Chinese Data Centers Shape ASEAN AI Norms, Analyst Says

September 21, 2026 at 12:11 PM2 min

This digest was compiled by AI from multiple sources — links to the originals are below.

Alibaba Cloud opened two data centers in Johor, Malaysia in June, bringing its total in the country to five. The expansion came four months after ASEAN endorsed a Malaysia-led framework on cross-border cloud computing. The region's growing reliance on Chinese infrastructure may embed norms shaped by Chinese law and opaque safeguards against cyber misuse.

Key Facts

Alibaba Cloud opened two data centers in Johor, Malaysia in June, bringing its total in the country to five.
ASEAN endorsed a Malaysia-led framework governing cross-border cloud computing four months before the Johor opening.
Chinese cloud providers operating abroad must comply with China's Cybersecurity Law, Data Security Law, and National Intelligence Law.
U.S. prosecutors used similar legal obligations to build a case against Chinese intelligence officer Xu Yanjun.

Data Center Expansion

Alibaba Cloud opened two data centers in Johor, Malaysia in June, bringing its total in the country to five. The opening came four months after ASEAN endorsed a Malaysia-led framework governing cross-border cloud computing. The framework set regional principles for data protection, regulatory access, and cross-border data hosting. Chinese cloud providers have expanded their footprint in Malaysia and Indonesia through partnerships with governments and businesses.

Norm Diffusion

The region's growing reliance on Chinese infrastructure may embed norms shaped by Chinese law and comparatively weak or opaque safeguards against cyber misuse. Chinese-developed models may disclose less about such safeguards, even as Beijing tightly controls politically sensitive content. Cloud providers can influence technical practices beyond their own facilities, as firms and agencies building on their platforms must meet requirements for access, configuration, and security. Dependency through platform lock-in allows this influence to become durable within systems and creates a risk that the government could lose practical control over its use of those systems.

Legal Obligations

Even when operating abroad, Chinese cloud providers must comply with China's Cybersecurity Law, Data Security Law, and National Intelligence Law. These laws create pathways for the Chinese government to compel access to data deemed relevant to national security, not unlike the USA PATRIOT Act, CLOUD Act, and FISA 702. Those same obligations helped U.S. prosecutors build their case against Chinese intelligence officer Xu Yanjun.