Digital technologies are playing a growing role in how energy is managed, both within buildings and across large power systems. These systems often rely on collecting and analyzing detailed data from users, devices, and networks to improve performance, service quality and enhance customer satisfaction, but while these developments support greater energy efficiency and adaptability, they also introduce serious concerns about data privacy, surveillance and ethical responsibility. This paper explores the legal and ethical implications of data use in digital energy systems, focusing on applications at both the building and grid levels, the review compares global data protection laws such as the GDPR and CCPA with those in Southeast Asia, including Malaysia’s PDPA, to highlight gaps in how these regulations apply to energy data. Ethical concerns such as consent, data control and fairness are also discussed, especially in regions with limited resources and the analysis shows that effective governance of digital energy systems must account for local context, cultural values, and the readiness of legal institutions. This study adds to ongoing debates about how to promote innovation in the energy sector while safeguarding individual rights and ensuring equity during digital transformation.