Qiuyang Zhao

Subscribe to Qiuyang Zhao's Posts

Across the Asia-Pacific region, privacy and cybersecurity regulation continues to evolve rapidly, with regulators increasingly moving from legislative build-out to practical compliance and enforcement. Recent developments in Vietnam, South Korea and Indonesia illustrate this trend and signal heightened regulatory expectations for organisations operating in the region.

Below is a snapshot of what happened, and why…

Continue Reading APAC Privacy Update: Major Regulatory Developments in Vietnam, South Korea and Indonesia Set the Stage for Enhanced Privacy Enforcement

Since the enactment of Singapore’s Cybersecurity Act 2018 (Cybersecurity Act), Singapore’s digital economy has grown rapidly, and cyber threats have evolved at a remarkable pace. To address this shifting landscape, the Cybersecurity  (Amendment)  Act 2024 (Amendment Act) was passed last year, introducing significant amendments to the Cybersecurity Act to broaden regulatory…

Continue Reading Singapore: Key Amendments to the Cybersecurity Act Now in Force

On 28 October 2025, China passed amendments to the Cybersecurity Law, marking the first update since its enactment in 2016. These amendments reflect China’s heightened focus on cybersecurity and AI governance and are scheduled to take effect on 1 January 2026.

Key Updates

The amendments primarily focus on the law’s enforcement provisions. Key updates include:…

Continue Reading CHINA: Amendments to Cybersecurity Law Effective 1 January 2026

It’s well-known that China’s data protection laws define sensitive personal information very differently to other jurisdictions. Instead of a closed list of data types, sensitive personal information in China has traditionally been defined by reference to a broad “risk of harm” test. A new national standard, which will come into force on 1 November 2025…

Continue Reading CHINA: definition and handling of Sensitive Personal Information helpfully clarified

Following Malaysia’s introduction of data breach notification and data protection officer (“DPO”) appointment requirements in last year’s significant amendments to the Personal Data Protection Act (“PDPA”) (click here for our summary), the Personal Data Protection Commissioner of Malaysia (“Commissioner”) recently released guidelines that flesh out such requirements, titled the…

Continue Reading Malaysia: Guidelines Issued on Data Breach Notification and Data Protection Officer Appointment

Chinese data regulators are intensifying their focus on the data protection compliance audit obligations under the Personal Information Protection Law (“PIPL“), with the release of the Administrative Measures for Personal Information Protection Compliance Audits (“Measures“), effective 1 May 2025.

The Measures outline the requirements and procedures for both self-initiated and regulator-requested…

Continue Reading CHINA: Mandatory Data Protection Compliance Audits from 1 May 2025

On 3 January 2025, the Cyberspace Administration of China (“CAC“) released for public consultation the draft Measures for Certification of Personal Information Protection for Cross-Border Transfer of Personal Information (“Draft Measures“). This regulation represents the final piece in the CAC’s regulatory framework for the three routes to legitimize cross-border transfers of personal data…

Continue Reading CHINA: Draft Regulation on Certification for Cross-Border Data Transfers Published

It’s the turn of South-East Asian countries to update their data protection laws. Here is our summary of the proposed new data protection laws in Vietnam, Malaysia and Indonesia. Organisations are advised to update their data protection compliance programmes as soon as possible to reflect these developments.

Vietnam

Vietnam issued its first draft of a…

Continue Reading VIETNAM, MALAYSIA AND INDONESIA: what you need to know about the new SE Asia data protection laws

Additional and clarified data compliance obligations will soon come into force under the long-awaited Network Data Security Management Regulation (“Regulation“), which was released on 30 September 2024. The Regulation is formulated under the existing data protection framework pillars of the Cyber Security Law, the Data Security Law and the Personal Information Protection Law…

Continue Reading CHINA: Enhanced and clarified data compliance obligations on handlers of “network data”, covering personal information and important data, and operators of online platforms from 1 January 2025

We previously wrote about proposed changes to the definition of sensitive personal information under a June 2024 draft of the Guide for Sensitive Personal Information Identification (“Guide“). The Guide has now (September 2024) been finalized and issued by the National Information Security Standardization Technical Committee (TC260). Helpfully, it gives organisations greater scope to…

Continue Reading China: New definition and guidelines on Sensitive Personal Information now finalised