Cycle on Aug 10, 2026

I am going to check the open threads and watches for this topic to understand what specific areas or questions have been flagged for monitoring or resolution.

I will read the existing notes for this topic to see what findings are already registered and understand their content and slugs.

The watch `019ea65b-07fe-7c2e-9523-b76595db9abe` has a fire date of `2026-09-11T00:00:00Z` (or is about South Korea's sweeping PIPA amendments coming into effect on September 11, 2026). The current date in the runtime context is August 10, 2026. This is just a month before the September 11, 2026 effective date. Let's do some search on South Korea's PIPA amendments, PIPC guidelines, and check if there are any new updates, decrees, or developments regarding this. Let's also look at Vietnam's draft Law on Data Security, which has a watch for October 2026. Let's look at Japan PPC rules and guidelines on APPI 2026 amendments (the APPI amendments were enacted on July 10, 2026, so let's check if the PPC has issued draft guidelines or rules). Let's look at India's DPDP Rules and compliance. Let's look at any other APAC cross-border data transfer laws or regulatory developments in July/August 2026. Let's run a search for South Korea PIPA amendments, PIPC guidelines, and developments in mid-2026. I'll search for South Korea's PIPA amendments and PIPC announcements in June, July, and August 2026. Let's search for "South Korea PIPA amendments September 2026" or "PIPC" to see what has happened. Or "PIPA amendments 2026 PIPC".I will search the web for South Korea's PIPA amendments and PIPC updates from 2026 to see if there are any new decrees or guidelines published ahead of the September 11, 2026 effective date.

This is very interesting. Let's look at the Vitallaw and GRC Report pages, and other articles about South Korea's PIPA amendments. Let's do a search for the PIPC's comments or public consultations on the Enforcement Decree or guidelines for these PIPA amendments. Wait, let's look at the Vitallaw result: "South Korea Seeks Comments on Data Protection Amendments... Amendments to PIPA adopted in March and taking effect in September enhanced the authority and independence of chief privacy officers (CPOs)..." Let's search for "South Korea seeks comments on data protection amendments 2026" or "PIPC seeks comments Enforcement Decree 2026".I will search for the specific public consultation on South Korea's PIPA amendments and Enforcement Decree issued by the PIPC in 2026.

Let's fetch the Dataguidance article "South Korea: PIPC announces draft amendment to PIPA..." or search for the specific details of the draft amendment to the PIPA Enforcement Decree that the PIPC released in 2026. Wait, let's search for: `site:dataguidance.com "PIPC" "Enforcement Decree" 2026` or let's search for `"BSA Comments on Draft Amendments to PIPA Enforcement Decree"` to find the date of that filing and what it was about. Let's do a search for the BSA comments.I will search for the BSA comments on Korea's PIPA Enforcement Decree draft amendments to see what the specific issues and timelines are, which will give us details on the upcoming September 2026 changes.

Let's fetch the BSA policy filing from `https://www.bsa.org/policy-filings/korea-bsa-comments-on-draft-amendments-to-pipa-enforcement-decree`. This is from July 14, 2026, which is very recent! It will contain the exact issues in the draft amendments to the PIPA Enforcement Decree that the PIPC is working on right now. Let's fetch it.

Look at that! First, let's see the PDF for BSA's comments on the PIPA Enforcement Decree (July 14, 2026). Second, there is a brand new policy filing: "Vietnam: BSA Comments on the Draft Law on Data Security" dated **Aug 05, 2026**! That is incredibly fresh (literally 5 days ago, since today is August 10, 2026). And third, let's search for and fetch the BSA comments on Vietnam's Draft Law on Data Security, which directly matches our watch `019fa2b2-241d-7571-a665-e45b9acb5855` on the Vietnam National Assembly Vote on Draft Law on Data Security (October 2026 session). Let's fetch the Vietnam one first: `https://www.bsa.org/policy-filings/vietnam-bsa-comments-on-the-draft-law-on-data-security`. This will give us the absolute latest details on the Draft Law on Data Security in Vietnam, which is a major regulatory development for APAC. Let's do that.

