Developing and launching a new drug on a commercial scale requires an enormous amount of time and investment in research and development (R&D), including pre-clinical testing and clinical trials. When considering the aggregate amount of drug development costs, it is important to recognize that this includes not only the investment in developing new drugs that get approved by a government food and drug regulator and are successfully brought to market, but also the R&D expenditures on a large number of potential pharmaceutical compounds and products that never actually make it to market. In particular, considerable investment is required in order to conduct and produce clinical trial data—to prove safety, efficacy and effectiveness of a new drug—that would warrant marketing approval by the regulatory authority. Such data is proprietary in nature and highly valuable for a research-based pharmaceutical company that develops an original drug. On the other hand, patent law typically confers generic drug manufacturers with the ability to engage in various preparatory activities with a view to obtaining marketing approval for a generic product before the patent for the original drug expires (commonly known as a “Bolar provision”). Since a generic drug maker may submit an application for marketing approval of a generic product before the relevant patent expires, the extent to which the drug originator’s data submitted to the regulatory authority is protected—or in other words, the extent to which the generic company may rely on the drug originator’s previously filed data, which underpins the safety and efficacy of the drug, to support the generic marketing approval application—becomes a critical issue. Availability of data exclusivity thus provides a form of market exclusivity outside that provided by patent rights. While some countries offer exclusivity or protection of the drug originator’s data submitted to the regulatory authority for marketing approval and prevent generic drug manufacturers from relying on such data in their own applications, many countries still do not have practical data exclusivity protections. In this guide, we discuss the availability of data exclusivity protections and limitations in Southeast Asian countries, including Cambodia, Indonesia, Laos, Malaysia, Myanmar, Thailand, and Vietnam. 2 Are there practical data exclusivity protections? ☒ Yes ☐ No What are the data exclusivity protections available with regulatory authorities? Cambodia provides informal protection of data exclusivity through the Cambodian Constitution and the Civil Code. These instruments afford legal protection to private information. In addition, the Criminal Code makes disclosure of any confidential information a crime. In 1996, the United States and Cambodia signed an agreement to explicitly protect data exclusivity for citizens and companies of the US, although to date no formal provisions regarding data exclusivity linked to patent or drug registration have been implemented into national legislation or declared by the Cambodian Department of Drugs and Food. Cambodia is a WTO designated least-developed country (LDC), meaning that, as a member of the TRIPS agreement, explicit and specific data exclusivity protections will need to be instituted by January 1, 2033. Tilleke & Gibbins sponsored and presented at the November 5–6, 2018 Regional Conference on Combating Counterfeit Medicine, held in Phnom Penh, Cambodia. Co-hosted by the Cambodia CounterCounterfeit Committee and the Cambodian government, the French government, and the Institut de Recherche Anti-Contrefaçon de Médicaments, the event’s keynote speaker was the Cambodian prime minister, Hun Sen, who specifically stated that Cambodia needed to comply with TRIPS data exclusivity requirements immediately rather than taking advantage of the 2033 deadline. What is the duration of these protections? The US-Cambodian agreement allows for protection to last for five years from the date of marketing approval for American companies, but to our knowledge, no question of enforcement of this has been raised. All companies can currently rely on criminal prohibition of confidential information disclosure, meaning the information can be protected so long as the business continues to take appropriate action to keep the information confidential. Until January 1, 2033, Cambodia does not need to provide for exclusive distributorships or patent protection for pharmaceuticals, based on its status as an LDC. Therefore, the first generic drug application can be filed as soon as the original drug is registered. What remedies are available to the injured parties if a regulatory authority breaches data Disclosure of confidential information is punishable by an imprisonment of up to one year and a fine of KHR 2 million (approximately USD 500). CAMBODIA 3 Are there practical data exclusivity protections? ☐ Yes ☒ No What are the data exclusivity protections available with regulatory authorities? Indonesia does not provide protection of data exclusivity by legislation or by the National Agency of Drug and Food Control’s (BPOM) policies. While BPOM protects the confidentiality of an applicant’s data by preventing disclosure to a third party, it may refer to the original applicant’s confidential information during the course of its review of a generic application, as