Across the Asia-Pacific region, privacy and cybersecurity regulation continues to evolve rapidly, with regulators increasingly moving from legislative build-out to practical compliance and enforcement. Recent developments in Vietnam, South Korea and Indonesia illustrate this trend and signal heightened regulatory expectations for organisations operating in the region.

Below is a snapshot of what happened, and why it matters for organisations.

Vietnam – data protection and cybersecurity sanctions framework took effect in August

  • What happened: Vietnam issued Decree No. 330/2026/NĐ-CP, which took effect on 19 August 2026. The decree establishes a detailed sanctions framework for non-compliance with the Law on Personal Data Protection (including its implementing regulations under Decree 356/2025/ND-CP) and the Law on Cybersecurity, together with their guiding decrees. It has extraterritorial effect and applies to both onshore and offshore companies. It introduces financial penalties of up to 5% of the preceding year’s revenues or VND 3 billion for non-compliance with cross-border transfer impact assessment (TIA) requirements, as well as fines of up to VND 30-100 million for other types of non-compliance.
  • Why it matters: The issuance of Decree 330 suggests that the practical grace period previously perceived by many organisations after the issuance of the Law on Personal Data Protection, its implementing regulations and the new Law on Cybersecurity may be coming to an end, and that the regulator may intend to move towards more active enforcement.

South Korea – PIPA amendments to take effect in September

  • What happened: Amendments to the Personal Information Protection Act (PIPA) were promulgated on 10 March 2026 and will take effect on 11 September 2026. The amendments strengthen accountability for personal information protection in several key respects, including:
  • Increased penalties: increasing the maximum penalty for certain repeat or significant violations or data breaches resulting from a failure to comply with a corrective order from 3% to 10% of annual turnover;
  • Potential data breach notification: requiring notification to data subjects of potential data breaches, rather than only after a breach has been confirmed;
  • Greater executive accountability: clarifying that the representative (e.g., CEO) or business owner bears ultimate responsibility for the secure processing of personal information and the protection of data subjects’ rights and must effectively implement comprehensive management measures;
  • Enhanced CPO requirements: requiring that the appointment of CPO be approved by the board and notified to the Personal Information Protection Commission (PIPC);
  • Mandatory ISMS-P certification (effective from 1 July 2027): requiring data handlers meeting certain thresholds to obtain an ISMS-P certification; and
  • Incentives for data protection investments: introducing mechanisms that may reduce sanctions where organisations demonstrate that they have made investments in budgets, personnel, facilities, and devices for data protection and privacy.
  • Why it matters: South Korea is already one of the most active data protection enforcement jurisdictions in the Asia-Pacific region. Increasing the maximum penalty ceiling to 10% of annual turnover further raises potential regulatory exposure. In addition, the heightened accountability placed on senior management, together with incentives for demonstrable investment in privacy compliance, reinforces the importance of maintaining robust data protection governance programmes. Organisations should also closely monitor the forthcoming amendments to the Enforcement Decree of the PIPA, which are expected to provide additional detail on how the amended PIPA provisions will be implemented in practice.

Indonesia – PDP Law implementing regulation promulgated

  • What happened: Indonesia has issued Government Regulation No. 33 of 2026 (GR 33/2026), the long-awaited implementing regulation for Law No. 27 of 2022 on Personal Data Protection (PDP Law). The regulation recently became available to the public and will take effect on 16 January 2027. It operationalises the requirements of the PDP Law, providing detailed rules on, among others, lawful bases and consent, required registers of processing activities (ROPA) and retention policies, data protection impact assessments (DPIA) required for higher-risk processing, cross-border transfers, data breach notification, data protection officers (DPO), and joint controllers and processors.
  • Why it matters: The regulation paves the way for the implementation of the PDP Law, and includes Indonesia-specific requirements that may necessitate localisation of organisations’ existing global privacy programmes. Organisations are recommended to use the six-month implementation period to assess and align their existing compliance frameworks with the new requirements before the regulation takes effect in January 2027.

Key takeaway

With Vietnam’s sanctions regime now in force, enhanced penalties and compliance requirements on the horizon in South Korea, and Indonesia’s implementing regulation set to take effect at the start of next year, organisations should take this opportunity to review their data protection and cybersecurity posture — from cross-border data transfer mechanisms and breach response protocols to executive accountability and investment in privacy personnel — to ensure alignment with local requirements and regulatory expectations. More broadly, as these developments signal a continued shift towards more mature and robust privacy regulatory and enforcement regimes across APAC, it is increasingly important for organisations to keep abreast of evolving regulatory priorities and enforcement trends in the region.