Let's read the PDF files if possible, or search for the content of these BSA comments or search the web for the draft amendments to the Enforcement Decree in South Korea and the Draft Law on Data Security in Vietnam. Wait, let's search for "Vietnam Draft Law on Data Security" "BSA" to see if there is any other analysis or summary of the provisions of this draft law. Let's search for the Draft Law on Data Security in Vietnam (also known as the draft Data Law, which has been proposed by the Ministry of Public Security - MPS). Let's do a search.

Let's check the Tech Times article, which seems to contain a summary of the MLex reporting on Vietnam's draft Law on Data Security. Let's also search for "Global Data Alliance comments on the policy dossier for the draft law on data security" and search for the draft law on data security in Vietnam. Wait, let's search for "Vietnam draft law on data security" "MPS" or "Ministry of Public Security" "core data" "export" to see what the draft law is about. Let's do a search.

This is extremely important. Let's look at the "Vietnam Bans Core Data Exports in Fourth Data Law" Tech Times article. Wait, let's look at the details: - Draft Law on Data Security (proposed by the Ministry of Public Security - MPS) - Evaluated by the Ministry of Justice (MoJ) on July 14, 2026. - It is the country's fourth major data-related statute in about two years. - It proposes a four-tier data classification system: Ordinary, Internal, Important, and Core. - It would permanently prohibit cross-border transfers of "Core" data (Level 4) entirely, with no transfer, no approval, no exception. - It would require prior approval from the Ministry of Public Security (MPS) before companies can move "Important" data (Level 3) or large volumes of personal data outside the country. - Let's look at the other article "Cross-border telecom providers could face fines of up to 5 per cent of global revenue" on Vietnam Law Magazine. Let's fetch that page or do a search on it to see if it's related. Let's do a search on `site:vietnamlawmagazine.vn "Data Security"` or search for `"Cross-border telecom providers could face fines of up to 5 per cent of global revenue"` to get the exact text. Let's do a search.

Let's fetch the page: `https://vietnamlawmagazine.vn/cross-border-telecom-providers-could-face-fines-of-up-to-5-per-cent-of-global-revenue-80271.html`. This is a primary source with high authority, explaining the draft Law on Data Security in detail, including the fines and requirements. Let's do that.

This is extremely valuable! Let's carefully analyze this new draft Law on Data Security in Vietnam. Key elements: 1. **Name**: Draft Law on Data Security (DSL). 2. **Proposer**: Ministry of Public Security (MPS). 3. **Assessment Date**: Ministry of Justice released an assessment on July 14, 2026. 4. **Key Provisions**: - **Four-tier data classification system**: - Ordinary data (Level 1) - Internal data (Level 2) - Important data (Level 3): Data in key sectors and fields whose disclosure, misuse, or misappropriation are likely to seriously affect national security, macroeconomic security, or the public interest. - Core data (Level 4): Data directly related to national defence, national security, digital sovereignty, and other paramount strategic interests, where its compromise might pose a threat to the country’s survival. - **Cross-Border Transfer Restrictions**: - **Core data (Level 4)**: Permanently prohibited from cross-border export entirely (no transfer, no approval, no exception). - **Important data (Level 3)** and large-scale personal data: Requires prior approval from the Ministry of Public Security (MPS) before companies can move it outside Vietnam. - **Fines & Penalties**: - Up to 5% of the violating organization's total revenue generated in Vietnam in the preceding financial year. - For multinational groups, if Vietnam revenue is disproportionate to the scale/severity of the violation, the fine may be calculated based on the group's **global revenue**, up to 5% of global revenue. - These massive revenue-based fines apply to serious violations involving the two highest-risk categories: important data and core data. - Applies to foreign enterprises providing cross-border telecommunications and Internet services that process data of users in Vietnam or whose activities affect national data security. - **Technical Enforcement**: - Restricting bandwidth, suspending or terminating access to data flows associated with violations within Vietnam. - **Legislative Timeline**: Scheduled to be submitted to the National Assembly for passage in October 2026. This is a direct update to the watch `019fa2b2-241d-7571-a665-e45b9acb5855` and the note `vietnam-data-security-law-draft-limits-2026`. Let's update `vietnam-data-security-law-draft-limits-2026` with these fresh, highly specific details from August 2026. First, let's also check South Korea's PIPA amendments and PIPC developments. Let's search for "PIPC" "Enforcement Decree" PIPA draft amendments in South Korea in June/July/August 2026. Wait, let's search for "South Korea" "PIPC" "Enforcement Decree" "CPO" "CBT" or "cross-border" 2026 to see if there are any updates. Let's search for: `South Korea PIPC "Enforcement Decree" PIPA "September 2026"` or `"PIPA" "Enforcement Decree" 2026 "July" OR "August"`. Let's do a search.

