Working remotely from another Southeast Asian country may seem simple, but it can expose employers to immigration, tax, data-security, and employment-law risks. David Smail, Partner and Head of Employment, Singapore at DLA Piper explains what businesses need to consider before approving overseas work requests.
For many employers, remote and hybrid work have become established parts of daily business. Employees may now expect to be able to extend a family trip, spend time in their home country, or work temporarily from a holiday destination, while staying in the same role, on the same payroll, and connected to the same systems.
A request can sound simple: Can I work from Bangkok for a few weeks?
Or: Can I spend two months in Malaysia while visiting family?
But the fact that an employee remains employed by a Singapore entity does not mean the arrangement is legally neutral. Once an employee performs work while physically present in another country, a range of local rules may come into play.
That can include immigration and work-authorisation requirements, personal and corporate tax exposure, the risk of creating a taxable presence for the employer, local employment-law protections, social-security obligations, data protection and cybersecurity rules, and even workplace health-and-safety responsibilities.
These questions are particularly important in Southeast Asia, where legal frameworks and enforcement practices vary materially between jurisdictions.
“One of the biggest misconceptions about cross-border remote work is that it is simply a flexible working arrangement,” David Smail, Partner and Head of Employment, Singapore at DLA Piper tells Sarah Gideon. “In reality, it can raise a whole range of legal and compliance issues, even where the employee remains employed by and paid through their home-country entity.”
Physical presence can change the legal analysis
Employers often focus first on tax. That is understandable: an employee spending an extended period abroad may create questions about where that individual should pay tax, whether payroll withholding is required, and whether the employer has new reporting obligations.
However, Smail says immigration is frequently the first issue that needs attention.
“In many countries, carrying out work activities while physically present in the jurisdiction may require an appropriate work visa, even if the employee is only there temporarily and continues to work for a foreign employer.”
This is a point employers can easily miss. The employee may not be taking up local employment, receiving local pay or working from a local office. Yet local immigration authorities may still view certain activities conducted while physically present in the country as work requiring authorisation.
The analysis is not always straightforward. It can depend on the destination country, the type of visa held, the nature of the employee’s work and the local interpretation of what constitutes employment or business activity.
Tax risks similarly extend beyond the employee’s personal position. Businesses must consider whether the employee’s activities could create corporate tax exposure or a permanent establishment, a taxable business presence, in the destination country.
“The risk tends to increase where the employee has managerial authority, signs contracts, generates revenue, or regularly interacts with customers,” Smail explains.
This can be especially relevant for senior executives, sales teams, business-development personnel and employees with authority to negotiate or conclude contracts. In these cases, the issue is not merely where the employee is sitting, but what they are doing from that location and whether those activities could be attributed to the company.
There is rarely a safe “number of days”
Businesses sometimes look for a universal threshold: perhaps 30, 60, or 90 days. But Smail cautions that a purely duration-based approach can be misleading.
“There is often a tendency to look for a magic number of days, but in practice the answer is rarely that simple.”
Duration matters, particularly when an overseas arrangement becomes lengthy, recurring or routine. The longer an employee remains in a country, the more likely it is that tax, social-security and employment-law considerations may arise.
But the employee’s role can be just as important, sometimes more so.
“An employee who spends a few weeks answering emails and attending internal meetings may present a very different risk profile from a senior executive, salesperson, or business development professional engaging with customers and making commercial decisions,” Smail adds.
For immigration purposes, some countries may take a strict approach even where the stay is short. For tax and permanent-establishment purposes, authorities may focus on the substance of the employee’s activities. An employee with a material role in generating revenue or concluding contracts could create greater concern than an employee whose work is internal and administrative.
Rather than relying on arbitrary thresholds alone, employers should assess the full context of each request:
Where will the employee be working?
How long will they be there?
Is the arrangement a one-off or likely to recur?
What is the employee’s seniority and level of authority?
Will they interact with customers, suppliers or regulators?
Can they negotiate, sign or effectively conclude contracts?
Will they access sensitive data or regulated systems?
Data protection does not stop at the border
Tax and immigration can dominate discussions about cross-border remote work, but data protection and confidentiality may be among the most overlooked risks.
“When an employee accesses systems from another country, employers need to think about more than just whether the internet connection is secure,” Smail says.
“Different jurisdictions may have different data protection laws, cybersecurity requirements, or restrictions on the transfer and storage of certain information.”
The practical controls may be familiar, but their consistent application is critical. Employers should consider requiring employees to use:
company-approved and company-managed devices,secure, encrypted connections and approved virtual private networks where appropriate,multi-factor authentication,systems with appropriate access controls, andclear procedures for reporting lost devices, suspected breaches or cybersecurity incidents.
