APAC Data Residency Digest — October 2026
TL;DR
The headline this cycle is China's enforcement machinery turning cross-border data transfer rules into a live weapon — against AI query routing itself, with the CAC probing DeepSeek and Moonshot AI for allegedly piping Chinese user data to Anthropic's Claude. Around it, the region's other regimes keep building: Vietnam's data security law cleared committee with a 5%-of-revenue fine cap, Indonesia's GR 33/2026 got its first detailed pre-effect compliance read-out, and Korea's new 10% ceiling now has its first test case queued in the Coupang decision.
China: AI routing becomes a cross-border transfer enforcement question
The CAC has demonstrated it will treat AI-era data flows — prompts, queries, embedded corporate and government data sent to foreign model providers — as squarely within China's cross-border data transfer rules.
"if Anthropic's allegations are true, sensitive data from Chinese users, government bodies, police, and state enterprises could have been sent to American systems along with the queries. This could potentially violate the country's cross-border data transfer regulations" — ForkLog, citing The Information
The probe followed Anthropic's 154-page September 10 report on "illegal distillation," which claimed Moonshot redirected over 23 million user queries to Claude between May and July, and DeepSeek more than 12 million in 14 days china-ai-cross-border-data-enforcement-2026. This lands on top of a special enforcement campaign that is now producing citable precedents: a Shanghai company was fined for exporting personal information through an ordinary Windows desktop client with no export security assessment, and a Jiangsu company was warned for running an LLM "API relay station" without one china-pipl-enforcement-campaign-april-2026
. Any endpoint tool or relay that moves PI out of China is now active enforcement territory — and app-store takedowns, not just fines, are the standard remedy, with 28 of 75 apps named in August already off the stores after failed retests.
What to watch: The CAC's sanctions decision in the DeepSeek/Moonshot probe — and whether it pairs the outcome with new guidance defining the AI-export compliance perimeter.
Vietnam: a four-tier data security law is one vote away
Vietnam's draft Law on Data Security reached the National Assembly Standing Committee on September 23, with the full NA's October session expected to enact it — and the penalty architecture is now firm.
"The maximum administrative fine for serious violations involving the leakage, theft or destruction of level-3 and level-4 data will be capped at 5 per cent of revenue in Vietnam or global revenue, depending on the case" — Vietnam Law Magazine
The softening matters as much as the cap: levels 1 and 2 are self-assessed by controllers with no additional administrative procedures, so the exposure concentrates on level 3/4 "important/core" data vietnam-data-security-law-draft-limits-2026. NA Chairman Tran Thanh Man's caution — that the law "must become a strategic tool rather than a barrier" — signals the digital-economy balancing act is live in the drafting room, not just in commentary.
What to watch: The October vote, and whether your Vietnam-held datasets could plausibly be classified important/core before the taxonomy takes effect.
Indonesia: the pre-effect checklist sharpens, the DPA still doesn't exist
Norton Rose Fulbright's late-September read-out on GR 33/2026 turns last cycle's headline into an operational punch list before the January 16, 2027 effective date.
"Existing global or GDPR-based arrangements should not be assumed to satisfy Indonesian requirements. Consultation with the Data Protection Authority may be required prior to any cross-border transfer of personal data." — Norton Rose Fulbright
The two operative risks are the 72-hour breach clock — which starts when a protection failure is "definitively, duly, and reasonably established," not merely detected — and transfer documentation, since GDPR-era intra-group SCCs can't be assumed to carry Indonesian transfers indonesia-pdp-law-compliance-transitional-realities-2026. The fine cap of 2% of annual revenue is modest by APAC standards; the process burden is not.
What to watch: Kominfo/Komdigi transition guidance and the still-pending presidential process forming the DPA — the moment it exists, GR 33/2026 becomes enforceable law.
Korea: the 10% ceiling is live, and Coupang is the test case
Korea's amended PIPA took effect September 11, and the first decision under the new regime may be the largest privacy penalty in its history.
The PIPC is investigating the Coupang breach affecting 33.7 million users — the largest in Korean history — with a potential fine reported at up to KRW 1 trillion (~US$770 million), and evidence has emerged that access logs may have been deleted during the investigation south-korea-pipc-prevention-transition-2026+2. If decided under the new 10%-of-turnover ceiling, it would be the first maximum-tier test and would eclipse the SK Telecom record of KRW 134.8 billion set under the old 3% cap. The enforcement ladder behind it shows why MNCs should care: "cross-border data practices and processing relationships drive most of the foreign-company fines," from Kakao Pay (with Alipay ordered to delete an NSF credit-scoring model) to AliExpress and Temu.
What to watch: The PIPC's Coupang decision — the first real data point on how the 10% ceiling gets applied.
Australia: the bill is coming, but the transfer reform isn't in it
Australia's Tranche 2 exposure draft consultation closed September 18, and the bill is expected late 2026 or early 2027 — but the cross-border piece was left out.
"a prescribed list of countries and contractual clauses for overseas data transfers" — White & Case, listing it among proposals not included in the exposure draft
That means the existing accountability-based APP 8 transfer regime continues for now — a notable deferral given last cycle's framing of the "fair and reasonable" test as the headline australia-privacy-reform-data-residency-2026. What is in the draft still forces uplift: controller/processor concepts, consent-for-trading (capturing cookies and pixels), and a 72-hour OAIC breach clock, with 6–12 month grace periods meaning the compliance clock starts at passage, not commencement.
What to watch: The bill's introduction — and whether the deferred transfer reforms reappear before passage.
What surprised us
- China's most concrete cross-border enforcement of the cycle wasn't against an MNC — it was against Chinese AI companies allegedly leaking Chinese data out. The DeepSeek/Moonshot probe reframes export controls as a two-way street, and puts every enterprise workflow piping China-origin data through offshore AI services inside demonstrated enforcement scope china-ai-cross-border-data-enforcement-2026
.
- Korea's remedy toolkit now includes algorithmic disgorgement. Alipay was ordered to delete an entire credit-scoring model built on unlawfully transferred data — a remedy type that could spread south-korea-pipc-prevention-transition-2026
+2.
- Vietnam is writing a post-quantum deadline into data law. Level-4 data held by Party, State and armed forces must transition to post-quantum cryptography by January 1, 2035 — an unusually concrete technical mandate for a privacy statute vietnam-data-security-law-draft-limits-2026
.
- A circulating report of a ~US$49M Meta fine doesn't match the known PIPC record. We've opened a verification thread — treat secondary claims of new large PIPA fines with suspicion until confirmed against PIPC releases.
Open threads worth a vote
- [watch] CAC decides outcome of DeepSeek/Moonshot AI data-routing probe — the enforcement outcome and any new AI-export guidance will define the compliance perimeter for offshore AI workflows.
- [watch] PIPC penalty decision on Coupang 33.7M-user breach — the first test of the 10% ceiling.
- [question] Verify reported PIPC fine on Meta/Instagram (~US$49M) — confirm whether this is a new September 2026 action or a misreporting of the November 2024 fine.