Quick answer
Is it legal to buy and use residential proxies in South and Southeast Asia?
Buying a residential proxy to view public web pages is not, in itself, an offence in the 14 countries we cover; the use is what counts. Personal data falls under laws such as India's Digital Personal Data Protection Act, 2023 or Singapore's PDPA 2012. Fraud, intrusion and spam are crimes everywhere. Checked October 2026; not legal advice.
Which data protection law and digital tax apply in each country?
As read in October 2026. A law that is not yet fully in force can still shape what clients expect from you.
| Country | Data protection law | Tax on digital services | Currency |
|---|---|---|---|
| India | Digital Personal Data Protection Act, 2023 (Rules notified November 2025; main duties apply from May 2027) | 18% GST on digital services supplied to India | Indian rupee (INR) |
| Indonesia | Law No. 27 of 2022 on Personal Data Protection, in full effect since 17 October 2024 | 12% VAT on foreign digital services, charged on an 11/12 base (11% in effect) | Indonesian rupiah (IDR) |
| Philippines | Data Privacy Act of 2012 (Republic Act No. 10173), enforced by the National Privacy Commission | 12% VAT on digital services from non-resident providers (Republic Act 12023, effective 2 June 2025) | Philippine peso (PHP) |
| Thailand | Personal Data Protection Act 2019, in full force since 1 June 2022 | 7% VAT (reduced from 10% until 30 September 2027), applied to foreign e-services above THB 1.8 million a year | Thai baht (THB) |
| Vietnam | Law No. 91/2025/QH15 on Personal Data Protection, in force since 1 January 2026, with Decree 356/2025/ND-CP | 10% VAT on digital services sold into Vietnam by foreign suppliers since 1 July 2025 | Vietnamese dong (VND) |
| Malaysia | Personal Data Protection Act 2010, as amended in 2024 (changes in force in three phases during 2025) | 8% service tax on digital services from foreign providers since 1 March 2024 | Malaysian ringgit (MYR) |
| Pakistan | No dedicated data protection act yet (the Personal Data Protection Bill is still a draft); the Prevention of Electronic Crimes Act 2016 applies | Sales tax on services set by each province, generally about 15% to 16% | Pakistani rupee (PKR) |
| Bangladesh | Personal Data Protection Ordinance, 2025 (gazetted November 2025) | 15% VAT on electronic services supplied to Bangladesh | Bangladeshi taka (BDT) |
| Sri Lanka | Personal Data Protection Act No. 9 of 2022, amended in 2025 (main provisions not yet in force) | 18% VAT, extended to digital services from non-residents from 1 July 2026 | Sri Lankan rupee (LKR) |
| Nepal | Individual Privacy Act, 2018, with the Individual Privacy Regulation, 2020 | 13% VAT, plus a 2% digital services tax on non-resident providers | Nepalese rupee (NPR) |
| Cambodia | No comprehensive data protection law yet: a draft Law on Personal Data Protection was still under consultation in 2025; privacy rules sit in the Constitution, Civil Code and E-Commerce Law | 10% VAT, charged by registered foreign suppliers of digital services | Cambodian riel (KHR), with the US dollar widely used |
| Singapore | Personal Data Protection Act 2012, enforced by the Personal Data Protection Commission | 9% GST, charged by overseas vendors of remote services above SGD 100,000 of local sales | Singapore dollar (SGD) |
| Australia | Privacy Act 1988, with 13 Australian Privacy Principles | 10% GST on digital products sold to Australian consumers | Australian dollar (AUD) |
| New Zealand | Privacy Act 2020, in force since 1 December 2020 | 15% GST on remote services sold to New Zealand consumers | New Zealand dollar (NZD) |
What changes when my checks collect personal data?
Prices, stock levels, ads and search rankings are business data. Names, phone numbers, faces, reviews tied to a person or account details are personal data. Once a job stores personal data about people in one of these countries, that country's law may apply to you even if you are abroad: Vietnam's 2025 law, Indonesia's Law No. 27 of 2022 and Malaysia's amended Act all reach processing that affects their residents. Keep jobs to the data you need, and delete what you do not.
