APAC Data Residency Digest — November 2026
TL;DR
The two open questions from last cycle both landed, and both answers matter. Korea's record Coupang fine turned out to be decided under the old penalty regime — the 10% ceiling's first real test is still ahead — while the circulating "~$49M new Meta fine" was confirmed to be a misreading of six years of cumulative fines. Meanwhile, Japan's PPC published the most detailed blueprint yet for consent-free AI training data flows, and Australia's ADM transparency deadline is now 60 days out.
Korea: the record fine is real, but the ceiling test hasn't happened yet
The Coupang penalty everyone was watching as the first test of Korea's new 10%-of-revenue ceiling was actually decided under the old rules — which changes what it tells you about provisioning. The ₩624.7B (~US$409M) decision of June 10–11, 2026 landed at roughly 1.4% of Coupang's 2025 revenue, well below what the new ceiling would permit, and the amended PIPA's 10% cap only took effect September 11, 2026 south-korea-pipc-prevention-transition-2026
+2.
The composition of the fine is the instructive part. It splits into ~₩423.6B for the breach affecting 33,222,472 registered members and ₩201.1B ($132M) for a separate violation — the Coupang Partners affiliate program covertly collecting third-party browsing activity from ~11.2 million users and linking it to member accounts south-korea-pipc-prevention-transition-2026+2. And the criminal referral didn't come from the breach itself:
"Regulators had ordered the preservation of access logs on November 21 — the day after Coupang filed its initial breach report, but six days later, the company manually deleted approximately six months of web access logs."
— The Record
That's the operational takeaway: evidence preservation during an investigation is now existentially important, and the PIPC also treated Coupang's exclusion of its chief privacy officer from its internal investigation as a substantive violation of CPO independence. Separately, the PIPC announced an overhaul of its own machinery on October 2 — tiered investigation deadlines (12 months for major cases, 6 for standard, 3 for minor) and a commitment to publish its administrative fine calculation standards, which should make future outcomes more provisionable south-korea-pipc-prevention-transition-2026+2.
What to watch: The first large-breach penalty actually decided under the 10% ceiling — any big tech, telecom, or finance case now in the PIPC's pipeline will set the benchmark.
Japan: the AI-training data exception gets its rulebook — with a public paper trail
Japan's implementation of the July 2026 APPI amendments is moving fast, and the PPC's October 1 draft paper is the blueprint multinationals should read now. The statistics-creation exception lets a business acquire publicly available sensitive information without consent — web scraping is explicitly named as a source — and provide personal data to third parties without consent where the purpose is statistics creation, a definition that reaches AI development japan-appi-2026-amendments-diet-enactment
.
The price of that consent-free lane is radical transparency. Both parties to a transfer must publish the deal details on a single web page that cannot block crawlers:
"making mechanical search possible"
— PPC Land, quoting government witness Kiyoshi Sawaki on the publication design
Two other pieces matter for compliance design. Contractors get a new statutory scope duty plus an exemption from Chapter 4 obligations where the contract fixes the handling method — and contracts must now specify the countries or regions where handling occurs, which plugs directly into cross-border transfer documentation and Japan's EU adequacy posture. On breach reporting, unlawful third-party transfers become reportable regardless of data type or headcount, dropping the 1,000-person threshold that applies to ordinary leaks — so an illegal transfer, however small, is now a reportable event japan-appi-2026-amendments-diet-enactment.
What to watch: Subsequent PPC commission meetings covering the remaining amended-law topics (improper use, children under 16, facial feature data) — this is a draft with no effective dates yet, but the 2027 obligations are taking shape in it.
Australia: a hard deadline arrives while the transfer reform stays parked
Australia is running on two clocks, and only one of them is ticking toward a date you can plan against. The OAIC published its final automated decision-making transparency guidance on September 30, and from December 10, 2026, APP entities must disclose in their privacy policies any computer program that makes or substantially informs decisions significantly affecting individuals' rights or interests — with the OAIC explicitly flagging banks, insurers, digital platforms, employers, and Commonwealth agencies as the exposed populations australia-privacy-reform-data-residency-2026
.
