IP Protection When Hiring Remote Teams in Southeast Asia

In the Philippines and Thailand, the developer who writes your code owns the copyright by default. Section 178.3 of the Philippine IP Code and Section 9 of the Thai Copyright Act both assign first ownership to the employee unless a written agreement states otherwise. In Singapore and Malaysia, the statutory default flips: the employer owns work-product IP under the Copyright Act 2021 (Section 130) and Copyright Act 1987 (Section 26(2)(b)) respectively. Vietnam sits in a gray zone where employer ownership of industrial property applies only to work "within the scope of assigned tasks", a phrase Vietnamese courts interpret narrowly. Without country-specific IP assignment clauses signed at contract execution, a company hiring across 3-4 ASEAN markets faces 3-4 different default ownership regimes for the same type of work product.

This guide provides the IP assignment default rule, required contract clauses, and enforcement strength for all 6 major ASEAN hiring markets, alongside NDA enforceability (strong in Singapore/Malaysia, deterrent-only in Vietnam/Indonesia), cross-border data transfer rules under each country's data protection law (Singapore PDPA penalties up to SGD 1 million or 10% of turnover, Indonesia PDP Law at 2% of revenue, Vietnam's PDPD requiring data impact assessments), the specific EOR contract chain needed to vest IP with the client company (not the EOR), and the 6 practical clauses every remote team employment contract in Southeast Asia must include: broadest-scope IP assignment, moral rights waiver, NDA with post-employment duration, non-solicitation, data handling and return obligations, and invention disclosure requirements.

IP Assignment: Country-by-Country Analysis

Singapore

Governing law: Copyright Act 2021 (revised), Patents Act (Cap 221), Registered Designs Act (Cap 266)

Default rule: Under Section 130 of the Copyright Act 2021, where a work is made by an author under a contract of service (employment), the employer is the first owner of copyright. This applies to literary works (including software code), artistic works, and other copyrightable outputs.

For patents, Section 49 of the Patents Act provides that inventions made by an employee in the course of normal duties or specifically assigned duties belong to the employer.

Assignment clause needed? Technically, the statutory default favors the employer. However, best practice is to include an explicit IP assignment clause that covers all forms of IP (copyright, patents, trade secrets, know-how, designs) and specifically addresses work created using company resources or related to company business. This eliminates any ambiguity about scope.

Enforcement: Strong. Singapore's Intellectual Property Office (IPOS) and court system provide reliable IP enforcement. Cases are heard by the High Court with specialist IP judges.

Vietnam

Governing law: Law on Intellectual Property 2005 (amended 2009, 2019, 2022), Labour Code 2019, Civil Code 2015

Default rule: Vietnam's IP Law (Article 39) provides that the employer owns industrial property rights (patents, industrial designs) created by an employee in the performance of duties or using the employer's resources, unless otherwise agreed. For copyright (Article 39a, 2022 amendment), the author retains moral rights (attribution, integrity) while the employer holds economic rights to works created under employment, but this requires the work to be created within the scope of assigned tasks.

Critical nuance: "Scope of assigned tasks" is narrowly interpreted. Work created outside specifically assigned tasks, even if related to the company's business, may remain the employee's property. Employment contracts must define the scope of IP-generating work broadly and explicitly.

Assignment clause needed? Mandatory. The statutory default is ambiguous enough that relying on it without contractual reinforcement is a material risk.

Enforcement: Moderate. Vietnam's IP enforcement has improved significantly since WTO accession (2007) and CPTPP implementation. The National Office of Intellectual Property (NOIP) handles registration. Court enforcement remains slower than Singapore or Malaysia.

Indonesia

Governing law: Law No. 28/2014 on Copyright, Law No. 13/2016 on Patents, Government Regulation 36/2018

Default rule: Indonesia's Copyright Law (Article 36) states that copyright in a work created under an employment relationship belongs to the employer, unless otherwise agreed in a written agreement. For patents, Law 13/2016 (Article 12) provides that the employer owns patents for inventions made in the course of employment.

Important distinction: The law refers to works created "in a work relationship" (hubungan kerja). For remote workers engaged through an EOR, the EOR is the legal employer, making it required that the service agreement between the company and the EOR, plus the employment contract between the EOR and the worker, both contain clear IP assignment provisions that ultimately vest IP with the client company.

