TL;DR
Regulatory frameworks across the Asia-Pacific region are transitioning from reactive post-incident reporting to aggressive, preemptive barriers and direct executive accountability. Vietnam is advancing a highly restrictive data classification system that introduces hard bans on exporting critical information, while South Korea is shifting the burden of proof to corporations and locking in ultimate legal liability at the CEO level.
Vietnam's Hardening Sovereignty Gates
Vietnam is shifting from retrospective compliance audits to preemptive, state-controlled data gates that could completely halt cross-border transfers.
"Unlike previous regulations like the Personal Data Protection Law (PDPL) or the Law on Data (effective July 1, 2026), which rely on cross-border transfer impact assessment (CBTIA) filings that allow transfers to proceed prior to retroactive audit, the proposed DSL introduces hard structural barriers" — [Vietnam's Draft Law on Data Security
]
This shift means multinational technology, telecommunications, and SaaS providers can no longer rely on standard impact assessments to maintain international data flows. By codifying a four-tier classification system, the Ministry of Public Security is establishing itself as a strict gatekeeper, requiring prior approval for "important" data and completely blocking "core" data from leaving the country Vietnam's Draft Law on Data Security. This structural barrier forces compliance teams to immediately map localized data or risk severe bandwidth restrictions and fines capped at 5% of revenue Vietnam's Draft Law on Data Security
.
What to watch: Watch whether the National Assembly votes to pass the proposed Law on Data Security in its upcoming October session Vietnam's Draft Law on Data Security.
South Korea's Executive Accountability and Punitive Surcharges
South Korea is placing the legal and financial burden of data protection directly onto corporate boardrooms, backing the strategy with unprecedented revenue-based penalties.
"In cases of intentional or gross negligence leading to repeated violations within three years, or serious data breaches affecting 10 million or more individuals, the PIPC can impose a penalty surcharge of up to 10% of annual revenue" — [South Korea Promulgates Sweeping PIPA Amendments
]
This dramatic escalation ensures that privacy compliance is no longer treated as a back-office IT concern, as the amended Personal Information Protection Act (PIPA) explicitly designates the CEO as the individual with ultimate legal liability [South Korea Promulgates Sweeping PIPA Amendments]. Multinational enterprises routing Korean user data overseas will face both a new cross-border transfer impact assessment system and strict Chief Privacy Officer (CPO) qualification mandates that require formal board approval [South Korea Promulgates Sweeping PIPA Amendments
].
What to watch: Watch how the Personal Information Protection Commission (PIPC) responds to formal industry pushback, such as the comments submitted by the Business Software Alliance on July 14, 2026, which advocated for internationally recognized security certifications to satisfy local requirements [South Korea Promulgates Sweeping PIPA Amendments].
What surprised us
- The complete shift in the burden of proof: Under South Korea's amended PIPA, the burden of proving a lack of intent or negligence in a data breach case shifts entirely from the victim to the corporation [South Korea Promulgates Sweeping PIPA Amendments
- Aggressive global revenue exposure in Vietnam: If a multinational's local revenue is considered disproportionate to a violation, Vietnamese authorities can calculate administrative fines of up to 5% based on the group's global revenue, rather than just local turnover [Vietnam's Draft Law on Data Security
- South Korea's calculation formula overhaul: To prevent companies from using historical low-earning years to dilute fines, the PIPC revised its Enforcement Decree to calculate surcharges based on the greater of the preceding year's revenue or the three-year average [South Korea Promulgates Sweeping PIPA Amendments