APAC Data Residency Digest — October 2026
TL;DR
The headline this cycle is that the region's two big emerging regimes moved from paper to machinery. India's long-dormant Data Protection Board was ordered by the Kerala High Court to become functional within eight weeks — just ahead of Consent Manager registration opening November 13 — while Malaysia opened a consultation on an AI-and-personal-data framework that treats AI vendor contracts as a cross-border transfer problem. Neither is a new law; both are the moment when existing rules start getting enforced.
India: the missing regulator gets a court-imposed deadline
India's DPDP rollout has had a single point of failure — a Board that doesn't exist — and a court just put a clock on it. The Data Protection Board created by the DPDP Act 2023 "has not yet started working", and the Kerala High Court "has now told the Centre to make it functional within eight weeks" — roughly early December 2026 — in a PIL about how airports collect and store passengers' personal data (the Digi Yatra case) india-dpdpa-compliance-roadmap-may-2027
.
The timing is tight by design: Consent Manager registration opens November 13, 2026, and the Board is the body that must register them and adjudicate breaches with penalties up to Rs 250 crore. Its continued non-existence has been "the biggest execution risk in the DPDP rollout" — without it, the entire consent architecture is theoretical india-dpdpa-compliance-roadmap-may-2027.
Meanwhile, MeitY quietly did housekeeping that matters more than it looks. The DPDP (Removal of Difficulties) Order, 2026 (issued October 5) made two textual fixes: inserting "of" into s.9(1) so verifiable parental consent clearly covers both children and persons with disabilities (breach exposure up to Rs 200 crore), and replacing "audit" with "data audit" in s.10(2)(c)(ii) for Significant Data Fiduciary audits. As CyberPeace put it:
"Data Fiduciaries, auditors and the Data Protection Board will all be working from the same words, so that the distinction between 'audit' and 'data audit', or between a phrase including or omitting 'of', is the sort of gap that can decide an argument."
— CyberPeace
The May 13, 2027 deadline for operational duties — notice, consent, breach reporting, and the rule 15 cross-border provisions — is unchanged. The practical to-dos now: align consent-flow language for children and persons with disabilities, use "data audit" consistently in SDF charters and engagement letters, and keep the Gazette text (not summaries) in your compliance file india-dpdpa-compliance-roadmap-may-2027.
What to watch: Whether the Centre actually complies with the 8-week timeline before the November 13 Consent Manager window opens — and which Consent Managers register first once the Board stands up.
Malaysia: AI compliance is being wired into the PDPA — and into your vendor contracts
Malaysia is building an AI governance layer on top of its amended PDPA, and the draft makes clear that AI procurement is a data transfer exercise. On October 5, the PDPD published a consultation paper on a proposed AI and Personal Data Protection Framework — lifecycle-based guidance for anyone developing, procuring, deploying, or supporting AI systems — with submissions due October 23 malaysia-ai-personal-data-framework-consultation-2026
.
The framework's core position is that AI changes nothing about legal bases: "AI does not create a separate legal basis for processing personal data" — you document the existing basis, ensure necessity and proportionality, and get fresh consent where data is used for a materially different purpose. The cross-border hook is in the third-party AI section:
"Before procuring or integrating third-party AI systems, organisations should conduct due diligence, define roles and data-processing responsibilities contractually, assess cross-border transfers and applicable safeguards, and maintain ongoing vendor oversight."
— Baker McKenzie
That means AI vendor contracts now need transfer-mapping against Malaysia's post-amendment transfer grounds (substantially similar law / adequate protection / listed grounds) — the same diligence you'd run for any offshore processor, applied to your AI stack. The framework also stresses evidence over assertion: "The emphasis is not only on compliance, but on maintaining evidence that governance arrangements operate effectively" malaysia-ai-personal-data-framework-consultation-2026.
Behind it sits a proposed AI Governance Bill, "expected to be tabled in Parliament, at the latest by Q1 2027," establishing overarching governance principles and institutional responsibilities. Together, the two instruments signal Malaysia building a structured regime fast — barely 18 months after its 2024–2025 PDPA overhaul and April 2025 shift to risk-based transfer guidelines malaysia-ai-personal-data-framework-consultation-2026.
What to watch: Publication of the final Framework after the October 23 consultation close — and whether the AI Governance Bill actually makes it into Parliament by Q1 2027.
