Global norms and regional innovation: <i>GDPR</i> , evolution of data protection in ASEAN and the legal trajectory of AI in Vietnam

Abstract Personal data protection has emerged as a defining challenge of the digital age, particularly with the rise of artificial intelligence (AI) and the increasing reliance on cross­border data flows. The European Union’s General Data Protection Regulation ( GDPR ) has set a global benchmark in this field, with its extraterritorial scope—the so-called Brussels Effect—provoking extensive debate worldwide. In ASEAN, with its accelerating digital transformation and economic integration, data protection laws are being reshaped under both global influences and local priorities. This study aims to identify the factors that have enabled GDPR standards to influence evolving legal frameworks of ASEAN and to examine how its member states are responding to global pressures, while simultaneously addressing the distinct challenges of data governance and regional data integration. Using a doctrinal and comparative approach, the study analyzes the personal data protection frameworks of ASEAN­6, with Vietnam highlighted as a distinctive case. Vietnam stands out for explicitly integrating AI­related provisions into its Personal Data Protection Law , reflecting both the influence of the GDPR and a localized adaptation aligned with strategies for national digital transformation. By examining ASEAN’s varied legal responses and Vietnam’s unique trajectory, the findings underscore the dynamic interplay between global standards and regional innovation. The article contributes insights for policymakers, businesses and scholars navigating data governance in the digital future of Southeast Asia.