The Tranche 2 bill, meanwhile, still hasn't been introduced to Parliament as of October 5, despite the exposure-draft consultation closing September 18. The prescribed-country list and contractual clauses for overseas transfers remain deferred, which means:
"cross-border transfer mechanics under the new law are not yet settled — do not lock long-term transfer templates to the draft text"
— Obsidian Regulatory Intelligence
The practical read: the existing APP 8 accountability regime continues for cross-border transfers, so don't restructure transfer agreements in anticipation of rules that may change before passage. Do, however, run the ADM mapping exercise now — the disclosure architecture is the same one compliance teams are building for EU AI Act transparency and Korea/Japan AI rules, so one mapping can feed all three australia-privacy-reform-data-residency-2026.
What to watch: The December 10 privacy-policy deadline — a policy that omits the APP 1.8 disclosures on commencement is non-compliant, full stop.
What surprised us
- The Coupang fine was a grandfathered decision. Last cycle framed it as the first test of the 10% ceiling; it was actually decided June 10–11 under the old regime, at ~1.4% of revenue. The ceiling remains untested, which means the worst-case provisioning math for any future Korean breach just got wider, not narrower south-korea-pipc-prevention-transition-2026+2.
- The Meta fine rumor resolved as a misreading of history. The ~US$49M figure matches Meta's cumulative six-year total — five fines from 2020–2024 totaling ₩72.962B — and the ~$668K Instagram figure matches the July 2023 Instagram fine. No new Meta action exists; nothing has been imposed since November 2024 south-korea-pipc-prevention-transition-2026+2.
- Japan is making data-sharing deals publicly machine-readable. The crawlable, no-robots.txt publication requirement will turn Japanese data-sharing partnerships into something anyone — regulators, journalists, competitors — can search. That's a reputational exposure layer on top of the compliance one.
- Korea's PIPC is optimizing for predictability, not just severity. Published fine-calculation standards and tiered deadlines cut both ways: faster enforcement, but outcomes you can actually model.
Open threads worth a vote
- [watch] First PIPA penalty decision applying the 10% turnover ceiling — still the open question after the Coupang decision was grandfathered under the old regime.
APAC Data Residency Digest — November 2026
Since last time
- Promoted — Japan is an entirely new topic this cycle: the PPC's October 1 draft paper on consent-free AI training data flows gets a full section. It wasn't mentioned at all in October.
- Escalated — Korea: the Coupang decision landed, and the answer reframes last cycle's framing — it was decided under the old penalty regime, so the 10% ceiling remains untested. New detail on fine composition, the criminal referral, and a PIPC process overhaul. Australia: a hard date arrived — the December 10, 2026 ADM transparency deadline — while the transfer reform story barely moved.
- Demoted — Australia's Tranche 2 transfer reform deferral: last cycle this was the whole Australia section; now it's a compressed paragraph inside a section dominated by the ADM deadline. Still present, still deferred.
- Disappeared — Four October sections are entirely absent from this briefing: China (the DeepSeek/Moonshot probe, the PIPL enforcement campaign, app-store takedowns), Vietnam (the data security law, including the post-quantum cryptography mandate), Indonesia (GR 33/2026 pre-effect checklist and the still-nonexistent DPA), and Korea's algorithmic disgorgement remedy (the Alipay model-deletion order). None are referenced even in passing — if you're tracking those, this cycle gives you no updates. The October open thread on the CAC's DeepSeek/Moonshot decision also dropped out without resolution.
- Unchanged — Nothing. Every section moved.
Korea: the record fine is real, but the ceiling test hasn't happened yet — [Escalated]
Last cycle queued Coupang as the first test of the new 10%-of-revenue ceiling. It wasn't. The ₩624.7B (~US$409M) decision of June 10–11, 2026 landed under the old rules — the amended PIPA's 10% cap only took effect September 11, 2026 — and at roughly 1.4% of Coupang's 2025 revenue, it never approached even the new ceiling south-korea-pipc-prevention-transition-2026+2.