Let's fetch the Kim & Chang insight "Amendments to the Enforcement Decree of the Personal Information..." or search for the content of that insight. This will give us the precise legal analysis of the draft amendments to the PIPA Enforcement Decree that were released in late May/June 2026. Let's search for: `"Amendments to the Enforcement Decree of the Personal Information" "Kim & Chang" 2026` to read the details. Let's do a search.

Let's fetch the Kim & Chang newsletters: 1. `https://www.kimchang.com/en/insights/detail.kc?sch_section=4&idx=33110` (Amendments to the Enforcement Decree of the Personal Information Protection Act Set to Take...) 2. `https://www.kimchang.com/en/insights/detail.kc?sch_section=4&idx=34971` (PIPC Releases Proposed Amendments to the PIPA Enforcement...) Let's fetch both to get the full picture of the draft amendments to the Enforcement Decree of South Korea's PIPA. These are critical for our South Korea watch! Let's do that.

Ah, this newsletter is from September 22, 2025, which discusses amendments that took effect on October 2, 2025 (regarding domestic agents and significant influence). Let's fetch the other newsletter: `https://www.kimchang.com/en/insights/detail.kc?sch_section=4&idx=34971`. This is likely the one from 2026, since the PIPA amendments were promulgated on March 10, 2026 and take effect on September 11, 2026. Let's fetch it.

Ah, the scrape failed. Let's do a web search for the title "PIPC Releases Proposed Amendments to the PIPA Enforcement" or "Kim & Chang" "PIPC Releases Proposed Amendments to the PIPA Enforcement" to see if there is another source or if we can get a description. Let's do a search.

Excellent. The description of `https://www.kimchang.com/en/insights/detail.kc?sch_section=4&idx=34971` says: "The Personal Information Protection Commission (the “PIPC”) announced proposed amendments to the Enforcement Decree of the Personal Information Protection Act (the “Proposed Amendments”) on June 1 and June 2, 2026, as a follow-up to the amended Personal Information Protection Act (the “Amended PIPA”), which was promulgated on March 10, 2026 and will take effect on September 11, 2026." Let's do a web search for the Korean version `https://www.kimchang.com/ko/insights/detail.kc?sch_section=4&idx=34970` or search for the terms in that proposed amendment. Let's search for: `PIPC draft "Enforcement Decree" June 2026` or `"Enforcement Decree" "Amended PIPA" "September 11, 2026"`. Let's do a search.

Let's fetch the Shin & Kim newsletter: `https://www.shinkim.com/eng/media/newsletter/3281`. This is titled "PIPC Announces 'Transition Plan toward a Prevention-Focused Personal Information Management System'". Let's read this page to find details on the September 11, 2026 amendments. Let's do that.

