Asia-Pacific data protection and AI laws

South Korea PIPASouth Korea

2026 PIPA amendments take effect

10%-of-revenue fines, CEO accountability, and notice duties for possible breaches apply.

Japan APPIJapan

2026 APPI amendment act promulgated

Amendment enacted by the Diet on 10 July 2026 and promulgated; main provisions take effect by cabinet order within two years of promulgation.

New Zealand Privacy ActNew Zealand

IPP 3A indirect-collection notification applies

Agencies collecting personal information from third parties must take reasonable steps to notify individuals, subject to exceptions.

South Korea PIPASouth Korea

2026 PIPA amendment promulgated (Act No. 21445)

Amendment raising fines to 10% of revenue and adding CEO accountability promulgated.

Vietnam AI LawVietnam

AI Law takes effect

Risk classification, transparency and labeling obligations apply to new AI systems.

South Korea AI Basic ActSouth Korea

AI Basic Act and Enforcement Decree take effect

Transparency, labeling, high-impact AI, and domestic representative obligations apply (fines deferred during the grace period).

Vietnam PDPLVietnam

PDPL and Decree 356/2025 take effect

Personal data protection obligations, DPIA/TIA filing and penalty framework apply; Decree 13/2023 replaced.

Hong Kong Critical Infrastructure Cyber OrdinanceHong Kong

PCICSO comes into operation

Commissioner's Office is established and designation of CIOs begins; obligations apply to designated operators.

2025 amendments take effect

Higher fines, first-violation fines, AI governance provisions and PIPL-alignment duties apply under the 28 Oct 2025 NPCSC Decision.

Australia Cyber Security Act (ransomware reporting)Australia

Ransomware reporting moves to compliance phase

The education-first phase (30 May-31 Dec 2025) ends; Home Affairs moves to a compliance and education approach for missed reports.

Australia Social Media Minimum AgeAustralia

Social media minimum age obligation applies

Age-restricted platforms must take reasonable steps to prevent under-16s from holding accounts.

India DPDP ActIndia

DPDP Rules published; Board and procedural rules in force

Rules 1, 2 and 17-21 (Data Protection Board constitution and functioning) take effect on publication in the Official Gazette.

New Zealand Privacy ActNew Zealand

Privacy Amendment Act 2025 technical changes commence

Technical amendments commence the day after Royal Assent (23 Sep 2025).

Japan AI Promotion ActJapan

AI Promotion Act fully in force

Provisions establishing the AI Strategy Headquarters and AI Basic Plan take effect.

AI content labeling measures and GB 45438-2025 take effect

Explicit and implicit labeling duties for AI-generated content and platform detection duties apply.

Australia Privacy ActAustralia

Statutory tort for serious invasions of privacy commences

Individuals can sue for serious invasions of privacy (Schedule 2), 6 months after Royal Assent.

Japan AI Promotion ActJapan

AI Promotion Act promulgated and partly in force

Most provisions, including basic principles and stakeholder duties, take effect on promulgation.

Malaysia PDPAMalaysia

PDPA amendments phase 3

Mandatory DPO appointment, data breach notification, and data portability take effect.

Australia Cyber Security Act (ransomware reporting)Australia

Ransomware payment reporting starts

Reporting business entities must report ransomware/cyber-extortion payments to ASD within 72 hours of payment.

PI compliance audit measures take effect

Self-audit and regulator-ordered audit regime applies; 10M+ processors must audit at least every two years.

Malaysia PDPAMalaysia

PDPA amendments phase 2

'Data controller' terminology, biometric data as sensitive data, higher penalties, Security Principle for processors, and removal of the cross-border whitelist take effect.

Malaysia PDPAMalaysia

PDPA amendments phase 1

Miscellaneous provisions commence (e.g. electronic service of notices).

Network Data Regulations take effect

All provisions, including the 10-million-person threshold duties and annual important-data risk assessments, apply.

Australia Privacy ActAustralia

Most POLA Act 2024 amendments commence

Tiered penalties, infringement notices, OAIC powers, security and overseas-transfer clarifications and doxxing offences commence the day after Royal Assent.

Indonesia PDP LawIndonesia

PDP Law transition ends

Controllers and processors must fully comply (Art. 74 two-year transition).

Cross-border data flow provisions take effect

Exemptions and volume thresholds apply from publication (Art. 14); security assessment results are valid for 3 years (Art. 9).

Indonesia PDP LawIndonesia

PDP Law enacted and in force

Law takes effect on enactment, starting a 2-year transition.

Higher financial penalty cap applies

Maximum penalty rises to 10% of Singapore turnover for organizations with turnover above SGD 10 million.

PDPA main obligations take effect

Core data protection obligations and penalties apply after postponement Royal Decrees.

Japan APPIJapan

2020 amendments in force

Mandatory breach reporting, pseudonymized information and stricter cross-border rules apply.

PIPL takes effect

All PIPL obligations (legal bases, consent, cross-border rules, data subject rights) apply (Art. 74).

Data Security Law takes effect

Data classification, important-data protection and data export restrictions apply (Art. 55).

2020 amendments largely in force

Mandatory data breach notification and revised consent framework apply.

New Zealand Privacy ActNew Zealand

Privacy Act 2020 in force

IPPs, mandatory breach notification and compliance notices apply.

Cybersecurity Law takes effect

Original CSL obligations for network operators and CII operators apply.

PDPA data protection obligations take effect

Main data protection provisions come into force.