new clinical data is not required to be submitted by generic drug manufacturers. The generic drug manufacturers only need to prove that their generic contains the same active ingredients through a bioavailability and bioequivalence report. What is the duration of these protections? There is no guaranteed duration for BPOM’s practice to prevent disclosure to a third party or for BPOM’s reliance on confidential information when reviewing subsequent generic applications. Also, Indonesia does recognize a Bolar exemption period, wherein the first generic drug application may only be filed five years before the expiration date of the patent. What remedies are available to the injured parties if a regulatory authority breaches data exclusivity? There are no official remedies available to injured parties regarding a breach of data exclusivity. INDONESIA 4 Are there practical data exclusivity protections? ☒ Yes ☐ No What are the data exclusivity protections available with the regulatory authorities? Laos provides formal protection of data exclusivity through the following legislation. Under the Law on Drugs and Medical Products, the Food and Drug Department of the Lao Ministry of Health protects the secret information of those who have registered their drugs in accordance with Lao laws and other agreements and treaties to which Laos is a party. Under the Law on Intellectual Property, data submitted in an application for marketing approval of a new pharmaceutical product is protected against unfair commercial use and prohibited disclosure. However, disclosure may be allowed to the extent “necessary to protect the public.” What is the duration of these protections? Protection lasts for five years from the date of marketing approval. During that period, no person may rely on the confidential data in support of an application for product approval. The first generic drug application can be filed as soon as the original drug is registered, creating a form of Bolar exemption. What remedies are available to the injured parties if a regulatory authority breaches data exclusivity? Unauthorized disclosure of the data is an act of unfair completion under Laos law. Interestingly, Laos has set out the importance of observing intellectual property rights under the new Penal Code, published October 17, 2018, which prohibits acts of infringement of intellectual property, and act of unfair practices. According to the Penal Code, such acts may incur one year to three years imprisonment, or re-education without deprivation of liberty, 1 and a fine of LAK 5–10 million (approximately USD 575– 1,150). Public officials who violate this law but do not commit criminal offenses are subject to discipline under the Law on Civil Servants. For criminal measures, individuals who breach industrial property protection regulations will be charged with a light or heavy penalty. 1 According to the Penal Code, re-education without deprivation of liberty is a punishment inflicted upon the offender where 5% to 20% of his total salary is remitted to the state, in accordance with the court's decision. A penalty of re-education without deprivation of liberty cannot exceed one year. LAOS 5 Are there practical data exclusivity protections? ☐ Yes ☒ No What are the data exclusivity protections available with regulatory authorities? Currently, there are no specific laws or regulations in Myanmar relating to data privacy or data exclusivity protections. Further, generic drugs do not need to provide clinical or nonclinical data in their application for approval. However, Myanmar’s Competition Law, enacted February 24, 2015, provides protections against disclosure of business secrets and certain confidential information. In addition, Myanmar’s Telecommunications Law, enacted October 8, 2013, prohibits the misappropriation of property and improper disturbance or extortion through a telecommunications network, thereby providing somewhat of a grounding for protection against the physical disclosure of confidential information through such electronic means. Myanmar is a WTO-designated least-developed country (LDC), meaning that, as a member of the TRIPS agreement, explicit and specific data exclusivity protections will need to be instituted by January 1, 2033. What is the duration of these protections? Myanmar’s Competition Law creates a form of trade secret protection lasting so long as the business continues to take appropriate action to keep the information confidential. Myanmar’s Patent Law, which was enacted in 2019, states that product or production processes relating to pharmaceuticals are not yet protectable inventions. Therefore, the first generic drug application can be filed as soon as the original drug is registered. However, under the Patent Law, the government has the authority to keep a patent application confidential or to withhold information from being released if it takes the view that the application poses a threat to national security, thereby preventing access to companies looking to produce a generic drug and delaying their application. What remedies are available to the injured parties if a regulatory authority breaches data exclusivity? Under the Competition Law 2015, the abuse of confidence in accessing, collecting, or revealing any trade secrets or confidential information is punishable with imprisonment of up to