Assignment clause needed? required, particularly for EOR arrangements where the employment relationship is between the worker and the EOR, not the client company.

Enforcement: Weak to moderate. The Directorate General of Intellectual Property (DGIP) handles registrations. Court enforcement of IP rights is improving but remains inconsistent, particularly outside Jakarta.

Philippines

Governing law: Intellectual Property Code (RA 8293), as amended by RA 10372 (2013)

Default rule: Section 178.3 of the IP Code provides that where work is created by an employee in the course of employment, the copyright belongs to the employee, unless there is a written agreement to the contrary. This is the opposite of the Singapore default.

This means: Without a written IP assignment agreement, a Filipino developer who writes code for your company owns the copyright to that code. The company has an implied license to use it, but does not own it. This is one of the most significant IP traps for companies hiring in the Philippines.

Assignment clause needed? Absolutely critical. Must be in writing, signed before or at the time of employment commencement, and should cover all work product created during employment.

For patents, Section 30 of the IP Code follows a similar employee-first approach but allows contractual override.

Enforcement: Moderate. The Intellectual Property Office of the Philippines (IPOPHL) handles registration and some dispute resolution. Court enforcement through Regional Trial Courts with IP jurisdiction.

Thailand

Governing law: Copyright Act B.E. 2537 (1994, amended 2015), Patent Act B.E. 2522 (1979, amended 2019)

Default rule: Section 9 of the Copyright Act provides that where a work is created under an employment contract, the employee is the author and first owner of copyright, unless the employment contract specifies otherwise. Similar to the Philippines, the default favors the employee.

For patents, Section 11 of the Patent Act provides that the employer owns inventions created by an employee as part of their duties, unless the employment contract provides otherwise.

Assignment clause needed? Mandatory for copyright. The employer-friendly default for patents reduces urgency for patent-specific clauses, but full IP assignment covering all IP types is best practice.

Enforcement: Moderate. The Central Intellectual Property and International Trade Court (IP&IT Court) is a specialized court that handles IP disputes with reasonable efficiency. Thailand's IP enforcement is generally stronger than Indonesia or Vietnam.

Malaysia

Governing law: Copyright Act 1987 (amended 2022), Patents Act 1983, Industrial Designs Act 1996

Default rule: Section 26(2)(b) of the Copyright Act provides that where a work is made by an employee under a contract of service, the employer is the first owner of copyright. This mirrors the Singapore approach.

For patents, Section 20 of the Patents Act provides that the right to a patent belongs to the employer where the invention was made in the performance of the employee's duties.

Assignment clause needed? The statutory default is employer-favorable, but explicit clauses remain best practice, particularly for remote workers where the "contract of service" characterization could be challenged.

Enforcement: Moderate to strong. The Intellectual Property Corporation of Malaysia (MyIPO) handles registrations. Enforcement through the High Court is relatively reliable.

NDA Enforceability

Country	NDA Enforceability	Key Considerations
Singapore	Strong	Enforceable under contract law; specific performance and injunctive relief available; courts routinely enforce reasonable NDAs
Malaysia	Strong	Enforceable under Contracts Act 1950; courts have established precedent for NDA enforcement
Thailand	Moderate	Enforceable as contractual obligation; Civil and Commercial Code governs; damages must be proven
Philippines	Moderate	Enforceable under Civil Code obligations and contracts; but must be reasonable in scope and duration
Vietnam	Moderate to weak	Enforceable under Civil Code 2015 (Article 38 on personal secrets); Labour Code 2019 allows confidentiality obligations; enforcement via courts is slow and uncertain
Indonesia	Weak to moderate	Civil Code (Article 1338) provides freedom of contract; NDAs are theoretically enforceable but court precedent is limited and enforcement is inconsistent

 

Practical reality: In Vietnam and Indonesia, NDAs serve primarily as a deterrent rather than an enforcement mechanism. The threat of legal action has value, but companies should not rely on post-breach NDA enforcement as their primary IP protection strategy in these markets. Technical controls (access management, data loss prevention, code repository restrictions) are more reliable.

Data Protection Laws Affecting Remote Teams

Every major ASEAN hiring market now has full data protection legislation. For companies employing remote teams across the region, these laws govern how employee data and company data processed by employees can be collected, stored, transferred, and deleted.

