Domestics Laws and Policy

Across the five sub-regions, most countries regulate digital identity through broader digital governance, civil-registration, electronic-document or electronic-signature laws rather than through a single standalone digital ID statute. 

In South Asia, five countries (Bhutan, India, Nepal, Pakistan, and Afghanistan) have domestic legal or policy frameworks defining digital identity, and these vary widely in scope and substance.^[24] Governments generally follow two approaches: either enacting dedicated digital ID laws (as in Pakistan’s 2025 Digital Nation Act) or adapting existing civil registration laws to include digital or biometric elements (as seen in Sri Lanka). Where defined, digital identity is typically understood as a state-issued identifier linking demographic and often biometric data for authentication and service access, though some countries provide clear statutory definitions while others rely on operational or technical descriptions within ID systems like Aadhaar. These differences influence accountability mechanisms, with dedicated laws more likely to include formal grievance redress systems, whereas amended civil registration frameworks offer more limited recourse. Across the region, digital ID systems are closely tied to citizenship: in some countries they directly function as proof of nationality, while in others like India, they do not confer citizenship but still depend on citizenship documentation and effectively act as markers for accessing rights and services.

Across Southeast Asia, ten of eleven countries have legal or policy frameworks governing digital identity, though these vary in scope and structure.^[25] Only the Philippines and Viet Nam have adopted dedicated digital ID laws while others rely on broader legal regimes such as civil registration, digital government, or cybersecurity; Laos lacks specific digital ID legislation altogether. Digital identity is generally defined as electronic credentials or authentication systems used to verify individuals and enable secure access to services, and in most countries, it is built on existing civil registration or population databases rather than functioning independently. Unlike South Asia, digital identity is not explicitly defined as proof of citizenship in any country, instead it serves as a marker of legal identity or residency linked to national ID systems. While most countries provide avenues for complaints through general administrative systems or data protection authorities, none has established a dedicated grievance mechanism specifically for digital identity systems.

In East Asia, all six countries examined have legal or policy frameworks governing digital identity, though their approaches differ.^[26] China, Japan, and South Korea have recently introduced dedicated digital ID laws or amendments (between 2023 and 2025), reflecting the relatively nascent nature of these regulatory frameworks, while Hong Kong, Mongolia, and Taiwan rely on existing laws (particularly those on electronic signatures, data protection, and cybersecurity) to provide the legal basis for digital ID systems. In countries with dedicated legislation, digital identity is explicitly defined as an electronic authentication system using identifiers or certificates to verify individuals in digital transactions, with examples including China’s “internet number” and Japan’s My Number system. In contrast, countries without specific laws regulate digital ID through broader digital governance frameworks that recognize electronic signatures and set standards for identity verification. Across all six countries, digital ID is not legally linked to citizenship, as systems are designed to be accessible to both citizens and foreign residents based on proof of legal residency rather than nationality.

In the Pacific sub-region, only three countries (Australia, New Zealand, and Vanuatu) have established legal and policy frameworks governing digital identity, while the remaining countries are at early stages of development.^[27] Australia and New Zealand provide detailed statutory definitions, framing digital identity as an electronic means of authentication for accessing services and securely sharing personal data, whereas Vanuatu regulates its national ID system through multiple laws without explicitly defining digital identity. All three countries clearly separate digital identity from citizenship status. Samoa and Papua New Guinea have introduced legal or policy frameworks to support future digital ID systems, explicitly defining their structure and clarifying that digital ID does not confer citizenship. The rest of the region, including countries like Kiribati, the Marshall Islands, and Nauru, lacks dedicated legal definitions or frameworks, though some have general electronic transactions laws or national strategies that lay the groundwork for future digital ID implementation.

In Central Asia, digital identity is generally regulated through a mix of laws on identity documents, electronic government, electronic signatures, digital development, and data protection rather than through standalone digital ID legislation.^[28] Kazakhstan and Kyrgyzstan are exceptions, having adopted comprehensive Digital Codes that explicitly govern digital identity, biometric authentication, and digital public services, while Tajikistan, Uzbekistan, and Turkmenistan rely on broader legal frameworks such as electronic document and e-government laws, with Turkmenistan still lacking an operational digital ID system. Most countries provide general grievance mechanisms through administrative or data protection channels, but only Kazakhstan has a dedicated system for digital ID complaints, with its Digital Code mandating oversight of biometric data use and enforcement through inspections and penalties.