What surprised us
- A High Court, not the executive, is forcing India's regulator into existence. The Board's non-existence was a known risk, but the fix arriving via a PIL about airport passenger data (Digi Yatra) — not via MeitY's own timetable — tells you the rollout's momentum is coming from litigation, not the implementation plan india-dpdpa-compliance-roadmap-may-2027.
- Single words are worth Rs 200 crore in India. An inserted "of" and an "audit"→"data audit" swap are the kind of drafting fixes that quietly close off entire defense arguments. If your templates still paraphrase the Act, now is the time to conform them to the Gazette text.
- Malaysia is treating AI vendors as transfer risk, full stop. Most AI frameworks talk about model governance; Malaysia's draft routes the compliance obligation through procurement and cross-border transfer diligence — which means your existing vendor-review process, not a new AI ethics committee, is the control that has to bend malaysia-ai-personal-data-framework-consultation-2026.
- The pace is accelerating, not settling. Malaysia went from PDPA overhaul (2024–2025) to risk-based transfer guidelines (April 2025) to an AI framework consultation (October 2026) to a possible AI Governance Bill (Q1 2027) — a compressed build-out that leaves little slack between rules landing and being enforced.
Open threads worth a vote
- [watch] Kerala HC 8-week deadline for Data Protection Board functionality — the Board must be operational to register Consent Managers from November 13; fires when it stands up or when the deadline lapses.
- [watch] Malaysia PDPD finalizes AI and Personal Data Protection Framework — the consultation closed October 23; the final Framework will set the lifecycle expectations for AI systems.
- [watch] Malaysia AI Governance Bill tabled in Parliament — expected "at the latest by Q1 2027."
APAC Data Residency Digest — October 2026 (delta edition)
Since last time
This cycle is a near-total rotation of subject matter: the three jurisdictions that dominated the November briefing (Korea, Japan, Australia) are all absent, and two new ones (India, Malaysia) take over. Nothing carried forward.
- Promoted — India and Malaysia are the two core sections this cycle. Strictly speaking they weren't even minor items last time — they're new entrants, and both arrive as "machinery" stories rather than new-law stories.
- Escalated — none.
- Demoted — none.
- Disappeared — Korea (Coupang fine analysis, evidence-preservation lesson, PIPC's October 2 machinery overhaul), Japan (the PPC's October 1 AI-training-data exception blueprint), Australia (the December 10 ADM transparency deadline and the parked Tranche 2 bill), and the Meta fine-rumor resolution. None of these had developments reported this cycle — they dropped off, they weren't resolved. The December 10 Australian deadline in particular is still a live date you should keep on your own calendar even though the briefing no longer tracks it.
- Unchanged — nothing; no section survives from last cycle.
India: the missing regulator gets a court-imposed deadline (new entrant)
India's DPDP rollout has had a single point of failure — a Board that doesn't exist — and a court just put a clock on it. The Data Protection Board created by the DPDP Act 2023 "has not yet started working", and the Kerala High Court "has now told the Centre to make it functional within eight weeks" — roughly early December 2026 — in a PIL about how airports collect and store passengers' personal data (the Digi Yatra case) india-dpdpa-compliance-roadmap-may-2027.
The timing is tight by design: Consent Manager registration opens November 13, 2026, and the Board is the body that must register them and adjudicate breaches with penalties up to Rs 250 crore. Its continued non-existence has been "the biggest execution risk in the DPDP rollout" — without it, the entire consent architecture is theoretical india-dpdpa-compliance-roadmap-may-2027.
Meanwhile, MeitY quietly did housekeeping that matters more than it looks. The DPDP (Removal of Difficulties) Order, 2026 (issued October 5) made two textual fixes: inserting "of" into s.9(1) so verifiable parental consent clearly covers both children and persons with disabilities (breach exposure up to Rs 200 crore), and replacing "audit" with "data audit" in s.10(2)(c)(ii) for Significant Data Fiduciary audits. As CyberPeace put it:
"Data Fiduciaries, auditors and the Data Protection Board will all be working from the same words, so that the distinction between 'audit' and 'data audit', or between a phrase including or omitting 'of', is the sort of gap that can decide an argument."
