government services, with the region's E-government Development Index (EDGI) in 2022 being higher than the world average. However, this bolstered digital capacity also serves as an instrument for state repression, infringing on citizens' rights. Over the past decade, most Southeast Asian countries have bolstered their capabilities for digital repression. The emergence of social media as a tool for social movements, exemplified by the Arab Spring and Thailand's PDRC protest, has incentivised the enhancement of these infrastructural controls. According to Sriyai’s study (2024b), this increase is particularly notable in their capacity to control digital infrastructure through Internet filtering capability, Internet shutdown capability, and social media monitoring capability. Interestingly, there is no discernible divide in this capacity between high-income and low-income countries or different regime types. For example, Myanmar, the poorest ASEAN country, has similar internet filtering and shutdown capabilities to Singapore, the region's richest, and even surpasses Singapore in social media monitoring capability. This suggests a "need-based" logic, where political control and survival drive states to build capacity in anticipation of security threats. Moreover, most countries tend to avoid broad-based tactics like internet shutdowns or blocking all websites, despite having the capacity to do so. This is due to significant socioeconomic trade-offs, including the risk of losing economic productivity and increasing social tension. As such, governments generally prefer "softer, more imperceptible approaches (Sriyai 2024b, 9)", such as social media surveillance and censorship, for infrastructural control. Privacy Risks and Legal-Policy Gaps The proliferation of emerging technologies, particularly AI tools, in development often outpaces the legal safeguards necessary to regulate them. As mentioned in the previous section, Southeast Asian countries leverage their advanced digital capabilities for both development and control. While building robust infrastructural control capacities and technological advancement, they often exercise these powers selectively. The UN Trade and Development (UNCTAD)(2025) shows that 75 per cent of countries had some data protection and privacy legislation (commonly known as PDPA Law) by 2021. Yet, governments worldwide have been under pressure over concerns about data protection and the privacy of their citizens. While frameworks like the EU’s General Data Protection Regulation (GDPR) (2016) can be used as a baseline reference of a global standard, many low- and middle-income countries lack robust data protection laws, institutional capacity, or leverage to enforce them. This legal vacuum, then, creates space for excessive data 3