Southeast Asia is sleepwalking into a data sovereignty crisis
US hyperscalers and Chinese internet giants are investing big, but the region is ceding data ownership
Welcome back to Asia Tech Review, your curated digest to keep up to date with tech news across Asia.
We’ve seen a lot of cloud and AI deals in Southeast Asia recently, but the region looks like it’s taking the short-term option rather than the harder long-term around data sovereignty. We take a deeper look into the topic today.
To keep up with our issues, follow us on LinkedIn or WhatsApp. Please do share Asia Tech Review with people you know who want to get smart about Asia tech.
A data sovereignty crisis is looming in Southeast Asia
The world’s biggest economies are moving to control where sensitive data is stored, who can access it and which laws govern it. Southeast Asia, by contrast, is sleepwalking into a digital crisis.
We’ve been here before in Southeast Asia. Platforms like Facebook and Google brought a global standard for how its 400 million internet users communicate. That opened up business and global conversation, but thorny issues around content removal, censorship and ad approvals were effectively outsourced to private companies in California.
That shaped politics, society and daily life across the region, but the data sovereignty question could reach even further. Data is now a national security issue. Businesses increasingly treat data as both intellectual property and the basis for future growth, planning and competitive advantage. Storing that data with an overseas provider, then processing it through AI systems built elsewhere, creates obvious strategic risks.
That helps explain why many of the world’s biggest economies are trying to build sovereign data and AI stacks of their own, with tighter control over how critical data is stored, processed and governed. Southeast Asia, however, is entering the AI era as a host, not an owner, and that could have major implications.
Sovereign data plays emerge
Europe may be the best example as the region unites to reduce its exposure to US hyperscalers. Amazon Web Services (AWS), Google Cloud and Microsoft Azure dominate the global cloud market, but they’re subject to the US CLOUD Act. This legislation can compel them to provide data regardless of where it is stored.
It isn’t only the US. Canada has laws that have been used to force European companies to provide data while China, a major presence in Southeast Asia, is well known for its data control.
The concern is real. Hyperscalers have become the norm for any business seeking quick and easy cloud storage. These services are used for all types of data from personal information from consumers right to more sensitive details from government agencies, healthcare systems, financial institutions and more. Even a low chance of data being accessed is a major systemic risk.
In response, European cloud providers are developing ‘sovereign’ alternatives to US products, which differentiate by storing data locally. But adoption is tough as the products are less mature and struggle for distribution.
There’s also a key piece missing, and that’s AI. Concern is not just around how data is stored, but also how it is processed. That’s crucial for sovereignty and that’s where European AI providers like Mistral are trying to push their credentials as an option for European businesses, governments and other institutions.
The ‘sovereign stack’ is less mature in India, but the country is championing homegrown AI services, with Sarvam gaining momentum. Yotta, India’s largest operator of Nvidia chips, is preparing for an IPO as it builds out what it calls a sovereign data infrastructure.
Selling the cloud, not building it
Southeast Asia isn’t just sitting still on developing alternatives, it is actively helping hyperscalers to entrench themselves.
Amazon, Microsoft, Google, Alibaba, TikTok and others have pledged to spend tens of billions of dollars on AI and cloud spending in Thailand, Indonesia, Malaysia and beyond in the coming years.
Southeast Asia may not have the capacity to develop alternatives, but it has stepped up with legal frameworks. Vietnam is the region’s strictest. It mandates local data storage and access, a challenging topic for US firms like Google and Facebook who balanced the value of the market with complying with local demands.
But Southeast Asia is a loose political union, composed of rival nations who are competing for investment from US, Chinese and other overseas data companies. Winning mega contracts, like TikTok’s planned $25 billion infrastructure deal, is likely to trump any longer term concerns around data access and security.
Moody’s Ratings recently forecast that South and Southeast Asia’s data centre industry will grow at 24% per year over the next 4-5 years
New era, same story
The current situation feels remarkably like the previous digital era of social media and mobile messaging. In both eras, Southeast Asia was an important region that represented a large and highly engaged user base with strong growth potential. That was important for convincing public markets or private investors of global revenue and adoption opportunities.
The region embraced platforms like Facebook and WhatsApp, often topping active user charts, but that led to countries ceding control of the discourse to overseas platforms.
Former Philippines president Rodrigo Duterte used Facebook heavily in his rise to power in 2016, leaning on its advertising, community building and some alleged disinformation. In Thailand, meanwhile, critical information from the government, its police and armed forces flows freely through messaging app Line.
Southeast Asia lost its digital sovereignty to these platforms, but more is at stake with the cloud and AI.
In other news you won’t want to miss:
Xiaomi committed $8.8 billion to funding AI technology over the next three years [South China Morning Post]
Huawei claims it has found a way to close its roughly five-year gap with TSMC, a move that could change assumptions in the chip manufacturing industry if successful [Bloomberg]
India’s Udaan, the e-commerce platform, is said to be raising $50-60 million from existing backers M&G Prudential and Lightspeed Venture Partners at a flat $1.8 billion valuation, the deal is reportedly a pre-IPO round [Economic Times]
Indonesia blocked prediction market platform Polymarket as it continues to crack down on online betting [The Block]
China will assign every domestically made humanoid robot a unique digital ID, tracking each machine from production to recycling [South China Morning Post]