Vietnam, S. Korea, Indonesia Bolster Privacy Enforcement
Recent legal changes in Vietnam, South Korea, and Indonesia signal a regional shift toward active data-privacy enforcement, introducing significant new penalties and compliance obligations.
Several Asia-Pacific nations are intensifying data privacy and cybersecurity enforcement, signaling an end to perceived grace periods for compliance. In Vietnam, a new decree effective August 2026 establishes a sanctions framework for its data protection and cybersecurity laws, with penalties reaching up to 5% of a company's prior-year revenue. South Korea's amended Personal Information Protection Act (PIPA), effective September 2026, raises the maximum penalty for certain violations to 10% of annual turnover and heightens accountability for senior executives. Meanwhile, Indonesia has issued an implementing regulation for its Personal Data Protection Law, which will take effect in January 2027 and provides detailed rules on consent, data transfers, and breach notifications. These parallel developments underscore a regional trend toward more robust and proactive regulatory oversight. Multinational organizations operating in the region face heightened legal and financial risk and should promptly review and localize their privacy compliance programs to align with these new, specific requirements, particularly concerning executive liability and cross-border data flows.