Cycle on Sep 14, 2026

I will list the open threads for the topic to see if there are any specific questions, investigations, or watches that have been registered by previous cycles or users.

I will read the existing notes for this topic to understand what has already been documented and identify any gaps or updates required.

The current date is September 14, 2026. Let's check the threads and watches we have. We have: 1. `Vietnam National Assembly Vote on Draft Penal Code Personal Data Crimes` (fire_date: 2026-10-31) 2. `South Korea Mandatory ISMS-P Certification Implementation` (fire_date: 2027-07-01) 3. `Vietnam National Assembly Vote on Draft Law on Data Security` (fire_date: 2026-10-31) 4. `Japan PPC Rules and Guidelines on APPI 2026 Amendments` (ongoing) Let's do some search to see if there are any updates on these topics, and also search for new developments in APAC data residency and cross-border data transfer requirements. Let's do a search on data protection, cross-border data transfers, and data residency in APAC countries (especially Vietnam, South Korea, Japan, India, Indonesia, China, Australia, Singapore, Malaysia, Thailand, etc.) for recent months (e.g. June-September 2026). Let's start by doing some searches on: - Vietnam draft Law on Data Security (any updates from August/September 2026, or upcoming October 2026 vote) - Vietnam draft Penal Code amendments - Japan PPC guidelines/rules on APPI 2026 amendments - South Korea personal data protection updates (effective date of PIPA amendments was September 2026, so let's see if there are enforcement updates or new guidelines) - Indonesia PDP Law (full enforcement was expected, let's see if the DPA has been established or if implementing regulations have been finalized in mid/late 2026) - Other countries: China, India, Malaysia, Singapore, Australia, Thailand. Let's perform a web search first. I will state my intent first. I will search for recent news on Vietnam's draft Law on Data Security and draft Penal Code amendments to see if there are updates or if the October session is approaching.

This is extremely helpful! The PDF from Nishimura & Asahi ("Asia & Data Protection Newsletter(September 3, 2026)") contains detailed information on exactly what we need for Vietnam: - Reform administrative procedures relating to personal data protection under the PDPL and Decree 356. - Introduction of two designated criminal offenses related to personal data protection to the draft amended Penal Code. - The new draft law on data security ("Data Security Law"). Let's fetch that PDF or search for its content so we can read it in detail! Wait, the Nishimura & Asahi PDF URL is `https://www.nishimura.com/sites/default/files/newsletters/file/asia_data_protection_260903_en.pdf`. Let's see if we can fetch it, or if we can search for terms inside it. Let's first try to fetch `https://www.nishimura.com/sites/default/files/newsletters/file/asia_data_protection_260903_en.pdf`. Wait, `web_fetch` handles URLs and returns markdown. Let's see if it can handle PDFs or if we need to search for text. Yes, `web_fetch` can extract text from a PDF if the tool supports it. Let's try to fetch it. If it fails, we can search for specific terms. Let's try! I will fetch the Nishimura & Asahi Asia & Data Protection Newsletter from September 3, 2026, to extract detailed information on Vietnam's new data protection reforms, draft Penal Code amendments, and the draft Data Security Law.

Ah, it timed out or failed. Let's do a web search with some query terms from the snippet, or try to search for "Nishimura & Asahi" and "September 3, 2026" "Vietnam" or "Article 159a" or "Data Security Law" to get more details. Let's do a search. I will search for the specific details of Vietnam's proposed Penal Code amendments (specifically Article 159a) and the draft Data Security Law to understand the current provisions, classifications, and potential criminal offenses.

Ah, the Lexology article has the same title and text: "Vietnam: A Closer Look at the New Wave of Data Protection and Cybersecurity Regulations". Let's fetch the Lexology article! The URL is `https://www.lexology.com/library/detail.aspx?g=3c1ab005-d01c-488a-ae87-27af43feda61`. Let's try fetching this Lexology page, which is likely the same article by Nishimura & Asahi. I will fetch the Lexology article "Vietnam: A Closer Look at the New Wave of Data Protection and Cybersecurity Regulations" to read the complete details on Vietnam's draft Law on Data Security, the draft Penal Code amendments, and administrative reforms.

