Regional Overview Regional Overview Country Comprehensive data-protection / privacy law? (yes/ no) Biometric data treated as sensitive? North Korea ⛔ ⛔ South Korea ✅ ✅ Taiwan ✅ ✅ Notable gaps/risks for digital ID Country No data protection law identified; pervasive state surveillance and no meaningful privacy safeguards. Sri Lanka Concerns around data breaches and expanding digital ID linked state and private-sector use. Concerns around digital ID security and cybersecurity threats still present. Comprehensive data-protection / privacy law? (yes/ no) ✅ Biometric data treated as sensitive? Notable gaps/risks for digital ID No clear Civil society has warned that large-scale digital biometric identity could enable mass surveillance absent safeguards stronger protections. SUB REGION - SOUTHEAST ASIA Brunei ✅ Cambodia ⛔ ⛔ SUB REGION - SOUTH ASIA No clear Centralised identity infrastructure and surveillance biometric concerns remain, especially for vulnerable groups. safeguards No comprehensive framework; heightened risks of privacy violations, surveillance and misuse of digital identity data. Afghanistan ⛔ Unclear High risk of misuse of biometric data from e-Tazkira systems; no robust privacy safeguards in practice. Bangladesh ⛔ Unclear Major breach and data-sharing concerns, including Rohingya biometric data transfer; weak specific safeguards for digital ID. Indonesia ✅ Partly Bhutan ✅ ✅ The privacy provisions ensure that the data collected at the time of registration is stored and safely secured, creating accountability on those involved in the process Laos ⛔ ⛔ Malaysia ✅ Partly Myanmar ⛔ ⛔ Philippines ✅ Partly Comprehensive law exists, but PhilSys-related breach and exclusion risks remain significant. Singapore ✅ Partly Strong legal framework, but spyware/cybersecurity concerns and broad state digital integration raise persistent risks. Thailand ✅ Partly Privacy law exists, but biometric and digital ID infrastructures have been linked to surveillance and exclusion risks. India Maldives Nepal Pakistan ✅ ⛔ ✅ ⛔ No clear Major breach risks, inadequate safeguards on biometric storage/use/access, and broad state-linked safeguards surveillance concerns. Unclear Metadata and digital ID linked systems may be used for monitoring; safeguards remain limited. No clear Data-protection measures exist, but no strong biometric encryption or digital ID specific limits on storage, use safeguards and access. Unclear Significant breach risks and limited dedicated safeguards for digital ID related personal data. Data-protection law exists, but risks remain from centralised databases, exclusion, and uneven implementation. No comprehensive framework for digital ID; limited safeguards and elevated privacy risks. Legal protections exist, but major data leaks and implementation gaps continue to raise concerns. Extremely high surveillance and misuse risks linked to UID Smart Card and biometric SIM registration; no meaningful comprehensive privacy protection. 42 43 STATELESSNESS ENCYCLOPEDIA ASIA PACIFIC THIRD EDITION - REGIONAL OVERVIEW REPORT 2026