Cross-Border Data Transfer Rules

Country	Law	Cross-Border Transfer Rule	Penalty for Violation
Singapore	PDPA 2012 (amended 2020)	Permitted if recipient country provides comparable protection, or with consent, or under contractual safeguards	Up to SGD 1 million or 10% of annual turnover
Thailand	PDPA B.E. 2562 (2019, enforced 2022)	Recipient country must have adequate standards; or consent; or necessary for contract performance	Up to THB 5 million criminal fine + civil damages
Indonesia	PDP Law No. 27/2022	Cross-border transfer permitted if recipient jurisdiction provides equivalent protection; implementing regulations pending	Up to 2% of annual revenue (administrative) + criminal sanctions
Philippines	DPA 2012 (RA 10173)	National Privacy Commission (NPC) has not issued a whitelist; companies must ensure adequate safeguards through contractual or organizational measures	Up to PHP 5 million + 1-6 years imprisonment for certain violations
Vietnam	PDPD (Decree 13/2023/ND-CP)	Data impact assessment required before cross-border transfer; registration with Ministry of Public Security for transfers of Vietnamese citizens' personal data	Administrative fines; implementing enforcement still developing
Malaysia	PDPA 2010 (Act 709)	Transfer to countries not specified by Minister requires consent or contractual safeguards	Up to RM 500,000 fine or 3 years imprisonment

 

What This Means for Remote Teams

When a developer in Vietnam pushes code to a GitHub repository hosted on US servers, that constitutes a cross-border data transfer if any personal data is involved. When a customer service agent in the Philippines accesses a CRM containing customer records, the data processing occurs in the Philippines and is governed by the DPA.

Companies must:

1. Include data processing clauses in employment contracts specifying what data the employee may access, process, and transfer

2. Implement technical controls (VPN, endpoint management, access restrictions) proportionate to data sensitivity

3. Conduct data protection impact assessments where required (Vietnam's PDPD mandates this for cross-border transfers)

4. Maintain records of processing activities as required by each country's law

Practical IP Protection Clauses for ASEAN Employment Contracts

Based on the country-by-country analysis, employment contracts for remote workers in Southeast Asia should include these clauses:

1. IP Assignment (Broadest Possible)

The clause must assign all intellectual property, copyright, patents, trade secrets, designs, know-how, created during employment or using company resources, regardless of whether created during working hours or on personal devices. The assignment must be in writing and signed at contract execution. In Philippines and Thailand, this is not optional, without it, the employee owns the IP by default.

2. Moral Rights Waiver (Where Applicable)

Vietnam and Indonesia recognize moral rights (right of attribution, right of integrity) that cannot be fully assigned. The contract should include a waiver of the exercise of moral rights to the maximum extent permitted by local law, or a commitment not to assert moral rights against the employer.

3. Confidentiality / NDA (During and Post-Employment)

Define confidential information broadly, specify the duration of confidentiality obligations (2-5 years post-employment, or indefinite for trade secrets), and include specific remedies for breach. In Vietnam, link confidentiality obligations to Article 21 of the Labour Code 2019 and the employment contract.

4. Non-Solicitation (Post-Employment)

Where non-competes are unenforceable (Philippines, Vietnam, Indonesia), non-solicitation clauses targeting the company's employees and clients provide partial protection. These are more likely to be enforced because they restrict the target of solicitation rather than the right to work.

5. Data Handling and Return

Require return or destruction of all company data, devices, and access credentials upon employment termination. Specify that the employee must not retain copies of company data on personal devices. Include a certification requirement: the departing employee must sign a declaration confirming data return/destruction.

6. Invention Disclosure

Require employees to disclose any invention, process, or creation that relates to the company's business or was developed using company resources, so the company can assess patentability and exercise assignment rights.

For companies hiring compliantly across multiple ASEAN markets, working with an EOR that embeds these IP protection clauses into locally compliant employment contracts, rather than relying on a one-size-fits-all template, is the most reliable approach. Each country's contract must reflect its specific IP default rules, data protection requirements, and enforcement realities.

Companies comparing IP environments across potential hiring markets should also consider the broader labor law frameworks that govern the employment relationship within which IP is created.

---

Aniday's HR Services

---