The Lexology page was successfully fetched but only has a brief intro. Let's see if we can find the full content of this newsletter by searching for the key headings and details from Nishimura & Asahi's PDF, or by searching for the text of the PDF directly on the web using Google Search. Let's try searching for specific strings like `"Reform administrative procedures relating to personal data protection under the PDPL"` or `"Introduction of two designated criminal offenses related to personal data protection"` or `"Article 159a" "Penal Code"` in Vietnam. I will search for the specific sections of the Nishimura & Asahi September 3, 2026 newsletter about Vietnam's draft Penal Code and Data Security Law to retrieve the full text.

Great! The search results show the PDF is indexed by Google, and we can find some strings. Let's do a search for `"Proposed addition of personal data offenses"` or `"Article 159a"` or `"159a"` or `"159b"` or search for `"The new draft law on data security"` inside the PDF. Wait, let's try to search the specific PDF text by using `site:nishimura.com "159a"` or other terms to see if we can get more snippets. I will search for the specific text in the Nishimura & Asahi PDF concerning the proposed criminal offenses in the draft amended Penal Code of Vietnam.

Ah! This is excellent. Let's do a search on Google with specific queries designed to pull out the text around Article 159a and 159b from this specific PDF. Let's see: `site:nishimura.com/sites/default/files/newsletters/file/asia_data_protection_260903_en.pdf "159a"` or `"159b"`. Let's try that. I will search for text inside the September 3, 2026 Nishimura & Asahi PDF containing "Article 159a" or "Article 159b" or "159a" or "159b" to understand the proposed criminal offenses in Vietnam's draft amended Penal Code.

Let's search for "Article 159a" or "Article 159b" on the open web to see if other law firms have written about them. Let's try searching: `Vietnam "Article 159a" OR "Article 159b" OR "Article 159-a" OR "Article 159-b" "Penal Code" OR "criminal"` or `Vietnam Penal Code "personal data" draft 2026`. I will search for other law firm publications or news articles detailing the proposed Articles 159a and 159b in Vietnam's draft amended Penal Code to understand what specific activities are being criminalized.

Excellent! The first result is: "Draft Penal Code targets data trafficking with stricter prison sentences... The crime of infringing on personal data (Article 159a)". Let's fetch this article: `https://en.sggp.org.vn/draft-penal-code-targets-data-trafficking-with-stricter-prison-sentences-post127755.html`. And the third result: `https://thevietnamese.org/2026/07/ministry-of-public-security-proposes-illegal-personal-data-trading-as-new-crime-in-viet-nam/`. Let's fetch both! I will fetch the SGGP article on the Draft Penal Code targeting data trafficking to get the exact provisions and penalties for Article 159a and other related articles.

This SGGP article is absolutely fantastic. It provides exact, concrete details on the three proposed criminal offenses in the draft amended Penal Code of Vietnam (Article 159a, 159b, and 159c): 1. **Article 159a: The crime of infringing on personal data** - Covers: gathering, processing, exchanging, gifting, publicizing, appropriating, illegally using, or intentionally leaking and losing others' personal data when statutory thresholds are met. - Penalties: fine ranging from VND 200 - 500 million ($7,600 - $19,000), non-custodial reform for up to three years, or a prison term from six months to three years. - Aggravated offenses (organized/professional crime, abusing position/power, illicit profits of VND 400 million ($15,200)+, causing damages of VND 1 billion ($38,000)+, or massive data subjects): up to seven years in prison. 2. **Article 159b: The crime of illegally buying and selling personal data** - Penalties: between one and 10 years behind bars depending on the volume of data and illicit profits. Maximum penalty (up to 10 years) applies when trading data of 25,000 people or more, or earning illicit profits of at least VND 1 billion ($38,000). 3. **Article 159c: The crime of obstructing personal data protection activities** - Covers: intentionally concealing or providing false information about data breaches, and establishing illegal technical barriers to hinder inspections and evidence collection. Wait! We have a watch for `Vietnam National Assembly Vote on Draft Penal Code Personal Data Crimes` (fire_date: 2026-10-31) and `Vietnam National Assembly Vote on Draft Law on Data Security` (fire_date: 2026-10-31). It is currently September 14, 2026. The vote has not yet occurred, but we have extremely valuable details on the drafts that were published for public consultation/appraisal. Let's do a search on the Vietnam draft Law on Data Security. The search results mentioned: `Vietnam: MPS publishes draft law on Data Security for public consultation` (August 6, 2026) - "Vietnam's draft Data Security Law establishes a comprehensive framework for data protection, with significant penalties for non-compliance, effective December 1, 2027." Let's search for this news on DataGuidance or other sites. The URL from the first search was: `https://www.dataguidance.com/news/vietnam-mps-publishes-draft-law-data-security-public` Let's search for it. I will search for the draft Law on Data Security published by Vietnam's Ministry of Public Security in August 2026 to understand its key provisions, such as classifications, export restrictions, and compliance deadlines.

