By Prof Dr Evelyn S Devadason
Digital trade presents ASEAN and India with an important new frontier for economic cooperation. This collaboration is particularly significant as ASEAN shifts towards a more services-oriented economic model, with digitally delivered services accounting for approximately half of the region’s trade in services. Stronger digital trade connections with India could help ASEAN expand higher-value activities, improve firm competitiveness and embed services more deeply within regional manufacturing and commercial networks.
The scope for engagement is both natural and complementary. India has emerged as a major hub for information-technology (IT) services, including software development and IT consulting, as well as digital platforms and large-scale digital public infrastructure. ASEAN, meanwhile, is deeply integrated into global electronics and semiconductor supply chains. This complementarity is reflected in their trade positions: ASEAN maintains a surplus with India in ICT goods, including hardware and electronic components, while India holds a stronger position in ICT-related services, particularly computer and other business services. ASEAN’s digital trade connections with India are currently concentrated in Singapore, Malaysia and Vietnam, suggesting considerable scope to broaden participation across the region.
Realising this potential will require more than connecting complementary industries. ASEAN-India digital trade remains constrained by regulatory, technical, financial, logistical, institutional and capability-related frictions. These obstacles increase the cost, time, complexity and uncertainty of cross-border transactions. They are particularly burdensome for small and medium enterprises (SMEs), which have fewer resources to navigate different regulatory regimes, payment systems, technical standards and licensing requirements.
Against this backdrop, the conclusion of negotiations on the ASEAN Digital Economy Framework Agreement (DEFA) provides a timely opportunity. India could position itself as an important external implementation partner for ASEAN’s digital-services agenda. The objective would not be to replicate DEFA or interfere with its ASEAN-led character, but to make Indian regulations and digital systems interoperable with the emerging regional framework.
A practical starting point would be a supplementary digital trade protocol under the ASEAN-India Trade in Services Agreement (AITISA), which predates many contemporary digital trade issues. Aligned with DEFA, the protocol could establish priority commitments on electronic transactions, digital payments, digital identity, cybersecurity, online consumer protection, artificial intelligence (AI) governance and market access for computer and other business services. An ASEAN-India Digital Economy Cooperation Framework could support implementation through regulatory dialogue, common technical standards and sector-specific pilot projects. Designing this framework, however, requires a clear understanding of where Indian and ASEAN regulatory approaches diverge.
Navigating Regulatory Fault Lines
Closer cooperation must address the risk of digital protectionism. Regulations protecting personal data, cybersecurity, financial stability and consumers serve legitimate public interests. They become digital trade frictions when they discriminate against foreign suppliers, require unnecessary localisation or impose disproportionate and duplicative compliance costs.
The most significant misalignment concerns data governance. DEFA seeks to facilitate trusted cross-border flows of non-sensitive commercial data and minimise localisation requirements, subject to legitimate public-policy exceptions. India, however, applies a more layered framework. Section 16(1) of the Digital Personal Data Protection (DPDP) Act 2023 generally permits overseas transfers of personal data unless the government restricts specified destinations, while Section 16(2) preserves stricter requirements imposed by other laws or sectoral regulators. The Reserve Bank of India’s 2018 circular, for example, requires authorised payment-system providers to store the entire dataset relating to their Indian payment operations in India.
The two sides also use different mechanisms to govern personal-data transfers. ASEAN’s voluntary Model Contractual Clauses (MCCs) provide a standard framework for allocating responsibilities between data exporters and recipients, but India does not recognise these clauses as automatically satisfying its domestic requirements. An ASEAN firm using the MCCs must still assess the DPDP Act, relevant sectoral rules and any additional storage or contractual obligations. Cloud, financial-technology, medical-analysis and other data-dependent providers may consequently need separate infrastructure and compliance arrangements for India and ASEAN.
Cybersecurity and platform regulation create further differences. India’s 2022 CERT-In Directions, issued under Section 70B (6) of the Information Technology (IT) Act 2000, require specified cyber incidents to be reported within six hours and relevant system logs to be retained for 180 days within Indian jurisdiction. ASEAN countries apply their own reporting, audit and licensing regimes. Malaysia’s Cyber Security Act 2024, for example, establishes obligations for national critical information infrastructure and, under Section 27, licensing requirements for specified cybersecurity services. Providers operating across both markets may therefore face separate procedures for the same activities.
Rule 4 of India’s Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules 2021 requires significant social-media intermediaries (SSMIs) to appoint an India-resident chief compliance officer, nodal contact person and grievance officer, and to publish periodic compliance reports. India’s 2020 Consolidated FDI Policy (Section 5.2.15.2.3) also permits 100% foreign investment under the automatic route in marketplace-based e-commerce but prohibits it in the inventory-based model. ASEAN platforms combining third-party marketplaces with direct retail may therefore need to establish a local compliance presence and restructure their operations before entering India. Indian firms expanding into ASEAN similarly encounter different national requirements governing platforms, foreign ownership, taxation, payments and consumer protection.
