Fundamentals of Asian Privacy and Data Protection Regimes
Asia has no single privacy law. This domain tests whether you can classify a jurisdiction's model, name its regulator, and identify which transfer rule governs an export.
Three regulatory models
- Omnibus laws: Japan APPI, Korea PIPA, Singapore PDPA, Hong Kong PDPO, Philippines DPA, Thailand PDPA, China PIPL, India's DPDP Act 2023.
- Sectoral frameworks: India's IT Act 2000 and SPDI Rules 2011 (being displaced by the DPDP Act), plus sector regulators such as the RBI for payment data.
- Co-regulatory overlays: APEC CBPR certification sits alongside domestic law; it does not replace it.
Common building blocks
Notice, consent, purpose limitation, security, retention limits, access and correction, breach notification, a DPO or grievance officer, and cross-border transfer limits. Localization mandates (Indonesia's PP 71/2019, Vietnam's Decree 13/2023, China's PIPL, RBI payment data) are distinct from transfer restrictions: localization requires in-country storage; transfer rules govern export.
Worked example
A Singapore HR platform stores Indian employees' payroll data in Tokyo and serves Hong Kong customers. Singapore's PDPA transfer limitation covers the export; Japan's APPI governs the Tokyo recipient's handling; India's DPDP Act applies to the Indian data principals. The best answer names each law and mechanism, not "GDPR adequacy".
Traps
- Treating APEC CBPR as an Asia-wide adequacy decision.
- Assuming every Asian law requires consent for every transfer.
- Missing that India now has an omnibus Act, not only the IT Act.