The level of scrutiny should reflect the nature of the information involved. An employee with access to highly sensitive customer information, financial data, trade secrets or confidential business plans may require more safeguards than an employee performing lower-risk work.
“A sensible starting point is to ensure employees use approved devices, secure networks, multi-factor authentication, and company-managed systems,” Smail highlights.
Just as important are clear instructions. Employees should understand what they can and cannot do while working abroad—such as whether they may use public Wi-Fi, print documents, work in public spaces or access particular categories of data. They should also know exactly who to contact if an incident occurs.
“Ultimately, a remote working arrangement should not weaken the organisation’s data protection standards simply because the employee happens to be logging in from another jurisdiction,” Smail adds.
Southeast Asia is not a single legal environment
Multinational businesses may be tempted to approach Southeast Asia as a broadly consistent operating region. In practice, that assumption can create risk.
“There is no single Southeast Asian approach to cross-border remote work,” Smail affirms. “The regulatory landscape varies significantly across the region.”
Countries differ not only in written laws, but also in how those laws are administered and enforced. Immigration requirements, local employment protections, tax rules, social-security obligations, data-protection frameworks and administrative practices can vary significantly.
A remote-working arrangement that is manageable in one jurisdiction may require a different approach elsewhere. It is therefore risky to treat a prior approval in one country as a precedent for another.
“The fact that a particular remote working arrangement has worked successfully in one country does not necessarily mean it can be replicated elsewhere without additional analysis. »
For Singapore-based employers, this can be a particular adjustment. Singapore’s legal and administrative environment is generally viewed as relatively clear and predictable. When employees work elsewhere in the region, employers may need to navigate less familiar rules, different documentary requirements and practical differences between the written legal position and local enforcement practice.
A consistent internal assessment framework can help employers make decisions efficiently. But for higher-risk cases, such as longer stays, senior employees, customer-facing roles or destinations with complex rules, local legal input may still be necessary.
The assumptions that can expose employers
Several common assumptions can lead companies to underestimate the implications of cross-border work.
The first is that no local issues arise because the employee remains on home-country payroll.
“In reality, the employee’s physical location often drives the risk analysis,” Smail highlights.
The second is that a short stay cannot matter. While a brief and low-risk arrangement may present fewer concerns than a long-term overseas posting, a short stay is not automatically risk-free. In particular, immigration rules and permanent-establishment concerns may depend heavily on the activities performed, rather than time alone.
A third assumption is that every employee request can be treated in the same way. But the risk profile can vary considerably according to the person, place and purpose of the arrangement.
“The destination country, the employee’s seniority, the nature of their role, and the length of the arrangement can all materially affect the analysis,” Smail adds.
Finally, employers should not dismiss the risks as theoretical. As flexible working becomes more common, regulators and tax authorities are increasingly familiar with cross-border arrangements and may be more willing to scrutinise them.
Designing a policy that balances flexibility and control
For employers, the practical answer is not necessarily to ban overseas remote work. A blanket prohibition may be difficult to sustain where employee expectations have shifted and competition for talent remains strong.
Instead, businesses should develop a policy that provides flexibility within clear boundaries.
“The most effective policies strike a balance between flexibility and control,” Smail says. “Rather than giving employees unrestricted freedom to work from anywhere, employers should think carefully about what types of arrangements they are prepared to support and what approval processes should apply.”
“Successful policies typically set out clear parameters around duration, eligible destinations, approval requirements, technology and cybersecurity expectations, and circumstances in which requests may be refused. »
The policy should also establish accountability. Cross-border remote work sits at the intersection of several functions: HR may manage the employee request; tax and mobility teams may assess fiscal and payroll implications; legal teams may consider immigration, employment and corporate-risk questions; and information-security teams may assess data and technology controls.
“The organisations that tend to manage these issues most effectively are not necessarily the ones with the most restrictive policies,” Smail shares. “They are the ones that have a clear framework for evaluating requests and understanding the risks before approvals are granted.”
Flexibility requires preparation
The ability to work across borders can be valuable for employees and employers alike. It can support family commitments, improve engagement and give businesses a more flexible approach to talent.
But it is not simply a matter of allowing an employee to take their laptop abroad.
For employers operating in Singapore and across Southeast Asia, each request should be considered through a practical risk lens: where the employee will be, how long they will be there, what work they will perform, what data they will access and whether local legal advice is needed.
As Smail puts it: “Flexible working can deliver significant business benefits, but employers should approach cross-border requests with the same level of care they would apply to any other international workforce issue.”
A well-designed work-from-anywhere policy is therefore more than an employee benefit. It is an essential governance tool for a workforce that is increasingly mobile, and for the legal realities that come with it.
READ MORE: From fixed assignments to fluid talent: How mobility can move into the future
Image / Provided
