APAC Data Residency Digest — September 2026
TL;DR
This is the cycle where the region's biggest regimes stopped drafting and started operating: Korea's amended PIPA with its 10% global-revenue fine ceiling took effect September 11, China's small-processor simplification went live September 1, and Indonesia finally published the cross-border transfer rules its 2022 PDP Law has waited four years for. Meanwhile Australia and India set clocks running — a "fair and reasonable" exposure draft in Canberra, a November 2026 Consent Manager milestone in Delhi — and survey data shows boards are already restructuring data architectures around sovereignty rather than waiting for harmonisation.
Korea's fine ceiling goes live — and it's now the world's highest
South Korea's amended PIPA moved from statute to enforcement reality on September 11, 2026, hardening the region's most aggressive regime into a materially higher-stakes one.
"a two-tier penalty structure where the baseline fine of up to 3% of related revenue is joined by an elevated tier of up to 10% of a company's total global annual revenue when aggravating factors are present" — Korea PIPA Takes Effect Tomorrow: World's First AI Training Data Law Is Now Enforceable — TechTimes
That ceiling surpasses the GDPR's 4% and the EU AI Act's 7% south-korea-pipc-prevention-transition-2026+2. The Coupang precedent — a record KRW 624.6 billion (~$467M) fine under the old law — shows where this regime was already heading. Beyond fines, the amendments make the CEO the "ultimate responsible person" for compliance by statute, require board approval for CPO appointments at large organizations, and trigger breach notification when a leak is merely reasonably likely — not just confirmed south-korea-pipc-prevention-transition-2026
+2. The PIPC followed within days with proposed Enforcement Decree amendments on ISMS-P audits (comment period through October 26), so the rulebook is still moving.
What to watch: The July 1, 2027 mandatory ISMS-P certification deadline for large controllers — gap analysis against ISO 27001/27701 programs should start now.
Indonesia publishes its transfer rules — but the referee doesn't exist yet
Indonesia's long-delayed implementing regulation finally resolves how data can leave the country, even as the authority meant to enforce it remains unbuilt.
"Indonesia has published long-delayed implementation rules for its 2022 Personal Data Protection (PDP) Law, spelling out for the first time how companies may legally transfer personal data abroad, even as the authority to enforce those rules remains to be created four years after the landmark law took effect." — New rules likely to unlock cross-border data flows — The Star (AFP)
GR 33/2026, effective January 16, 2027, recognises adequacy decisions and binding corporate rules as legal transfer pathways and adds programme-level obligations — ROPA, DPIAs, DPO requirements — with DLA Piper flagging "Indonesia-specific requirements that may necessitate localisation of organisations' existing global privacy programmes" indonesia-pdp-law-compliance-transitional-realities-2026. The catch is enforcement capacity: the data protection authority still awaits presidential approval, so the regulation's practical bite is prospective. Use the six-month runway to map Indonesian data flows against the new pathways before the DPA's arrival converts them from paperwork into live risk.
What to watch: The presidential process constituting the DPA — the moment it exists, GR 33/2026 becomes enforceable law rather than a compliance template.
China builds a regulatory ladder — with localization at the top
China is tiering its PIPL regime by processor size, and both ends moved this month: simplification for the small, infrastructure-grade obligations for the large.
"China is 'treating major data handlers increasingly like regulated infrastructure institutions'" — China closes consultation on stricter rules for large data processors — Digital Watch Observatory
The small-processor rules (Order No. 25, in force September 1) lighten obligations for processors handling data of fewer than 100,000 individuals — but the Article 6 trap matters: publication-only notice is unavailable if data is "provided to another processor," which disqualifies most China subsidiaries feeding employee records into global HR systems or group CRMs china-pipl-cross-border-transfer-pathways-2026. At the other end, the draft large-processor rules (10M+ individuals, consultation closed September 7) would require domestic storage of Chinese-collected personal information and use of China-located data centres meeting specified ownership requirements — plus an independent supervisory committee mostly of external members china-pipl-cross-border-transfer-pathways-2026
. A separate July CAC Q&A also narrowed recruitment flows: CVs sent to an overseas HQ "that takes no part in the hiring decision" are not "necessary" and should stay in China.
What to watch: Final adoption of the large-processor rules, and whether the domestic-storage and data-centre-ownership requirements survive consultation.
Australia and India set the next clocks
The region's two big common-law rollouts both advanced on schedules compliance teams can plan against.
Australia's Tranche 2 exposure draft (consultation closed September 18) centres on a world-first "fair and reasonable" test: collection, use, or disclosure is only lawful if fair and reasonable in the circumstances — and, as The Conversation put it, "Businesses cannot consent their way around it" australia-privacy-reform-data-residency-2026. AI-drawn inferences count as "collected" information, precise location data becomes sensitive, and large platforms face a first right-to-erasure. Because the test operates as a ceiling consent mechanics can't rescue, broad secondary uses routed offshore become independently challengeable even when consented to. India's DPDP, meanwhile, has a near-term milestone: Consent Manager registration opens in November 2026, six months before the May 2027 substantive obligations — including the rule 15 cross-border transfer provisions — commence, and the in-house analysis warns that "a team that treats May 2027 as its only date leaves those six months unused" india-dpdpa-compliance-roadmap-may-2027
.
What to watch: Australia's final Tranche 2 bill language, and which firms register as India's first Consent Managers in November.
What surprised us
- Korea's carrot is nearly as notable as its stick. The amended PIPA offers fine reductions up to 40% for documented privacy investment (budget, personnel, systems), absent intent or gross negligence — an unusually explicit incentive structure worth building evidence for south-korea-pipc-prevention-transition-2026
+2.
- The AI-training consent question is being relocated to regulators. Korea's pending amendment would allow non-pseudonymized data for AI development without consent, subject to PIPC case-by-case approval — prompting VeraSafe's Kyoungsic Min to ask "who supervises the supervisor?" Japan's PPC is doing the conceptual groundwork for a similar "statutory compilation" AI exception in its APPI rulemaking japan-appi-2026-amendments-diet-enactment
. The pattern: permissionless AI training is becoming regulator-discretionary, not controller-autonomous.
- Sovereignty drivers differ wildly by market. Australia's top driver is control over sensitive data (56%); Vietnam's is geopolitical risk mitigation (47%); Singapore's is customer pressure for localization at just 24% — so a uniform APAC sovereignty strategy is structurally wrong multinational-data-residency-adaptation-japan-korea-australia-2026
.
- AI adoption is being throttled by compliance, not capability. Among APAC organisations not yet using AI, 60% cite security, privacy, compliance, or sovereignty concerns as the barrier multinational-data-residency-adaptation-japan-korea-australia-2026
Open threads worth a vote
- [watch] Indonesia GR 33/2026 (PDP implementing regulation) takes effect — track transition guidance and DPA formation status ahead of the January 16, 2027 effective date.
- [watch] India Consent Manager registration opens — see which applicants register when rule 4 commences in November.
- [watch] China finalizes large personal information processor rules — watch whether the localization and data-centre requirements are softened in the final text.