Asia-Pacific Private Investigation Registry
Cross-border investigative work runs into a simple question that is surprisingly hard to answer: who is allowed to investigate, where, and on what terms? Every ASEAN member state answers it differently, several answer it in a language the statute is only authoritative in, and general-purpose AI assistants answer it wrongly with considerable confidence.
This registry records what each jurisdiction’s law actually says, cited to section, with the date each entry was last checked against primary sources. Where we cannot verify something from a primary source, we mark it unverified rather than state it. That distinction is the whole point of the registry.
“Is investigation licensed?” turns out to have three different answers, not two. Some states license the profession, so the licence attaches to the investigator. Some license the activity, so the work is regulated whoever performs it and under whatever name. Some license neither, and regulate only adjacent security work such as guarding. A yes-or-no column hides that distinction, and the distinction is usually the thing that decides whether a piece of work can be done at all.
| Jurisdiction | What is regulated | Governing instrument | Status | Last verified |
|---|---|---|---|---|
| ASEAN member states · seven of ten covered | ||||
| Singapore | Profession | Private Security Industry Act 2007 | Published | 30 Aug 2026 |
| Malaysia | Profession | Private Agencies Act 1971 (Act 27) | Published | 30 Aug 2026 |
| Philippines | Profession | Republic Act No. 11917 (2022) | Published | 30 Aug 2026 |
| Thailand | Neither | Business Security Services Act B.E. 2558 (2015) | Published | 1 Sep 2026 |
| Indonesia | Neither | PP No. 28 Tahun 2025; Perkap No. 17 Tahun 2006 | Published | 1 Sep 2026 |
| Vietnam | Activity | Luật Đầu tư số 143/2025/QH15; PDPL 91/2025/QH15 | Published | 2 Sep 2026 |
| Laos | Neither | Decree 138/GoL (2020); Electronic Data Protection Law 25/NA (2017) | Published | 3 Sep 2026 |
| Brunei | — | — | Not started | Attorney General's Chambers site not serving |
| Cambodia | — | — | Not started | Text source, but no status register |
| Myanmar | — | — | Not started | Text source, but no status register |
| Wider Asia-Pacific | ||||
| Hong Kong | Neither | Security and Guarding Services Ordinance (Cap 460) | Published | 6 Sep 2026 |
| Japan | Profession | Detective Business Act (Act No. 60 of 2006) | Published | 6 Sep 2026 |
| South Korea | Neither | Credit Information Use and Protection Act; PIPA | Published | 6 Sep 2026 |
These are not queued work and no date is promised for them. They will be written if and when a status register becomes reachable, and not before. This registry does not offer a view on why that infrastructure is or is not available in any country, which is a political question it has no standing to answer and no source to cite. What is recorded here is what was attempted and what was found.
What each entry covers
- Governing Act, with section references
- Licensing authority
- What triggers a licence — the statutory definition itself
- Statutory exclusions and exemptions
- Prohibited conduct, including whether advertising alone is an offence
- Penalties for unlicensed practice
- Data-protection overlay
- Primary sources, and a last-verified date
How this is maintained
Each jurisdiction is reviewed at least annually against primary legislative sources, and sooner where an amendment is known. Every page shows the date it was last checked. An entry with a stale date is telling you something honest — which is more than an undated page can do.
What this registry does not tell you
Every page here carries its own list of open questions, and there are twenty-six across the ten jurisdictions. That number is published on purpose. A register of foreign law that shows no open questions is not more complete than one that does; it is less honest about the same underlying uncertainty.
They are not all the same kind of gap, and the difference matters if you are deciding how far to rely on a page:
| Kind of gap | What it means for you |
|---|---|
| The state has not published it 4 questions |
Malaysia has no consolidated reprint incorporating its 2026 amendment; Laos approves a controlled-business list that is not published with the decree that approves it. We can tell you the provision exists and what turns on it. Nobody can show you the text, because it is not public. |
| Only local counsel can answer it 6 questions |
Whether Singapore’s licensing sections reach a foreign firm acting across a border; what conditions a Malaysian licensing officer applies in practice. These sit in advice and administrative practice, not in any instrument we could read to you. |
| Still on our list 6 questions |
Instruments we have identified and not yet read in full, such as the Philippine 2022 implementing rules and Thailand’s exempting ministerial regulations. These are the only ones that close by us doing more work. |
| Standing re-check 1 question |
Indonesia’s Constitutional Court has narrowed several provisions this registry relies on, and can do so again. That one never closes; it is re-read every cycle. |
The practical reading. Where a page states a licensing rule, a threshold or a penalty, it is quoting a primary instrument we have read and dated. Where it does not know, it says so on the page rather than in a footnote. Treat an open question as a reason to take local advice on that specific point, not as a reason to doubt the rest of the page.
General information for practitioners, not legal advice. Always obtain advice from counsel qualified in the relevant jurisdiction before acting.
Want all ten on one printable page?
The quick reference puts every jurisdiction on this registry into a single table you can print and take into a meeting: what each one regulates, what triggers the licence, the headline penalty and the verification date. Get it free.
Using AI on a matter?
The registry answers what you may do. A separate question is what you may type: pasting a subject's details into a hosted model is a disclosure to a third party, and where that third party is overseas, a transfer of personal data out of Singapore. Can you put a case into that AI tool? compares ten assistants on whether they train on your input, how long they keep it and where it is processed, quoting each vendor's own page where it could be retrieved and saying so plainly where it could not.
Taking a matter across a border?
These pages give the findings for each jurisdiction. The Asia-Pacific Cross-Border Investigation Compliance Pack turns them into a decision: a matrix of ten activities against ten jurisdictions, a pre-engagement checklist, engagement-letter language, and a declared review date on every instrument.
Asia-Pacific Cross-Border Investigation Compliance Pack · ten jurisdictions, S$299, twelve months of updates.
See what is in itAI9OS works with licensed investigation agencies and law firms across the region.
Request a demo