This is exceptionally rich! Let's examine the details of the draft Data Security Law (DSL) and its accompanying Draft Data Security Decree (which is dated August 6, 2026, and based on the draft version of the DSL dated August 17, 2026). Wait, what are the key requirements of the draft Data Security Law? Let's search for "draft Data Security Law" or "Draft Data Security Decree" "Vietnam" to see what specific requirements exist. For example, the search results mentioned: - "Draft Data Security Law, Articles 6, 9, 10, 17, 20; Draft Data Security Decree, Articles 4, 6, 22, 23, 24, Chapter X" - "Draft Data Security Law, Articles 12, 13, 14, and 15; Draft Data Security Decree, Articles 32, 34, 35, 38, and 39." - "Draft Data Security Law, Article 23.8; Draft Data Security Decree, Articles 58.2 and 58.3, and Annex IX." - "Key policies and notable requirements in the draft Data Security Law and Draft Data Security Decree... 246/NQ-CP of the Government dated August 20, 2026, on adoption of the policies of the Data Security Law." Let's search for the actual content of the draft Data Security Law or the Linklaters Asia TMT Bulletin - August 2026 or DataGuidance article on the draft Data Security Law to see what specific provisions are in there. I will search for Linklaters' or DataGuidance's summaries of the draft Data Security Law of Vietnam (August 2026) to see the exact categories of data, export rules, and compliance requirements.

Let's look at the Nishimura PDF snippets again: - "The Data Security Law, a draft of which was released by the MPS for public consultation on July 17, 2026, is set for December 1, 2027 in the draft version released for public consultation" - "Like other recently promulgated data laws and cybersecurity laws, the draft Data Security Law is designed to [have extraterritorial scope]" - "Risk-based data taxonomy: Draft Data Security Law, Article 2.2, 2.3, 2.4, 2.6, 8.1, 8.2, 8.3" - "Key policies and notable requirements in the draft Data Security Law and Draft Data Security Decree: Draft Data Security Law, Articles 6, 9, 10, 17, 20; Draft Data Security Decree, Articles 4, 6, 22, 23, 24, Chapter X" - "Draft Data Security Law, Articles 12, 13, 14, and 15; Draft Data Security Decree, Articles 32, 34, 35, 38, and 39." - "Draft Data Security Law, Article 23.8; Draft Data Security Decree, Articles 58.2 and 58.3, and Annex IX." Let's do a search on Google for `"Risk-based data taxonomy" "Data Security Law" Vietnam` or `"Draft Data Security Law" "Article 2" OR "Article 8" "Vietnam"` or `"Draft Data Security Decree" "Article 58" OR "Article 32" "Vietnam"`. Wait, let's search for the actual text of the Nishimura PDF using a specific query. Let's try to search for the terms in the Nishimura newsletter that discuss the draft Data Security Law. I will search for specific terms in the Nishimura & Asahi newsletter regarding Vietnam's draft Data Security Law to extract the exact details of the risk-based data taxonomy and key policies.

This is fantastic! Let's search for the rest of this table and the text on the "Risk-based data taxonomy" to get the descriptions and principles for Level 3 and Level 4 data. Let's search for: `site:nishimura.com/sites/default/files/newsletters/file/asia_data_protection_260903_en.pdf "LEVEL" "DESCRIPTION" "PROTECTION PRINCIPLE"`. Or we can search for terms like `"Data circulating internally"` or `"national security" "social order"` in the PDF. I will search for the details of Level 3 and Level 4 data security risk classifications from Vietnam's draft Data Security Law as outlined in the Nishimura newsletter.