Which laws are new or still changing?
- India: the Digital Personal Data Protection Rules were notified in November 2025; the main duties apply from May 2027.
- Vietnam: Law No. 91/2025/QH15 took effect on 1 January 2026, with Decree 356/2025/ND-CP.
- Malaysia: the 2024 amendments came into force in three phases in 2025.
- Sri Lanka: the 2022 Act, amended in 2025, is not fully in force.
- Bangladesh: a Personal Data Protection Ordinance was gazetted in November 2025.
- Pakistan and Cambodia: data protection bills are still drafts.
What does the tax column mean for me?
It shows the tax a foreign seller of digital services usually charges consumers in that country, which is why local prices on marketplaces and apps include VAT or GST. It does not change the price of Banyan Proxies plans, which are sold in USD.
What do the Banyan Proxies rules add?
Our Acceptable Use Policy applies on top of local law: Banking, government and payment-portal sites, plus SMTP (email-sending) ports 25, 465 and 587 are blocked, and fraud, intrusion, spam and attacks end an account. Some countries are not available, for legal or sourcing reasons, including countries and regions under comprehensive sanctions.
Which of our policies apply as well?
The terms of service, the privacy policy and the Acceptable Use Policy apply on top of local law. Each country overview on the city index repeats its law and tax.
What else do buyers ask about local rules?
Is web scraping legal in India?
Collecting public web data is not banned as such, but the Information Technology Act 2000 punishes unauthorised access, and the Digital Personal Data Protection Act, 2023 governs personal data. Respect each site's terms and technical limits. This is not legal advice.
Do I need to register anything to use proxies in these countries?
We know of no country in this list that asks a user to register before viewing public pages through a proxy. The rules apply to what you collect and how you use it. This is not legal advice.
Why is mainland China not covered?
For legal and sourcing reasons. Some countries are not available, for legal or sourcing reasons, including countries and regions under comprehensive sanctions.
Where do these facts come from? (28)
- Digital Personal Data Protection Act, 2023 (overview and Rules timeline) (2026-10-18)
- India Briefing: GST on digital (OIDAR) services (2026-10-18)
- DLA Piper Privacy Matters: new SE Asia data protection laws (October 2024) (2026-10-18)
- Ortax: latest PPN PMSE rules (23 July 2025) (2026-10-18)
- Data Privacy Act of 2012 (2026-10-18)
- GMA News: VAT on foreign digital services (3 October 2024) (2026-10-18)
- DLA Piper: data protection laws of Thailand (2026-10-18)
- PwC Tax Summaries: Thailand, other taxes (2026-10-18)
- LuatVietnam: Law on Personal Data Protection and guiding documents (2026-10-18)
- PwC Tax Summaries: Vietnam, other taxes (2026-10-18)
- DFDL: implementation of the PDP (Amendment) Act 2024 (2026-10-18)
- RegFollower: Malaysia service tax on digital services rises to 8% (2026-10-18)
- DLA Piper: data protection laws of Pakistan (2026-10-18)
- PwC Tax Summaries: Pakistan, other taxes (2026-10-18)
- Prothom Alo: Personal Data Protection Ordinance gazetted (2026-10-18)
- PwC Tax Summaries: Bangladesh, other taxes (2026-10-18)
- Personal Data Protection Act (Sri Lanka) (2026-10-18)
- Sri Lanka VAT guidelines (digital services from 1 July 2026) (2026-10-18)
- DLA Piper: data protection laws of Nepal (2026-10-18)
- PayPro Global: Nepal VAT and digital services tax (2026-10-18)
- DLA Piper: data protection laws of Cambodia (2026-10-18)
- PwC Tax Summaries: Cambodia, other taxes (2026-10-18)
- DLA Piper: data protection laws of Singapore (2026-10-18)
- PwC Tax Summaries: Singapore, other taxes (2026-10-18)
- OAIC: the Privacy Act (2026-10-18)
- PwC Tax Summaries: Australia, other taxes (2026-10-18)
- Privacy Act 2020 (2026-10-18)
- IRD: GST for overseas businesses (2026-10-18)