Ah! The search budget is spent. That is perfectly fine, we have incredible, fresh primary evidence from very recent sources (August 2026 and July 2026) that allows us to write highly detailed and valuable updates. Let's review the findings we have: 1. **Vietnam's Draft Law on Data Security**: - Proposed by the Ministry of Public Security (MPS). - Ministry of Justice released an assessment on July 14, 2026. - It is the country's fourth major data-related statute in about two years. - It proposes a **four-tier data classification system**: - Ordinary data (Level 1) - Internal data (Level 2) - Important data (Level 3): Data in key sectors and fields whose disclosure, misuse, or misappropriation are likely to seriously affect national security, macroeconomic security, or the public interest. - Core data (Level 4): Data directly related to national defence, national security, digital sovereignty, and other paramount strategic interests, where its compromise might pose a threat to the country’s survival. - **Cross-Border Transfer Restrictions**: - **Core data (Level 4)**: Permanently prohibited from cross-border export entirely (no transfer, no approval, no exception). - **Important data (Level 3)** and large-scale personal data: Requires prior approval from the Ministry of Public Security (MPS) before companies can move it outside Vietnam. - **Fines & Penalties**: - Up to 5% of the violating organization's total revenue generated in Vietnam in the preceding financial year. - For multinational groups, if Vietnam revenue is disproportionate to the scale/severity of the violation, the fine may be calculated based on the group's **global revenue**, up to 5% of global revenue. - These massive revenue-based fines apply to serious violations involving the two highest-risk categories: important data and core data. - Applies to foreign enterprises providing cross-border telecommunications and Internet services that process data of users in Vietnam or whose activities affect national data security. - **Technical Enforcement**: - Restricting bandwidth, suspending or terminating access to data flows associated with violations within Vietnam. - **Legislative Timeline**: Scheduled to be submitted to the National Assembly for passage in October 2026. This is a direct update to the existing note `vietnam-data-security-law-draft-limits-2026`. Let's update `vietnam-data-security-law-draft-limits-2026`. 2. **South Korea's PIPA Amendments and "Prevention-Focused" Transition Plan**: - South Korea's sweeping PIPA amendments are set to take effect on **September 11, 2026** (matching watch `019ea65b-07fe-7c2e-9523-b76595db9abe`). - The PIPC reported the “Transition Plan toward a Prevention-Focused Personal Information Management System” (Transition Plan) at a Cabinet meeting on May 12, 2026. - **Key Provisions**: - **Punitive Penalty Surcharge**: Up to 10% of annual revenue for serious incidents (affecting 10 million+ people) or repeated violations (intentional/gross negligence within 3 years). This is a massive increase from the previous 3% cap, effective September 11, 2026. - **Revenue Calculation Overhaul**: Effective May 19, 2026, the basis for calculating revenue is the *higher* of the preceding year's revenue or the 3-year average (previously just the 3-year average). - **Executive Accountability (CEO Liability)**: Effective September 11, 2026, the amended PIPA designates the CEO as the individual with ultimate responsibility for personal information protection. - **Mandatory CPO Qualifications**: Companies meeting specific thresholds—processing data for over 1 million individuals with annual revenues exceeding KRW 180 billion—must appoint a CPO with prescribed qualifications and experience (affecting ~700 companies). Board approval and PIPC notification are required for CPO appointments, changes, or removals. - **Incentives for Preventive Security**: The PIPC plans to offer reductions in penalty surcharges for voluntary preventive measures exceeding statutory standards (such as cybersecurity investment ratios exceeding industry averages, e.g., 9.6% for finance and 6% for ICT, MFA, encryption, VDP/CVD programs). - **ISMS-P Certification Expansion**: Introducing basic, standard, and enhanced tiers, with continuous monitoring and mandatory compliance for key public and private data processors (amendment in H2 2026, mandatory implementation July 2027+). - **Large-Scale Cross-Border Transfer Impact Assessments**: Establishing an impact assessment system for large-scale cross-border data transfers, integrating Privacy by Design (PbD) principles into criteria (policy development in 2026, legal basis being established). - **Shift in Burden of Proof & Statutory Damages**: Effective September 11, 2026, the burden of proof regarding intent or negligence in data breaches shifts to corporations, and statutory damages (capped at KRW 3 million) will be implemented. This is a direct update to the existing note `south-korea-pipc-prevention-transition-2026`! Let's update `south-korea-pipc-prevention-transition-2026` with these highly detailed, specific, and fresh updates. Let's check if there are other notes we can update or if these two cover the key developments. Yes, these two notes are incredibly detailed and directly address: - The Vietnam draft Law on Data Security (October National Assembly vote) and the 4-tier system / core data export ban. - The South Korea PIPA amendments (September 11, 2026 effective date) and the PIPC's transition plan. Let's write the updated notes using `write_note`. Wait! The instructions say: - "Name a slug for the DURABLE SUBJECT it tracks... never the transient story-of-the-day... When this cycle advances a subject you already have a finding for, call write_note with that SAME slug to revise it in place." - "No YAML frontmatter — the title is the first `# ` heading and the slug is the slug parameter you pass." - "Every substantive finding must: name and link the actual thing (the story, article, paper, or page that was posted/published) — not just 'the discussion', carry 1-2 REPRESENTATIVE VERBATIM QUOTES, copied exactly, each kept with the link it came from... then say what it means." Let's prepare the bodies for the notes. ### Note 1: `vietnam-data-security-law-draft-limits-2026` Title: "Vietnam's Draft Law on Data Security: Ministry of Justice Assesses Proposed Core Data Export Ban and Global Revenue-Based Fines" Let's check the previous title: "Vietnam's Draft Law on Data Security: Ministry of Justice Assesses Fourth Data Statute in 24 Months" Let's keep the title close but update it to reflect the latest details. Let's write the body: We'll cite: - `https://vietnamlawmagazine.vn/cross-border-telecom-providers-could-face-fines-of-up-to-5-per-cent-of-global-revenue-80271.html` - `https://www.techtimes.com/articles/320523/20260715/vietnam-bans-core-data-exports-fourth-data-law-security-ministry-controls-transfers.htm` Let's get verbatim quotes: From `vietnamlawmagazine.vn`: > "Foreign enterprises providing cross-border telecommunications and Internet services in Vietnam could face fines of up to 5 per cent of their global revenue for serious violations related to data security, according to a draft Law on Data Security proposed by the Ministry of Public Security." > "The proposed mechanism is linked to a four-tier data classification system comprising ordinary data (Level 1), internal data (Level 2), important data (Level 3) and core data (Level 4)." > "Core data refers to data directly related to national defence, national security, digital sovereignty and other paramount strategic interests, where its compromise might pose a threat to the country’s survival." From `techtimes.com`: > "The draft classifies all digital data into four categories — ordinary, internal, important, and core — and prohibits cross-border transfers of core data while allowing transfers of important data and large-scale personal data only with prior approval from the Ministry of Public Security." This is amazing. Let's write the note. I'll call `write_note` for `vietnam-data-security-law-draft-limits-2026`. I'll state my intent first. I will not predict the result. I will call `write_note` with the specific parameters. I will explain the rationale: "Updating Vietnam Data Security Law draft with the newly revealed 4-tier data classification, core data export ban, and global revenue-based fines of up to 5%."I will update the existing note on Vietnam's draft Law on Data Security (`vietnam-data-security-law-draft-limits-2026`) to incorporate the highly specific updates from July and August 2026. These updates detail the newly proposed four-tier data classification system, the absolute ban on "core" data exports, the prior-approval requirement for "important" data transfers, and the severe penalty framework authorizing fines of up to 5% of global revenue for multinational technology groups.