Regulated digital products may also undergo repeated national assessments. AI-enabled medical-device software (SaMD), for example, may require approval under India’s Medical Devices Rules 2017 and Malaysia’s Medical Device Act 2012 even where much of the underlying technical and clinical evidence overlaps. Misalignment thus occurs between India and DEFA’s regional direction, between India and individual ASEAN members, and among ASEAN countries themselves.
The appropriate response is managed interoperability rather than regulatory uniformity. ASEAN and India should develop a mapping guide for their data-transfer regimes, compatible cyber-incident reporting procedures and transparent platform-entry requirements. Standard data-transfer contracts and regulatory reliance or mutual recognition for selected privacy, cybersecurity and technical assessments could reduce duplication, while additional safeguards remain in place for sensitive health and financial information. This would preserve each party’s right to regulate without allowing legitimate public-policy measures to become disguised barriers to digital trade.
Existing cooperation with Singapore and emerging or potential arrangements with Malaysia provide practical settings in which managed interoperability can be tested.
From Regional Rules to Investible Projects
India-Singapore cooperation offers a useful starting point. Chapter 10 of the India-Singapore Comprehensive Economic Cooperation Agreement already addresses electronic commerce through provisions on the electronic supply of services, digital products, exceptions and regulatory transparency. Although these commitments provide a bilateral foundation, they are less comprehensive than the rules emerging under DEFA. Modernising the chapter could therefore create a regulatory pilot for a wider ASEAN-India digital trade protocol.
Several existing initiatives demonstrate how interoperability can work in practice. The Unified Payments Interface (UPI)-PayNow linkage, launched in 2023, has facilitated faster person-to-person cross-border payments. Connectivity between India’s Open Network for Digital Commerce (ONDC) and Singapore’s Proxtera gives SMEs another channel through which to identify customers and suppliers across borders. TradeTrust has demonstrated how interoperable electronic bills of lading can support cross-border trade-finance transactions. Together, these initiatives connect payments, business discovery, documentation and financing rather than treating each element of digital trade separately.
Cybersecurity cooperation provides another component of this emerging architecture. The inaugural India-Singapore Cyber Policy Dialogue was held in October 2024, while cooperation between their computer emergency-response teams supports more secure digital transactions. Together, these payment, documentation and cybersecurity arrangements provide important institutional foundations for digital trade. Yet rules and interoperable systems will not generate commercial activity automatically; firms must also invest in the platforms, infrastructure, technology, skills and business networks needed to use them.
Investment is therefore a central, though sometimes overlooked, driver of digital trade. It finances data infrastructure and software development, enables digital firms to establish a commercial presence abroad and connects start-ups and SMEs to larger regional business networks. It can also embed digitally delivered services within manufacturing, finance, healthcare and logistics value chains.
Singapore illustrates the relationship between investment and digital trade. In 2024-25, it was India’s largest source of foreign direct investment (FDI), with flows of approximately US$14.94 billion. Cumulative Singaporean FDI into India reached US$179.48 billion between April 2000 and June 2025, representing about 24% of India’s total inflows. Major recipient sectors included services, computer software and hardware, telecommunications and pharmaceuticals. Meanwhile, approximately 9,000 Indian companies are registered in Singapore, using its financial and business ecosystem to access capital, professional services and Southeast Asian markets. These investment and commercial links support the firms and infrastructure that use initiatives such as UPI-PayNow, ONDC-Proxtera and TradeTrust.
Nevertheless, large investment figures should not be treated as proof that digital integration is automatically deep or inclusive. Some investments may involve financial intermediation or acquisitions that generate limited technology transfer, capability development or SME participation. Policy should favour investments that create productive capacity, develop skills, connect local suppliers, support joint intellectual property and expand regional market access. Success should be measured not simply by capital committed, but by the resulting services, business linkages and sustained cross-border trade.
The India-Singapore experience should inform, rather than be transferred unchanged to, wider ASEAN-India cooperation. ASEAN economies differ in regulatory capacity, digital infrastructure, industrial structure and SME readiness. Replication should therefore focus on functional outcomes, such as lower-cost payments, verifiable electronic documents and trusted data transfers, while adapting implementation to national conditions. Malaysia, for example, offers an opportunity to test a more sector-specific model linking India’s digital capabilities with Malaysia’s manufacturing strengths.
Modernising the 2011 Malaysia–India Comprehensive Economic Cooperation Agreement (MICECA) could incorporate e-commerce, SME participation, paperless trade and supply-chain resilience while providing an enabling framework for sector-specific partnerships. The linkage between India’s UPI and Malaysia’s DuitNow QR system illustrates how bilateral commitments can be converted into practical digital connectivity. With Phase 1 completed, Indian travellers can use participating UPI-enabled applications at supported DuitNow QR merchants in Malaysia; the next phase would extend reciprocal payment access to Malaysian users in India.
