Cycle on Sep 28, 2026

I'll start this research cycle by checking the open threads and existing notes for this topic.

I have a clear picture: 7 open watch threads and ~30 existing notes, with the last cycle updating notes on 2026-09-21. Today is 2026-09-28, so this cycle should focus on the past week's developments and check whether any watches have fired. Let me search for the freshest news across the key jurisdictions.

Good leads. Vietnam's NA Standing Committee reviewed the draft Data Security Law on September 23 — progress on an open watch. China's CAC released 10 typical enforcement cases, and there's a DeepSeek/Moonshot probe. Let me dig into these and check other jurisdictions.

Vietnam's NA Standing Committee reviewed the draft Data Security Law on Sept 23 — key details captured (4-tier risk, 5% revenue cap, PQC deadline). Now let me check the China enforcement cases, the DeepSeek/Moonshot probe, and other jurisdictions.

The DeepSeek/Moonshot CAC probe (reported Sept 22) is a major cross-border data enforcement story. Let me verify the CAC enforcement cases, the Korea Meta fine report, Japan PPC progress, and the Indonesia GR 33/2026 analysis.

The search budget is spent, but I have strong leads. Let me fetch the actual sources to verify before writing: the ForkLog piece on the CAC probe, the Data Compliance China briefing on the Sept 15 typical cases, and the Korea PIPC enforcement trends piece.

I now have verified evidence for four updates and one new finding. Let me also ground the Australia next-steps before writing notes.

I'll now write the findings. First batch: the new China AI cross-border enforcement note, the update to the China enforcement campaign note, and the Vietnam update.

First batch written. Now the second batch: Indonesia, South Korea, and Australia updates.

All six notes are written. Now I'll register the forward-looking watches this cycle surfaced and the one verification thread, then close the cycle.

All findings are persisted, three new watches registered, and one verification thread opened. No existing watch fired this cycle (Vietnam's vote, India's Consent Manager window, Indonesia's take-effect date, and China's large-processor finalization all remain ahead). Closing the cycle.

Cycle complete. Here's what this research cycle surfaced for APAC data residency and cross-border transfer tracking: ## New finding - **China treats AI query routing as a cross-border data transfer problem** — The Information reported (Sept 22) that the CAC is probing DeepSeek and Moonshot AI over alleged covert routing of Chinese user queries — including police, military and state-enterprise data — to Anthropic's Claude (23M+ and 12M+ queries respectively). Beijing's enforcement theory is a potential **cross-border data transfer violation**, not just model distillation. Sanctions undecided; HK-listed AI stocks fell Sept 23. ## Updates to standing findings - **China enforcement campaign** — The April CAC+MIIT+MPS campaign produced its first published "typical cases" (Sept 15): a Shanghai company fined for exporting PI via a Windows desktop client with **no data-export security assessment**, a first penalty on PIPL Art. 26 facial recognition, and a warning for an LLM "API relay station." CVERC named 82 apps (Sept 23); 28 of August's batch failed retest and were pulled from stores. - **Vietnam** — NA Standing Committee reviewed the draft Data Security Law Sept 23: 4-tier taxonomy confirmed (levels 1–2 self-assessed), 5% of Vietnam-or-global-revenue fine cap, a Jan 1, 2035 post-quantum cryptography deadline for level-4 state data, and the Chairman's "strategic tool rather than a barrier" caution. Vote expected at the October session (watch standing). - **Indonesia** — Norton Rose Fulbright's GR 33/2026 checklist: 72-hour breach notice from when failure is "definitively established," GDPR-era transfer agreements can't be assumed sufficient, DPIAs before AI/biometric processing, 2%-of-revenue fines, and possible DPA consultation before transfers — all ahead of the Jan 16, 2027 take-effect. - **South Korea** — The 10% turnover ceiling and CEO liability are live (Sept 11). The pending Coupang decision (33.7M-user breach, potential KRW 1 trillion) would be the first test of the new ceiling. - **Australia** — Tranche 2 consultation closed Sept 18; bill expected late 2026/early 2027 with 6–12 month grace periods. Notably, the **overseas transfer reforms (prescribed countries/contract clauses) are deferred** out of this bill. ## New watches 1. CAC's outcome on the DeepSeek/Moonshot probe 2. PIPC's Coupang penalty decision (first test of the 10% ceiling) 3. Australian Privacy Amendment Bill introduction/passage Plus one verification thread: a claim the PIPC fined Meta ~US$49M that doesn't match known enforcement history — to be confirmed next cycle.