Across all sub-regions, domestic legal frameworks do not establish a direct statutory linkage between digital ID and citizenship. Both citizens and, in some countries, foreign residents can in principle access digital ID provided they have documentation proving legal residency. In practice, however, the requirement to possess foundational legal identity documents as a prerequisite for digital ID enrollment creates an indirect link to citizenship, since stateless persons and undocumented migrants typically lack such documents.

Dedicated complaint mechanisms remain rare. The Kazakhstan Digital Code mandates ministry-level review of complaints concerning biometric authentication and data processing,^[29] and Pakistan’s NADRA operates a centralized complaint-management system;^[30] most other countries rely on general administrative complaint pathways, data-protection authorities or agency help desks.

Table 3: Domestic legal framework for digital ID across Asia-Pacific

Data Protection

Data-protection frameworks vary widely. All East Asian countries except North Korea have established data protection and privacy laws, generally providing safeguards for the collection, processing, and use of personal data within digital ID systems, including consent requirements, purpose limitation, and security obligations.^[31] China, Taiwan, Mongolia, and South Korea maintain relatively comprehensive frameworks, with China’s Personal Information Protection Law and South Korea’s Personal Information Protection Act offering strong protections for sensitive data such as biometrics, alongside enhanced rights and oversight mechanisms. However, most countries lack explicit restrictions on government access to personal data collected through digital ID systems, as seen in Hong Kong’s framework. Despite robust legal regimes in some cases, concerns persist across the sub-region regarding surveillance risks, data breaches, and the growing use of AI, particularly in China’s state-controlled digital identity infrastructure, while North Korea remains an outlier with no data protection laws and pervasive state surveillance. 

Across the Pacific, most countries lack both digital ID systems and corresponding data protection frameworks, with only seven (Australia, Kiribati, New Zealand, Palau, Papua New Guinea, Samoa, and Vanuatu) having some form of legal or policy safeguards.^[32] Among these, Australia and New Zealand provide relatively comprehensive privacy regimes, though gaps remain, such as the absence of mandatory encryption and limited data erasure rights. Samoa and Vanuatu have more recent laws addressing data retention, security, and general safeguards, but weaknesses persist, particularly around biometric data regulation and government access. Papua New Guinea and Kiribati maintain broader data governance frameworks that only partially address digital ID concerns. Palau is notable for aligning its Digital Residency Program with ISO 27001 standards. Overall, uneven regulatory coverage and limited safeguards raise growing concerns about privacy risks, data misuse, and potential surveillance across the region.

In South Asia, the picture is uneven.^[33] Bhutan, India, Nepal, and Sri Lanka have data protection laws or policies, but only Bhutan’s National Digital Identity framework includes explicit, built-in safeguards for digital ID systems, such as user consent, encryption, and controlled access to biometric data. In contrast, India, Nepal, and Sri Lanka lack specific protections like mandatory encryption or robust safeguards governing the storage, use, and access to digital ID data. Across the region, significant concerns persist around privacy, surveillance, and exclusion, compounded by major data breaches in countries like India, Bangladesh, and Pakistan. Risks of state surveillance are particularly acute in contexts such as the Maldives, where digital ID metadata may be used to monitor individuals, and Afghanistan, where biometric data from e-Tazkira systems may be misused. Civil society in Sri Lanka and elsewhere has also warned that expansive digital ID systems could enable mass surveillance in the absence of strong legal protections.

Seven of eleven Southeast Asian countries (Malaysia, Singapore, Indonesia, Thailand, the Philippines, Viet Nam, and Brunei) have data protection or privacy laws that regulate personal data used in digital ID systems, generally requiring consent, imposing security measures, and offering complaint and enforcement mechanisms.^[34] However, Cambodia, Laos, Myanmar, and Timor-Leste lack comprehensive frameworks for digital ID, heightening risks of privacy violations, surveillance, and data misuse; with Myanmar’s UID Smart Card and biometric SIM registration schemes drawing particular concern. Across the sub-region, recurring problems include large-scale data breaches, expanded state surveillance powers, centralized population databases, and exclusion of those without digital credentials, illustrated by major leaks in Malaysia and the Philippines, cybersecurity and spyware abuses in Viet Nam and Singapore, and extensive surveillance using biometric and digital ID infrastructures in Myanmar, Thailand, and Brunei, often targeting migrants, refugees, stateless communities, LGBTI persons, and human rights defenders. 