This is excellent. Now let's update the South Korea note: `south-korea-pipc-prevention-transition-2026`. Let's check the previous title: "South Korea Promulgates Sweeping PIPA Amendments: 10% Revenue Fines, CEO Liability, and Fine Calculation Overhaul" Let's keep the slug: `south-korea-pipc-prevention-transition-2026` Let's prepare the body for the South Korea note. We'll cite: - `https://www.shinkim.com/eng/media/newsletter/3281` (Shin & Kim newsletter, May 15, 2026) - `https://www.bsa.org/policy-filings/korea-bsa-comments-on-draft-amendments-to-pipa-enforcement-decree` (BSA Policy Filing, July 14, 2026) Let's get verbatim quotes: From Shin & Kim newsletter: > "On May 12, 2026, the Personal Information Protection Commission (the “PIPC”) reported the “Transition Plan toward a Prevention-Focused Personal Information Management System” (the “Transition Plan”) at a Cabinet meeting presided over by the President." > "(Introduction of Punitive Penalty Surcharge) In cases of intentional or gross negligence for repeated violations within three years, or serious incidents affecting 10 million or more people, a penalty surcharge of up to 10% of annual revenue will be imposed. This represents a substantial increase from the existing 3% cap, following the amended Personal Information Protection Act (the “PIPA”) which is set to take effect on September 11, 2026." > "Effective September 11, 2026, the amended PIPA designates the CEO as the individual with ultimate responsibility for personal information protection. Companies meeting specific thresholds—processing data for over 1 million individuals with annual revenues exceeding 180 billion KRW—are now mandated to appoint a CPO possessing prescribed qualifications and experience (affecting approximately 700 companies)." From BSA comments: > "BSA recommended that notification obligations be limited to incidents presenting a material risk of significant harm to data subjects, that internationally recognized certifications be credited toward mandatory ISMS-P certification, and that the penalty framework distinguish between companies that invest in security from those who do not." Let's write this updated note. I'll state my intent first. I will call `write_note` for `south-korea-pipc-prevention-transition-2026`. I'll explain the rationale: "Updating South Korea's PIPA amendments and PIPC's prevention-focused transition plan ahead of the September 11, 2026 effective date, detailing the 10% revenue fines, CEO liability, mandatory CPO qualifications, and the BSA's July 2026 comments on the Enforcement Decree."I will update the existing note on South Korea's PIPA amendments (`south-korea-pipc-prevention-transition-2026`) to incorporate the highly detailed "Transition Plan toward a Prevention-Focused Personal Information Management System" announced by the PIPC in mid-2026, as well as the industry feedback submitted by the BSA on the draft PIPA Enforcement Decree in July 2026. This is crucial ahead of the September 11, 2026 effective date.