Ah! The search budget is spent. We have got an enormous amount of highly specific, high-quality, up-to-date evidence on Vietnam's draft Data Security Law (DSL), the draft Data Security Decree, and the draft amended Penal Code (Articles 159a, 159b, and 159c) from July, August, and September 2026. This is incredibly valuable for a compliance team managing APAC operations! Let's review the details we have: 1. **Vietnam's Proposed Penal Code Amendments (Articles 159a, 159b, 159c)**: - **Context**: On July 7, 2026, the Nghe An Province Public Security Department busted a group of suspects trading personal information (over 72.4GB containing 50 million pieces of personal information). Dong Nai Province also dismantled a cyber ring. Following these, the Ministry of Justice published the appraisal dossier for the draft amended Penal Code, primarily drafted by the Ministry of Public Security (MPS). - **Article 159a (The crime of infringing on personal data)**: Criminalizes gathering, processing, exchanging, gifting, publicizing, appropriating, illegally using, or intentionally leaking/losing others' personal data. Penalties: fine of VND 200–500 million ($7,600–$19,000), non-custodial reform for up to 3 years, or prison term of 6 months to 3 years. For organized, professional crimes, abuse of power, illicit profits of VND 400 million ($15,200)+, damages of VND 1 billion ($38,000)+, or massive data subjects, the penalty is up to 7 years in prison. - **Article 159b (The crime of illegally buying and selling personal data)**: Prison sentences of 1 to 10 years depending on volume of data and illicit profits. Maximum penalty (10 years) applies for trading personal data of 25,000+ people or earning illicit profits of VND 1 billion ($38,000)+. - **Article 159c (The crime of obstructing personal data protection activities)**: Covers intentionally concealing/providing false info about data breaches and establishing illegal technical barriers to hinder inspections/evidence collection. - **Status**: Scheduled for a National Assembly vote in the upcoming October 2026 legislative session. - **Slug to update**: `vietnam-data-security-law-draft-limits-2026` (Wait! The title of `vietnam-data-security-law-draft-limits-2026` is "Vietnam's Draft Law on Data Security: MPS Moves Forward with 4-Tier Risk Taxonomy, Global Revenue Fines, and October 2026 Legislative Vote". This covers the Draft Law on Data Security, but we also have `vietnam-pdpl-decree-356-cross-border-transfers-2026` and `vietnam-pdp-law-enactment-2026`. Wait! Let's look at the existing notes and their slugs to see which one is the best fit). Let's check the slugs: - `vietnam-data-security-law-draft-limits-2026`: "Vietnam's Draft Law on Data Security: MPS Moves Forward with 4-Tier Risk Taxonomy, Global Revenue Fines, and October 2026 Legislative Vote" - `vietnam-pdpl-decree-356-cross-border-transfers-2026`: "Vietnam Personal Data Protection: Decree 330/2026/ND-CP Sets Heavy Penalties and Fines Up to 5% of Revenue for Cross-Border Transfer Violations" - `vietnam-pdp-law-enactment-2026`: "Vietnam's Personal Data Protection Law (PDPL) Takes Effect Alongside Implementing Decree 356 and Strict CTIA Dossier Mandates" Let's update `vietnam-data-security-law-draft-limits-2026` with the new details of both the draft Law on Data Security (DSL) and the draft amended Penal Code (since both are scheduled for the October 2026 National Assembly vote and we have amazing new details on both!). Let's look at the details of the draft Law on Data Security (DSL) and its implementing Draft Data Security Decree (which is dated August 6, 2026, and based on the draft version of the DSL dated August 17, 2026): - **Timeline**: The Ministry of Public Security (MPS) published the draft Data Security Law for public consultation on July 17, 2026, with the public comment period concluding in August 2026. On August 20, 2026, the government issued Resolution 246/NQ-CP adopting the policies of the Data Security Law. The law is scheduled for a National Assembly vote in October 2026 and is set to take effect on **December 1, 2027**, after which it will prevail over conflicting data security provisions in existing legislation. - **Extraterritorial Scope**: The draft law applies broadly to: (i) Vietnamese agencies, organizations, and individuals, (ii) foreign agencies, organizations, and individuals existing or operating in Vietnam, and persons of Vietnamese origin of undetermined nationality residing in Vietnam who have been issued an identity certificate, and (iii) foreign agencies, organizations, and individuals directly involved in or related to data security protection activities and data processing activities in Vietnam. - **Risk-Based Data Taxonomy**: The backbone of the draft law is a 4-tier taxonomy that classifies data based on risks (unauthorized access, exploitation, cyberattack, and sensitivity level): - **Level 1**: Data accessible to the public or with unrestricted access, the compromise of which poses only low risk and causes no significant damage. Protection: The data administrator, by itself, determines the classification level and organizes protection measures in accordance with current standards and technical regulations, and bears full responsibility, without having to report to or obtain confirmation from state agencies. - **Level 2**: Data circulating internally within an agency, organization, or enterprise, or constituting a trade secret, a leak of which causes loss to the organization's operations or reputation but does not endanger national security, social order and safety, or the public interest. Protection: same as Level 1 (the data administrator determines classification and organizes protection measures without state reporting). - **Level 3**: Data on the list of important data issued by the Prime Minister in accordance with the Data Law (e.g., non-public basic citizen data of a certain scale). Protection: The data administrator must establish a risk management mechanism, designate personnel responsible for data security, and implement the protective measures as required by law. - **Level 4**: Data on the list of core data issued by the Prime Minister in accordance with the Data Law. Protection: same as Level 3 (establish risk management, designate personnel, and implement required protective measures). Wait! Let's check if there are other details we can include. Let's see: we have two watches: - `Vietnam National Assembly Vote on Draft Penal Code Personal Data Crimes` (fire_date: 2026-10-31) - `Vietnam National Assembly Vote on Draft Law on Data Security` (fire_date: 2026-10-31) Since the vote is scheduled for October 2026, and today is September 14, 2026, these watches have not fired yet. But we have excellent new details on the draft provisions. Let's write a note updating `vietnam-data-security-law-draft-limits-2026` to incorporate these highly specific details. Let's make sure the note has 1-2 representative verbatim quotes with links to the actual sources, name and link the actual sources, and then interpret what it means for compliance teams. Wait, let's look at the existing note `vietnam-data-security-law-draft-limits-2026` to see what is already there. Wait, we don't have the full body of `vietnam-data-security-law-draft-limits-2026` in the kickoff, but we have its preview: "Vietnam’s data governance framework is expanding beyond personal data protection to encompass a comprehensive and systematic data security regime. On **July 17, 2026**, the Ministry of Public..." Let's write a comprehensive update to the note `vietnam-data-security-law-draft-limits-2026`. Wait, the prompt says: "When writing a finding that refines one of the above, reuse its slug to update. Otherwise pick a fresh slug." Let's write the note with the slug `vietnam-data-security-law-draft-limits-2026`. Let's draft the note. Wait, let's make sure there are no other notes we need to write. The brief asks us to: "Track how data residency and cross-border data transfer requirements are evolving across APAC: new laws and amendments by country, enforcement actions, adequacy decisions, guidance from data protection authorities, and how multinational companies are adapting their compliance strategies. Surface what a compliance team managing APAC operations needs to stay current on." Since the search budget is spent, we must focus on writing up the findings we already have evidence for (which is Vietnam's massive new draft Law on Data Security and draft Penal Code amendments, both reaching critical milestones in July, August, and September 2026 ahead of the October 2026 National Assembly vote). Let's organize the note body carefully. No YAML frontmatter. The title is the first `# ` heading and the slug is the slug parameter we pass. It must carry 1-2 representative verbatim quotes, copied exactly, each kept with the link it came from. And say what it means. Let's write the note body for `vietnam-data-security-law-draft-limits-2026`. Wait, the title should be: `# Vietnam's Draft Law on Data Security and Draft Penal Code: 4-Tier Risk Taxonomy, Extraterritorial Scope, and Three New Personal Data Crimes Proposed Ahead of October 2026 Vote` Let's review the sources we have: 1. SGGP English Edition article: "Draft Penal Code targets data trafficking with stricter prison sentences" (July 8, 2026) - URL: `https://en.sggp.org.vn/draft-penal-code-targets-data-trafficking-with-stricter-prison-sentences-post127755.html` 2. Nishimura & Asahi PDF: "Asia & Data Protection Newsletter (September 3, 2026)" - URL: `https://www.nishimura.com/sites/default/files/newsletters/file/asia_data_protection_260903_en.pdf` 3. OneTrust DataGuidance: "Vietnam: MPS publishes draft law on Data Security for public consultation" (August 6, 2026) - URL: `https://www.dataguidance.com/news/vietnam-mps-publishes-draft-law-data-security-public` Let's select two great verbatim quotes: Quote 1 (from SGGP): > "A major breakthrough of the draft is the proposal to append three entirely new offenses regarding personal data: > 1. The crime of infringing on personal data (Article 159a), > 2. The crime of illegally buying and selling personal data (Article 159b), > 3. The crime of obstructing personal data protection activities (Article 159c)." Link: `https://en.sggp.org.vn/draft-penal-code-targets-data-trafficking-with-stricter-prison-sentences-post127755.html` Quote 2 (from Nishimura & Asahi): > "The risk-based data taxonomy is the backbone of the draft Data Security Law, and classifies data by several factors (including but not limited to the risk of unauthorized access to, exploitation of, or use of data, or the risk of a cyberattack, and the sensitivity level of the data), in order to define management levels and apply corresponding protective measures." Link: `https://www.nishimura.com/sites/default/files/newsletters/file/asia_data_protection_260903_en.pdf` Let's check if we can include a third quote from OneTrust DataGuidance: > "On July 17, 2026, the Ministry of Public Security (MPS) published the draft Data Security Law (draft law) for public consultation until August 5, 2026. The draft law establishes a comprehensive legal framework for safeguarding data security, regulating data-related activities, preventing risks to national security, and protecting the lawful rights and interests of organizations and individuals in cyberspace." Link: `https://www.dataguidance.com/news/vietnam-mps-publishes-draft-law-data-security-public` Let's write the note. I will state my intent before writing the note. I will write a comprehensive update to the note `vietnam-data-security-law-draft-limits-2026` detailing Vietnam's proposed 4-tier risk taxonomy, extraterritorial scope, and the three new personal data crimes in the draft amended Penal Code, all of which are heading to a National Assembly vote in October 2026.

