Southeast Asia is absorbing more new data centre capacity than any region outside the United States, with little changing about who holds jurisdiction over the data inside. Kuala Lumpur alone carries roughly 7.7 GW in pipeline. India’s entire operational fleet, the whole country, sits at about 1,575 MW. The gap is not a measure of ambition, but it is of who the capacity is for. India builds for Indian demand. Southeast Asia builds to host workloads that belong to somebody else.

DC Byte’s Global Index read of the region, published this week, ranks Kuala Lumpur, Bangkok and Jakarta as the growth markets that best illustrate where APAC hyperscale is going next. Bangkok has around 2 GW under construction or committed, with another 4 GW in early stages and industry estimates of more than US$23 billion in proposed investment across the capital and the surrounding provinces. Jakarta has AWS, Google Cloud and Microsoft’s Indonesia Central region live, with DCI Indonesia, NeutraDC, STT GDC, Digital Edge, ByteDance and Alibaba Cloud all adding to the pipeline. The listed demand drivers are cloud adoption, AI workloads, enterprise digitisation, and growing data residency requirements. Yes. Residency requirements appear in the analysis as a reason to build. They are counted as demand.

Residency is a location fact

Where a rack sits and whose law reaches it are two different questions. Commerce Secretary Howard Lutnick set out the American position to lawmakers in unambiguous terms: allies can buy AI chips provided an approved American operator runs the data centre and the cloud touching that data centre is also an approved American operator. Under that condition, an AWS region in Jakarta satisfies Indonesian residency rules under GR 71/2019 and the PDP Law while remaining reachable through US legal process. The building is Indonesian. The operator is not. Indonesian data sits inside a facility on Indonesian soil, governed by contracts written under law Indonesia does not make.

Canada has spent three years learning this lesson with Palantir and CLOUD Act exposure, and Southeast Asia is learning it from a notoriously ornery negotiating partner while pouring the concrete.

Two stacks in the same industrial estate

Jakarta hosts AWS, Google and Microsoft. Jakarta also hosts ByteDance and Alibaba Cloud. Johor and Kuala Lumpur host both. This is the region’s foreign policy expressed as infrastructure: the same hedge ASEAN states run between Washington and Beijing diplomatically, poured into industrial parks.

The hedge is expensive to maintain. Malaysia placed high-performance US-origin AI chips on its Strategic Items List in July 2025, requiring a strategic trade permit and 30 days’ notice before any export, transhipment or transit, after allegations that Chinese engineers had rented Malaysian data centre capacity packed with Nvidia hardware to train models. The permit regime protects Malaysian access to American chips by policing Chinese access to Malaysian racks. Malaysia is doing American export enforcement on Malaysian soil, at Malaysian cost, to keep the build-out running.

Anwar’s 2026 budget addresses this with RM2 billion, around US$490 million, for a sovereign AI cloud, part of a wider RM5.9 billion AI research and commercialisation commitment. Against a 7.7 GW pipeline that number is small, and also the only line item in the Malaysian build-out that buys control rather than capacity.

Thailand has taken the other route. Alongside its hyperscale surge, Bangkok now faces an energy management screening committee, proposed foreign ownership restrictions delivered through licence reclassification, tighter utility and zoning audits, and a dedicated power tariff. The stated rationale is power and water, the mechanism is a foreign-control filter, and licence reclassification is significantly different from a residency rule.

The rulebook and the racks are arriving together

Vietnam passed Southeast Asia’s first binding AI law in December 2025, shortly after I moved to the region, effective March 2026, with risk-based classification and extraterritorial reach over foreign providers. Its Personal Data Protection Law took effect on 1 January 2026, layering cross-border transfer impact assessments onto what was already the region’s strictest localisation regime. Vietnam also has the least hyperscale capacity of the major ASEAN markets. The country with the most control over data has the least infrastructure to run it.

ASEAN concluded DEFA negotiations in Manila at the end of May 2026, with signing targeted for the 49th ASEAN Summit in November. It is the first region-wide digital economy agreement anywhere, and it commits members to trusted cross-border data flows, source code protection, and coordinated AI provisions.

Ten states are therefore signing a flows agreement in November while several of them tighten localisation through the same year. DEFA harmonises data moving out. National law pulls data back in. Whether those two survive contact will be the actual sovereignty story of 2027, and it will be settled in implementing regulations, not in the summit communiqué.

The cables: the map nobody ranks

Apricot and Echo, undersea cables carrying connectivity, were rerouted around Indonesia to avoid the South China Sea entirely. SJC2 lost years to Chinese permitting demands extending past internationally recognised territorial waters. Bifrost landed at Manado in North Sulawesi. Batam is now treated as a workable alternative to landing in Singapore. New systems increasingly run through the Java Sea and the Makassar Strait because the direct route has become a permitting hazard.

Indonesia’s archipelagic geography has turned into a neutrality asset. Cable consortia will pay for longer, shallower, more expensive routes to avoid asking Beijing for approval, and Indonesia’s own permitting regime, which pushed Apricot’s Indonesian segment out to 2027, is leverage those consortia now have to negotiate against.

That is real sovereign power, exercised over infrastructure the region physically controls. It doesnt appear in any growth-market ranking, because gigawatts are much easier to count and discuss than chokepoints.

What India shows by contrast

India moved from 375 MW in 2020 to roughly 1,575 MW today. The IndiaAI Mission has around 34,000 GPUs deployed and rents them to startups, researchers and government at approximately ₹65 per GPU-hour. DPDP Rules were finalised in November 2025 with compliance due by May 2027. G42 and Cerebras are building an 8-exaflop national system with C-DAC under Indian governance. OpenAI has taken 100 MW with Tata.

India has less capacity and more control, because Indian demand justifies Indian infrastructure and Indian rules can be enforced against a market nobody wants to exit. Southeast Asian states individually lack that leverage. Collectively, through DEFA and through the cable routes, they might have it.

The sovereignty test to apply here

Capacity is the wrong metric for a sovereignty claim. Four questions do more work:

• Whose legal process reaches the data at rest in the facility
• Who can suspend the service, and under whose authority
• Whether the state can run its own critical workloads if the operator withdraws
• Who controls the physical path the traffic takes to leave the country

By those measures, Kuala Lumpur’s 7.7 GW is a commercial achievement and a sovereignty liability, Vietnam’s binding law is a sovereignty asset with nowhere to run, and Indonesia’s cable geography is the most underrated position in the region.

The build-out is happening either way. The question is whether ASEAN uses DEFA to write jurisdiction rules into it before November, or ratifies flows and settles the jurisdiction question later, by which point the racks are in the ground and the operators have the contracts.

Sources: DC Byte, Southeast Asia’s Top Future-Growth Data Centre Markets (5 August 2026); MITI Malaysia strategic trade permit statement (14 July 2025); Asia Society Policy Institute on Malaysia’s data centre strategy; ASEAN DEFA conclusion, 57th SEOM Manila (May 2026); Carnegie Endowment and CSIS on Southeast Asian subsea cables; Lok Sabha reply on Indian data centre capacity (5 August 2026); IndiaAI Mission.