026 (Act No. 81 of 2026) (unofficial English translation of the name) | Bangladesh | Law | Cyber Protection Act, 2026 (Act No. 81 of 2026) (unofficial English translation of the name) (সাইবার সুরক্ষা আইন, ২০২৬ (২০২৬ সনের ৮১ নং আইন)): in force, As of 2026-10-12 | 2026-10-12 | Source link (opens in a new window) |
| Cyber Protection Ordinance, 2025 (Ordinance No. 25 of 2025) (unofficial English translation of the name) | Bangladesh | Law | Cyber Protection Ordinance, 2025 (Ordinance No. 25 of 2025) (unofficial English translation of the name) (সাইবার সুরক্ষা অধ্যাদেশ, ২০২৫ (২০২৫ সনের ২৫ নং অধ্যাদেশ)): repealed, As of 2026-10-12 | 2026-10-12 | Source link (opens in a new window) |
| Cyber Security Act, 2023 (Act No. 39 of 2023) (unofficial English translation of the name) | Bangladesh | Law | Cyber Security Act, 2023 (Act No. 39 of 2023) (unofficial English translation of the name) (সাইবার নিরাপত্তা আইন, ২০২৩ (২০২৩ সনের ৩৯ নং আইন)): repealed, As of 2026-10-12 | 2026-10-12 | Source link (opens in a new window) |
| Personal Data Protection Act, 2026 (Act No. 63 of 2026) (unofficial English translation of the name) | Bangladesh | Law | Personal Data Protection Act, 2026 (Act No. 63 of 2026) (unofficial English translation of the name) (ব্যক্তিগত উপাত্ত সুরক্ষা আইন, ২০২৬ (২০২৬ সনের ৬৩ নং আইন)): partly in force, As of 2026-10-12 | 2026-10-12 | Source link (opens in a new window) |
| Personal Data Protection Ordinance, 2025 (Ordinance No. 61 of 2025) (unofficial English translation of the name) | Bangladesh | Law | Personal Data Protection Ordinance, 2025 (Ordinance No. 61 of 2025) (unofficial English translation of the name) (ব্যক্তিগত উপাত্ত সুরক্ষা অধ্যাদেশ, ২০২৫ (২০২৫ সনের ৬১ নং অধ্যাদেশ)): repealed, As of 2026-10-12 | 2026-10-12 | Source link (opens in a new window) |
| National Data Management Act, 2026 (Act No. 80 of 2026) (unofficial English translation of the name) | Bangladesh | Law | National Data Management Act, 2026 (Act No. 80 of 2026) (unofficial English translation of the name) (জাতীয় উপাত্ত ব্যবস্থাপনা আইন, ২০২৬ (২০২৬ সনের ৮০ নং আইন)): in force, As of 2026-10-12 | 2026-10-12 | Source link (opens in a new window) |
| Information and Communication Technology Act, 2006 (Act No. 39 of 2006) (unofficial English translation of the name) | Bangladesh | Law | Information and Communication Technology Act, 2006 (Act No. 39 of 2006) (unofficial English translation of the name) (তথ্য ও যোগাযোগ প্রযুক্তি আইন, ২০০৬ (২০০৬ সনের ৩৯ নং আইন)): in force, As of 2026-10-12 | 2026-10-12 | Source link (opens in a new window) |
| Bangladesh Telecommunication Act, 2001 (Act No. 18 of 2001) (unofficial English translation of the name) | Bangladesh | Law | Bangladesh Telecommunication Act, 2001 (Act No. 18 of 2001) (unofficial English translation of the name) (বাংলাদেশ টেলিযোগাযোগ আইন, ২০০১ (২০০১ সনের ১৮ নং আইন)): in force, As of 2026-10-12 | 2026-10-12 | Source link (opens in a new window) |
| Personal Data Protection Act, No. 9 of 2022 | Sri Lanka | Law | Personal Data Protection Act, No. 9 of 2022: partly in force, As of 2026-10-12 | 2026-10-12 | Source link (opens in a new window) |
| Personal Data Protection (Amendment) Act, No. 22 of 2025 | Sri Lanka | Law | Personal Data Protection (Amendment) Act, No. 22 of 2025: in force, As of 2026-10-12 | 2026-10-12 | Source link (opens in a new window) |
| Computer Crimes Act, No. 24 of 2007 | Sri Lanka | Law | Computer Crimes Act, No. 24 of 2007: in force, As of 2026-10-12 | 2026-10-12 | Source link (opens in a new window) |
| Banking Act Directions No. 16 of 2021: Regulatory Framework on Technology Risk Management and Resilience for Licensed Banks | Sri Lanka | Guidance or code of practice | Banking Act Directions No. 16 of 2021: Regulatory Framework on Technology Risk Management and Resilience for Licensed Banks: Code of practice, As of 2026-10-09 | 2026-10-09 | Source link (opens in a new window) |
| Banking Circular No. 2 of 2025: Reporting of Information Technology and Cybersecurity Incidents of Licensed Banks | Sri Lanka | Guidance or code of practice | Banking Circular No. 2 of 2025: Reporting of Information Technology and Cybersecurity Incidents of Licensed Banks: Code of practice, As of 2026-10-09 | 2026-10-09 | Source link (opens in a new window) |
Law change timeline
No change recorded yet; the register updates after the monitor detects a change.