This progress provides a useful proof of concept, but payment connectivity represents only one component of digital trade cooperation. Extending this implementation-oriented approach to data governance, cybersecurity, digital skills and AI will require sustained institutional coordination. High-level agreements and policy dialogues will not necessarily produce tangible commercial outcomes unless they are translated into implementable projects, clear timelines and measurable targets. The Malaysia-India Digital Council, operationalised as a government-to-government mechanism with industry participation, could perform this delivery role across its four pillars of digital public infrastructure, cybersecurity, digital talent and AI.
Rather than functioning primarily as a forum for policy exchanges, the Council could identify obstacles faced by firms, select joint pilot projects, designate responsible agencies and mobilise supporting investment. It should track outcomes such as interoperable payments, approved data-transfer mechanisms, jointly developed technologies, SME participation, private capital committed and products successfully deployed. MICECA would provide the enabling trade framework, while the Council would translate high-level commitments into commercial cooperation.
AI-enabled medical-device software (SaMD) offers one concrete pilot. Indian firms could develop diagnostic, monitoring and device-management software, drawing on India’s strengths in software engineering, cloud computing and medical-data analytics. Malaysian manufacturers could integrate these applications into imaging equipment, wearable sensors, laboratory instruments and other connected devices, while Malaysian hospitals and research institutions undertake clinical validation and product adaptation.
Investment would be required at each stage. Indian firms would need to finance software development, algorithm testing and secure cloud services. Malaysian partners would need to support device integration, manufacturing capacity and regulatory compliance. Hospitals and research institutions would require resources for clinical validation, while distributors would need customer training and after-sales networks. Public co-financing or risk-sharing could help early-stage firms participate, but private investment would ultimately be necessary to move successful products from testing to commercial scale.
Following deployment, Indian providers could supply algorithm updates, cloud-based analysis and remote technical support, while Malaysian partners manage production, regional distribution, customer training and after-sales services. This would create a two-way digital-services value chain rather than a one-directional export of Indian software or Malaysian hardware. Jointly developed technologies could subsequently be supplied across ASEAN and third markets.
A cross-border regulatory sandbox could facilitate development and commercialisation. Malaysia’s Medical Device Authority (MDA) and India’s Central Drugs Standard Control Organisation could coordinate requirements for clinical validation, algorithm performance, data protection, cybersecurity, human oversight and post-market monitoring, while retaining authority over final domestic approvals. Evidence generated in one country could be considered by the other, reducing unnecessary duplication without weakening patient-safety standards. Crucially, the sandbox should establish clear criteria for graduation, regulatory approval, investment mobilisation and market deployment; otherwise, it risks generating experimentation without reducing firms’ actual costs or uncertainty.
Regulatory cooperation must also extend beyond market entry to post-market surveillance. Stronger digital market surveillance could help prevent unregistered, falsified and counterfeit devices from reaching consumers through online platforms. Rather than duplicating Malaysia’s existing safeguards, India could assist through the Malaysia-India Digital Council by supporting interoperable device registries, seller-verification systems and platform-compliance tools. Indian technology firms could contribute AI-based monitoring to flag suspicious listings and misuse of registration information, while regulators and cybersecurity agencies strengthen intelligence sharing, coordinated takedowns and recalls, and the secure exchange of digital evidence.
Building Regional Digital-Services Value Chains
The scale of India’s digitally delivered services provides a commercial base from which bilateral pilots could be extended regionally. In 2025, India accounted for approximately 10.5% of global computer-services exports and 8.3% of global other-business-services exports. These two categories represented 38.2% and 55.5%, respectively, of India’s digitally delivered services exports.
Cooperation should therefore move beyond a model in which India simply exports IT services to ASEAN. The greater opportunity lies in establishing regional digital-services value chains. Indian firms could contribute software engineering, cloud services, AI and data analytics, while ASEAN partners provide sectoral expertise, manufacturing capabilities, investment networks and customer access. Joint offerings could encompass cybersecurity, AI-enabled medical analysis, industrial software, digital financial services, engineering design, accounting, consulting and supply-chain analytics.
A successful ASEAN-India strategy must bring together four elements: compatible rules, interoperable systems, productive investment and firm-level capabilities. Rules reduce uncertainty; interoperability lowers transaction costs; investment finances market entry and commercial scaling; and firm capabilities determine whether businesses can exploit the resulting opportunities. Weakness in any one element can prevent high-level cooperation from producing meaningful trade outcomes.
DEFA will remain an ASEAN-led framework, but its integration gains can be complemented by compatible external partnerships. By modernising the ASEAN-India services architecture, enabling trusted data flows, connecting digital systems, mobilising productive investment and supporting joint production, ASEAN and India can transform their existing digital links into deeper economic integration and make digital trade a substantive pillar of their relationship.
The author is a Professor at the Faculty of Business and Economics, Universiti Malaya, and Vice-President of the Malaysian Economic Association. She also serves as an IDEAS Senior Fellow in international trade, investment and regional integration.