two years, a fine of up to MMK 10 million (approximately USD 6,600), or both. Under the Telecommunications Law 2013, the abuse of a telecommunications network to disturb or misappropriate property is punishable with imprisonment of up to three years, a fine, or both. In addition to criminal prosecution, civil action may be raised for any damages in relation to the utilization of the information. MYANMAR 6 Are there practical data exclusivity protections? ☐ Yes ☒ No What are the data exclusivity protections available with regulatory authorities? Currently, Thailand has no standalone data exclusivity protection. The Thai FDA has taken a narrow view of what constitutes “unfair use” of submitted data under the TRIPS agreement. The FDA treats an originator’s data on file as forming part of known scientific knowledge and relies on such data to grant marketing approval to generic applicants. The WTO has not yet commented on Thailand’s view of unfair use. However, Thailand’s Trade Secrets Act, amended in 2015, and accompanying ministerial regulations, provide limited ‘data protection’ against disclosure of the originator’s submitted data to a third party by imposing a duty on the Thai FDA to maintain the confidentiality of trade secrets, including testing results and other proprietary information submitted in support of permit applications. Further, the Official Information Act, enacted in 1996, mandates that if a government agency seeks to disclose information that could be injurious to a private entity, the entity may appeal the upcoming disclosure after being notified by the official or on their own accord, and the official must immediately consider the appeal before disclosing such information. What is the duration of these protections? In order to receive ‘data protection’ pursuant to the Trade Secrets Act (discussed above), a Trade Secrets Recordal Application and required supporting documents must be submitted to the Thai FDA, along with the application for marketing approval. After the Thai FDA is duly notified by the applicant that the data submitted with the marketing approval application is to be treated as a ‘trade secret’, the Thai FDA will keep the submitted data confidential for five years from the date of notification. Nonetheless, as of April 2025, the Thai FDA has indicated that the procedures under the currently available Guidelines for Trade Secrets Recordal Applications apply only to paper-based submissions and are no longer applicable to electronic submissions, which are now the standard through the electronic Common Technical Document (eCTD) system. As a result, although the Official Information Act provides exemptions for information protected by law or intended to be kept confidential, there is presently no clear mechanism for applicants to designate specific information as a trade secret within the electronic submission process. Future potential amendments to the Guidelines as well as practical interim measures for the protection of trade secrets in electronic submissions will have to be monitored to identify solutions that provide data protection while ensuring compliance with Thai law and international obligations, including those under the TRIPS Agreement and as regularly highlighted in the US Trade Representative’s Special 301 Report. THAILAND 7 Note that while generic drug applicants must disclose previous patents in their applications, as of October 21, 2019, the Thai FDA is not legally obligated to take this into consideration when deciding to grant marketing approval for a generic drug. Thus, a Bolar exemption is effected, whereby the first generic drug application can be filed before the patent covering the original drug expires, but the generic drug cannot be marketed until after the original drug’s patent protection expires. What remedies are available to the injured parties if a regulatory authority breaches data exclusivity? Unauthorized disclosure of confidential data (trade secret) to a third party by an official is addressed through criminal prosecution. Officials who breach the confidentiality duty are subject to imprisonment for up to two years, a fine of THB 200,000 (approximately USD 6,500), or both. 8 Are there practical data exclusivity protections? ☒ Yes ☐ No What are the data exclusivity protections available with regulatory authorities? While there is specific data exclusivity legislation, the purpose of data exclusivity is undermined by the Drug Administration of Vietnam’s application process. Generic drug applicants are not required to submit trial data for approval. Thus, subsequent parties do not have to reference the data from an original applicant’s dossier, and can obtain marketing authorization despite the government’s protection of the information. Under Vietnam’s Intellectual Property Law, and Circular No. 05/2010/TT-BYT, applicants for licenses for trading in or circulating pharmaceuticals that require test results or other data may request the data to be kept secret. The licensing body must not grant licenses to subsequent applicants who use the secret data without the prior applicant’s consent. In order to receive these protections, the following criteria must be met: 1. The trial data must be a trade secret; 2. It must be a result of significant investment and effort; and 3. Protection of it must be requested by its owner.