All Central Asian countries have personal data protection or privacy laws that regulate the collection, processing, and protection of personal data, including biometrics used in digital ID systems.^[35] These frameworks generally require lawful and purpose-limited processing, consent, and security measures. In Kazakhstan, Kyrgyzstan, Uzbekistan, and Turkmenistan, biometric data is explicitly treated as sensitive and subject to heightened safeguards. Tajikistan’s 2018 Law on Personal Data sets out general protections but does not create a distinct higher-protection regime for biometrics. None of the five countries, however, restrict government access to personal data collected through digital ID, allowing state agencies broad access for national security, law enforcement, and administrative purposes. This contributes to ongoing concerns about privacy, surveillance, and data security, particularly in relation to large biometric databases and integrated identity platforms. Tajikistan’s and Uzbekistan’s laws, for example, require security measures but stop short of mandating encryption of digital ID and biometric data, despite documented risks.

Common concerns across the region include government surveillance and access to personal data, privacy risks from centralised biometric databases, breaches, and exclusion from public services for individuals without digital ID credentials. Government agencies are generally permitted to access data collected through digital ID systems for national-security, law-enforcement or public-administration purposes; none of the sub-regions has established clear legal prohibitions on such access. The most extensively documented case of digital ID related data misuse concerns Rohingya refugees. Human Rights Watch reported in June 2021 that, between 2018 and 2021, the Bangladeshi government submitted approximately 830,000 names with biometric data to Myanmar authorities, drawing on data UNHCR had collected during refugee registration without obtaining specific informed consent for that onward transfer.^[36] Surveillance concerns connected to digital ID and biometric systems have also been documented in China, Thailand, Singapore, Viet Nam, Maldives and Afghanistan.

Table 4: Domestic legal framework for data protection and privacy across Asia-Pacific

International Commitments

There is no international treaty specifically regulating digital identity systems. Most countries are, however, parties to international human rights treaties that create obligations relevant to legal identity, non-discrimination and access to essential services — including the ICCPR, ICESCR, CRC, CEDAW, CERD and CRPD. Article 7 of the CRC and Article 24(2) of the ICCPR are particularly relevant for birth registration; Article 24 ICCPR and Article 8 CRC for the right to identity.^[37]

Ratification of the Statelessness Conventions across the region remains low and uneven. 

Table 5: Ratification of Statelessness Conventions across Asia-Pacific

Regional and international digital governance frameworks provide further, albeit non-binding, structuring influences on digital ID policy. Japan, South Korea, Australia, New Zealand, the Philippines and Singapore participate in the APEC Cross-Border Privacy Rules system, which operates as a voluntary certification mechanism for cross-border data transfers. It also indirectly shapes standards for handling digital ID related personal data.^[38] Japan, South Korea and New Zealand are adherents to the OECD Recommendation on the Governance of Digital Identity, adopted in June 2023, which sets out principles for trusted, user-centred, and interoperable digital ID ecosystems.^[39] In Southeast Asia, states engage with ASEAN’s Framework on Personal Data Protection and the ASEAN Digital Economy Framework Agreement; while both instruments are non-binding, they signal a regional commitment to converging approaches on data protection and digital economy enablers, including digital identity.^[40]

At the multilateral level, commitments on civil registration and vital statistics form a key part of the normative environment for digital ID. States across the five sub-regions that endorsed the Ministerial Declaration adopted at the Third Ministerial Conference on Civil Registration and Vital Statistics in Asia and the Pacific have committed to a Decade of Action for Inclusive and Resilient CRVS. This includes registering every birth and death by 2030 and addressing the exclusion of digitally marginalised populations.^[41] This regional agenda links foundational CRVS reforms with the development of digital public infrastructure, reinforcing the expectation that digital-ID systems should support universal, non-discriminatory access to registration and services.
The CRC General Comment No. 25 (2021) is identified as the most directly applicable international interpretive instrument requiring that digital systems be designed so that all children can safely access essential public and educational services without discrimination.^[42] When read alongside core treaty provisions on birth registration and identity, this guidance positions digital ID and associated data-governance frameworks as central to states’ obligations to prevent exclusion, protect privacy. It also emphasises the need to ensure that stateless, undocumented or otherwise marginalized children are not left outside legal-identity and service-delivery systems.