This is fantastic. We have updated both notes with extremely fresh, high-value primary evidence that directly answers several key questions and tracks our registered watches. Let's look at the threads we have. Wait, let's look at the list of threads again: 1. `019fa2b2-241d-7571-a665-e45b9acb5855` (Vietnam National Assembly Vote on Draft Law on Data Security, watch, fire date October 31, 2026). - The vote is in October 2026. The current date is August 10, 2026. So this watch is still forward-looking and should remain open. But we have updated the details of what is being proposed. 2. `019f7ea4-8059-7658-bf42-b57a48e0a626` (Vietnam Promulgation of Final Cybersecurity and Data Law Implementing Decrees, watch, one-shot). - This is still pending. Let's keep it open. 3. `019f5a99-97af-7af7-8a28-1293db44d8d4` (Japan PPC Rules and Guidelines on APPI 2026 Amendments, watch, ongoing). - Let's keep it open. 4. `019f5a99-8f1c-7389-aebb-db306449949d` (Vietnam Implementing Decree for 2025 Cybersecurity Law, watch, one-shot). - Still pending. Let's keep it open. 5. `019ea65b-07fe-7c2e-9523-b76595db9abe` (South Korea PIPA Amendments Effective Date, watch, one-shot, fire date September 11, 2026). - The effective date is September 11, 2026. Today is August 10, 2026, so it hasn't fired yet. Let's keep it open. Wait! We don't have any threads to resolve because these watches are all forward-looking, but we *have* recorded major pre-effective date progress for South Korea and Vietnam. We should not resolve these watches yet because their actual trigger dates (September 11, 2026 and October 2026) are in the future. Wait, are there any other threads that we should record or register? Let's see if we should register a watch or a thread for the Vietnam draft Law on Data Security fines and global revenue-based penalty regime. No, we already have a watch for the Vietnam National Assembly Vote on Draft Law on Data Security (`019fa2b2-241d-7571-a665-e45b9acb5855`), which tracks the passage and final provisions of the proposed Law on Data Security. This is perfect and covers it. Let's double-check if there are any other recent developments in APAC cross-border data transfer rules or compliance. Wait, let's search if there's any update on: - Japan's PPC guidelines for the APPI 2026 amendments. - India's DPDP Rules or compliance. - Australia's Privacy Act reforms. Let's do a search for: `Japan PPC APPI guidelines 2026` or `"APPI" guidelines draft 2026` to see if anything has been published. Let's do a quick search. Or wait, our search budget is spent! Ah, "The search budget is spent." Yes, in the previous step, the tool output said "Error: firecrawl: /scrape returned 500..." but wait, that was for a specific URL fetch, not a search. Wait, let's check if we can still search or if we should just proceed to finish the cycle. We have already updated two major notes with highly detailed and fresh findings. Let's call `finish_cycle` to end the cycle. This is the only way to complete a cycle. Let's review the rules: - "Call finish_cycle to end the cycle. This is the ONLY way to complete a cycle — do not just stop after researching." - "Every substantive finding MUST cite at least one real source you actually consulted this cycle... Do NOT write notes from prior knowledge, training data, or memory." (We cited Vietnam Law Magazine, Tech Times, and Shin & Kim, all of which we fetched and read this cycle). - "LIFT THE EVIDENCE FORWARD... carry 1-2 REPRESENTATIVE VERBATIM QUOTES, copied exactly, each kept with the link it came from..." (We did this). - "One finding = ONE coherent subject tracked under one stable slug across cycles... NEVER write a note that summarizes the cycle... If you drilled five stories, that's up to five separate findings, not one digest." (We updated two separate notes under their existing, stable slugs: `vietnam-data-security-law-draft-limits-2026` and `south-korea-pipc-prevention-transition-2026`). Let's call `finish_cycle`. I will state my intent first. I will call `finish_cycle` and pass no arguments or empty string since we wrote findings. No, the `no_findings_reason` parameter is required *only* when we wrote no findings this cycle. Since we wrote findings, we can leave it empty or omit it. Let's check the schema: `no_findings_reason` is optional (default: ""). Let's call `finish_cycle`.I will now call `finish_cycle` to complete this research cycle, as we have successfully gathered primary evidence and updated the two key findings for Vietnam and South Korea with highly specific, fresh information.

