Data residency and cross-border transfer rules

South Korea PIPASouth Korea

2026 PIPA amendments take effect

10%-of-revenue fines, CEO accountability, and notice duties for possible breaches apply.

South Korea PIPASouth Korea

2026 PIPA amendment promulgated (Act No. 21445)

Amendment raising fines to 10% of revenue and adding CEO accountability promulgated.

Vietnam PDPLVietnam

PDPL and Decree 356/2025 take effect

Personal data protection obligations, DPIA/TIA filing and penalty framework apply; Decree 13/2023 replaced.

2025 amendments take effect

Higher fines, first-violation fines, AI governance provisions and PIPL-alignment duties apply under the 28 Oct 2025 NPCSC Decision.

Latombe appeal lodged at the Court of Justice

Latombe appealed the General Court judgment to the Court of Justice on points of law (reported as Case C-703/25 P); the DPF stays valid while it is pending.

DOJ Bulk Data RuleUnited States (Federal)

Due diligence, audit and reporting obligations apply

Subpart J (data compliance program, due diligence and audits for restricted transactions) and reporting requirements in 202.1103 and 202.1104 apply.

Nigeria NDPANigeria

GAID 2025 takes effect

General Application and Implementation Directive becomes effective, replacing the NDPR 2019 and NDPR Implementation Framework.

General Court upholds DPF (Latombe v Commission)

General Court dismissed Philippe Latombe's action for annulment (Case T-553/23) and confirmed the US offered adequate protection when the decision was adopted.

Brazil LGPDBrazil

Deadline to adopt ANPD standard contractual clauses

Agents relying on contractual clauses for international transfers must incorporate the ANPD-approved SCCs into their contracts within 12 months of publication.

Malaysia PDPAMalaysia

PDPA amendments phase 3

Mandatory DPO appointment, data breach notification, and data portability take effect.

DOJ Bulk Data RuleUnited States (Federal)

Prohibitions and restrictions take effect

Core prohibitions on covered data transactions and security requirements for restricted transactions apply.

Malaysia PDPAMalaysia

PDPA amendments phase 2

'Data controller' terminology, biometric data as sensitive data, higher penalties, Security Principle for processors, and removal of the cross-border whitelist take effect.

Malaysia PDPAMalaysia

PDPA amendments phase 1

Miscellaneous provisions commence (e.g. electronic service of notices).

Network Data Regulations take effect

All provisions, including the 10-million-person threshold duties and annual important-data risk assessments, apply.

Indonesia PDP LawIndonesia

PDP Law transition ends

Controllers and processors must fully comply (Art. 74 two-year transition).

Saudi PDPLSaudi Arabia

One-year grace period ends

Grace period for controllers to comply ends; PDPL fully enforceable.

Turkey KVKKTurkey

Old transfer regime ends

Transitional period ends in which the former Article 9 explicit-consent transfer basis could still be relied on.

Brazil LGPDBrazil

International transfer regulation published

Resolution CD/ANPD 19/2024 on international transfers and standard contractual clauses published and in force.

PADFAUnited States (Federal)

PADFA takes effect

The prohibition takes effect 60 days after enactment (April 24, 2024).

Turkey KVKKTurkey

Law 7499 amendments take effect

New sensitive data and cross-border transfer rules (Arts. 6 and 9) apply.

Cross-border data flow provisions take effect

Exemptions and volume thresholds apply from publication (Art. 14); security assessment results are valid for 3 years (Art. 9).

Saudi PDPLSaudi Arabia

PDPL in force

PDPL and its implementing regulations take effect.

DPF adequacy decision adopted and effective

Commission adopted Implementing Decision (EU) 2023/1795, effective on notification to Member States; EU-US transfers to DPF-certified organisations may proceed without additional safeguards.

Nigeria NDPANigeria

NDPA signed into law

President signs the Nigeria Data Protection Act, 2023.

Indonesia PDP LawIndonesia

PDP Law enacted and in force

Law takes effect on enactment, starting a 2-year transition.

PDPA main obligations take effect

Core data protection obligations and penalties apply after postponement Royal Decrees.

UAE PDPLUnited Arab Emirates

PDPL enters into force

Decree-law takes effect; compliance obligations tied to Executive Regulations.

PIPL takes effect

All PIPL obligations (legal bases, consent, cross-border rules, data subject rights) apply (Art. 74).

Data Security Law takes effect

Data classification, important-data protection and data export restrictions apply (Art. 55).

Brazil LGPDBrazil

ANPD sanctions enforceable

Administrative sanctions (Arts. 52-54) become applicable per Law 14.010/2020.

Brazil LGPDBrazil

LGPD in force

Main LGPD provisions take effect.

Kenya Data Protection ActKenya

Data Protection Act in force

Act commences.

Cybersecurity Law takes effect

Original CSL obligations for network operators and CII operators apply.