I will now call `finish_cycle` to complete this research cycle, as I have updated the note with the latest findings on Vietnam's draft Law on Data Security and draft Penal Code amendments.

I have successfully completed this research cycle for the APAC data residency and cross-border transfer topic. ### Summary of Actions in This Cycle: 1. **Investigated Key Regulatory Watches**: * Reviewed the upcoming October 2026 legislative milestones in Vietnam regarding the draft **Law on Data Security** and the draft **Penal Code amendments** (introducing personal data crimes). 2. **Gathered and Verified Evidence**: * Sourced and analyzed legal and news bulletins from July, August, and September 2026 (including detailed guidance from *Nishimura & Asahi*, *OneTrust DataGuidance*, and *SGGP English Edition*). 3. **Updated Standing Findings**: * Reused the existing slug `vietnam-data-security-law-draft-limits-2026` to write a comprehensive update detailing: * **Draft Law on Data Security (DSL)**: Explored its broad extraterritorial scope, its December 1, 2027 proposed effective date, and the specific **4-tier risk-based data taxonomy** (Levels 1 to 4) that dictates management and protection levels. * **Draft Penal Code Amendments**: Unpacked the three proposed criminal offenses—**Article 159a** (Infringing on personal data, carrying up to 7 years' imprisonment), **Article 159b** (Illegally buying/selling personal data, carrying up to 10 years' imprisonment), and **Article 159c** (Obstructing personal data protection activities). * **Compliance Takeaways**: Interpreted what this means for corporate compliance teams managing APAC risk, emphasizing the shift toward severe individual criminal liability for local executives and technical staff. 4. **Maintained Active Watches**: * Kept the existing watches for Vietnam's October 2026 legislative sessions active, as the current date is September 14, 2026, and the votes have not yet occurred.