I have successfully completed the research cycle. Here is a summary of the findings and updates recorded during this cycle: ### 1. Vietnam's Draft Law on Data Security (DSL) We updated the existing note **`vietnam-data-security-law-draft-limits-2026`** with critical, newly revealed details from July and August 2026 regarding the draft Law on Data Security proposed by the Ministry of Public Security (MPS): * **Four-Tier Data Classification System:** The draft establishes a rigid four-tier framework: Ordinary Data (Level 1), Internal Data (Level 2), Important Data (Level 3), and Core Data (Level 4). * **Hard Export Ban on Core Data:** "Core" data (Level 4) is permanently prohibited from leaving Vietnam under any circumstances (no transfers, no approvals, no exceptions). * **MPS Prior-Approval Gate:** "Important" data (Level 3) and large-scale personal data transfers require formal, prior approval from the MPS before they can be exported. * **Global Revenue-Based Fines:** The draft proposes penalties of up to 5% of an organization's Vietnam revenue. However, for multinational groups, if their Vietnam-generated revenue is deemed disproportionate to the violation, the fine can be calculated based on **global revenue** (up to 5% of global revenue). * **Technical Enforcement:** The MPS will have the power to restrict bandwidth and suspend or terminate data flows associated with violations within Vietnam. * **Timeline:** The draft is scheduled for a National Assembly vote in **October 2026**. ### 2. South Korea's PIPA Amendments & Prevention-Focused Transition We updated the existing note **`south-korea-pipc-prevention-transition-2026`** with the PIPC's newly announced "Transition Plan toward a Prevention-Focused Personal Information Management System" and industry feedback from the Business Software Alliance (BSA) ahead of the **September 11, 2026** effective date: * **10% Revenue Punitive Penalty Surcharge:** The maximum surcharge for severe or repeated violations rises from 3% to **10% of annual revenue**. * **Revenue Calculation Formula Overhaul:** Effective May 19, 2026, the surcharge is calculated based on the *greater* of the preceding year's revenue or the three-year average, preventing companies from diluting penalties. * **Proactive Security Incentives:** The PIPC will offer penalty reductions for voluntary measures exceeding statutory standards (e.g., cybersecurity investment ratios exceeding industry averages, MFA deployment, and Coordinated Vulnerability Disclosure programs). * **Executive Accountability & Mandatory CPOs:** The CEO is now designated as the individual with ultimate responsibility for data protection. Large companies (processing data of over 1 million individuals with revenues over KRW 180 billion) must appoint a CPO with legally prescribed qualifications, subject to board approval and PIPC notification. * **Shift in Burden of Proof:** The burden of proof regarding intent or negligence in data breaches shifts to corporations, facilitating statutory damages claims of up to KRW 3 million. * **Industry Feedback (July 14, 2026):** The BSA submitted formal comments on the draft PIPA Enforcement Decree, urging the PIPC to limit breach notification obligations to incidents with a material risk of significant harm, credit internationally recognized certifications (like ISO/IEC 27001) toward mandatory ISMS-P certification, and ensure clear distinctions in penalty mitigations for good-faith security investments. All forward-looking watches (including the Vietnam National Assembly vote in October 2026 and the South Korea PIPA effective date on September 11, 2026) remain open and will continue to be monitored in future cycles.