— CyberPeace
The May 13, 2027 deadline for operational duties — notice, consent, breach reporting, and the rule 15 cross-border provisions — is unchanged. Practical to-dos now: align consent-flow language for children and persons with disabilities, use "data audit" consistently in SDF charters and engagement letters, and keep the Gazette text (not summaries) in your compliance file india-dpdpa-compliance-roadmap-may-2027.
What to watch: Whether the Centre actually complies with the 8-week timeline before the November 13 Consent Manager window opens — and which Consent Managers register first once the Board stands up.
Malaysia: AI compliance is being wired into the PDPA — and into your vendor contracts (new entrant)
Malaysia is building an AI governance layer on top of its amended PDPA, and the draft makes clear that AI procurement is a data transfer exercise. On October 5, the PDPD published a consultation paper on a proposed AI and Personal Data Protection Framework — lifecycle-based guidance for anyone developing, procuring, deploying, or supporting AI systems — with submissions due October 23 malaysia-ai-personal-data-framework-consultation-2026.
The framework's core position is that AI changes nothing about legal bases: "AI does not create a separate legal basis for processing personal data" — you document the existing basis, ensure necessity and proportionality, and get fresh consent where data is used for a materially different purpose. The cross-border hook is in the third-party AI section:
"Before procuring or integrating third-party AI systems, organisations should conduct due diligence, define roles and data-processing responsibilities contractually, assess cross-border transfers and applicable safeguards, and maintain ongoing vendor oversight."
— Baker McKenzie
That means AI vendor contracts now need transfer-mapping against Malaysia's post-amendment transfer grounds (substantially similar law / adequate protection / listed grounds) — the same diligence you'd run for any offshore processor, applied to your AI stack. The framework also stresses evidence over assertion: "The emphasis is not only on compliance, but on maintaining evidence that governance arrangements operate effectively" malaysia-ai-personal-data-framework-consultation-2026.
Behind it sits a proposed AI Governance Bill, "expected to be tabled in Parliament, at the latest by Q1 2027," establishing overarching governance principles and institutional responsibilities. Together, the two instruments signal Malaysia building a structured regime fast — barely 18 months after its 2024–2025 PDPA overhaul and April 2025 shift to risk-based transfer guidelines malaysia-ai-personal-data-framework-consultation-2026.
What to watch: Publication of the final Framework after the October 23 consultation close — and whether the AI Governance Bill actually makes it into Parliament by Q1 2027.
What surprised us
- [NEW] A High Court, not the executive, is forcing India's regulator into existence. The Board's non-existence was a known risk, but the fix arriving via a PIL about airport passenger data (Digi Yatra) — not via MeitY's own timetable — tells you the rollout's momentum is coming from litigation, not the implementation plan india-dpdpa-compliance-roadmap-may-2027.
- [NEW] Single words are worth Rs 200 crore in India. An inserted "of" and an "audit"→"data audit" swap are the kind of drafting fixes that quietly close off entire defense arguments. If your templates still paraphrase the Act, now is the time to conform them to the Gazette text.
- [NEW] Malaysia is treating AI vendors as transfer risk, full stop. Most AI frameworks talk about model governance; Malaysia's draft routes the compliance obligation through procurement and cross-border transfer diligence — which means your existing vendor-review process, not a new AI ethics committee, is the control that has to bend malaysia-ai-personal-data-framework-consultation-2026.
- [NEW] The pace is accelerating, not settling. Malaysia went from PDPA overhaul (2024–2025) to risk-based transfer guidelines (April 2025) to an AI framework consultation (October 2026) to a possible AI Governance Bill (Q1 2027) — a compressed build-out that leaves little slack between rules landing and being enforced.
Open threads
New threads this cycle:
- [watch] Kerala HC 8-week deadline for Data Protection Board functionality — the Board must be operational to register Consent Managers from November 13; fires when it stands up or when the deadline lapses.
- [watch] Malaysia PDPD finalizes AI and Personal Data Protection Framework — the consultation closed October 23; the final Framework will set the lifecycle expectations for AI systems.
- [watch] Malaysia AI Governance Bill tabled in Parliament — expected "at the latest by Q1 2027."
Status of last cycle's thread:
- First PIPA penalty decision applying the 10% turnover ceiling — not closed and not absorbed; it simply vanished from this cycle's coverage along with all Korea content. The underlying question (no large-breach penalty decided under the new ceiling yet) remains open on its own terms, so treat it as still live even though the briefing has stopped tracking it.