What's new and instructive is the fine's composition and the conduct that triggered the criminal referral. It splits into ~₩423.6B for the breach affecting 33,222,472 registered members and ₩201.1B ($132M) for a separate violation — the Coupang Partners affiliate program covertly collecting third-party browsing activity from ~11.2 million users and linking it to member accounts south-korea-pipc-prevention-transition-2026+2. And the referral came not from the breach but from evidence destruction:
"Regulators had ordered the preservation of access logs on November 21 — the day after Coupang filed its initial breach report, but six days later, the company manually deleted approximately six months of web access logs."
— The Record
The PIPC also treated Coupang's exclusion of its chief privacy officer from its internal investigation as a substantive violation of CPO independence. Separately, the PIPC announced an overhaul of its own machinery on October 2 — tiered investigation deadlines (12 months for major cases, 6 for standard, 3 for minor) and a commitment to publish its administrative fine calculation standards, which should make future outcomes more provisionable south-korea-pipc-prevention-transition-2026+2.
What to watch: The first large-breach penalty actually decided under the 10% ceiling — any big tech, telecom, or finance case now in the PIPC's pipeline will set the benchmark.
Japan: the AI-training data exception gets its rulebook — with a public paper trail — [Promoted — new topic]
Japan's implementation of the July 2026 APPI amendments is moving fast, and the PPC's October 1 draft paper is the blueprint multinationals should read now. The statistics-creation exception lets a business acquire publicly available sensitive information without consent — web scraping is explicitly named as a source — and provide personal data to third parties without consent where the purpose is statistics creation, a definition that reaches AI development japan-appi-2026-amendments-diet-enactment.
The price of that consent-free lane is radical transparency. Both parties to a transfer must publish the deal details on a single web page that cannot block crawlers:
"making mechanical search possible"
— PPC Land, quoting government witness Kiyoshi Sawaki on the publication design
Two other pieces matter for compliance design. Contractors get a new statutory scope duty plus an exemption from Chapter 4 obligations where the contract fixes the handling method — and contracts must now specify the countries or regions where handling occurs, which plugs directly into cross-border transfer documentation and Japan's EU adequacy posture. On breach reporting, unlawful third-party transfers become reportable regardless of data type or headcount, dropping the 1,000-person threshold that applies to ordinary leaks — so an illegal transfer, however small, is now a reportable event japan-appi-2026-amendments-diet-enactment.
What to watch: Subsequent PPC commission meetings covering the remaining amended-law topics (improper use, children under 16, facial feature data) — this is a draft with no effective dates yet, but the 2027 obligations are taking shape in it.
Australia: a hard deadline arrives while the transfer reform stays parked — [Escalated, with a Demoted thread]
The new development is a date you can plan against: the OAIC published its final automated decision-making transparency guidance on September 30, and from December 10, 2026, APP entities must disclose in their privacy policies any computer program that makes or substantially informs decisions significantly affecting individuals' rights or interests — with the OAIC explicitly flagging banks, insurers, digital platforms, employers, and Commonwealth agencies as the exposed populations australia-privacy-reform-data-residency-2026.
The transfer reform story is where you were last cycle: the Tranche 2 bill still hadn't been introduced to Parliament as of October 5, despite the exposure-draft consultation closing September 18, and the prescribed-country list and contractual clauses for overseas transfers remain deferred, which means:
"cross-border transfer mechanics under the new law are not yet settled — do not lock long-term transfer templates to the draft text"
— Obsidian Regulatory Intelligence
The practical read: the existing APP 8 accountability regime continues for cross-border transfers, so don't restructure transfer agreements in anticipation of rules that may change before passage. Do, however, run the ADM mapping exercise now — the disclosure architecture is the same one compliance teams are building for EU AI Act transparency and Korea/Japan AI rules, so one mapping can feed all three australia-privacy-reform-data-residency-2026.
What to watch: The December 10 privacy-policy deadline — a policy that omits the APP 1.8 disclosures on commencement is non-compliant, full stop.
What surprised us
- [UPDATED] The Coupang fine was a grandfathered decision. Last cycle framed it as the first test of the 10% ceiling; it was actually decided June 10–11 under the old regime, at ~1.4% of revenue. The ceiling remains untested, which means the worst-case provisioning math for any future Korean breach just got wider, not narrower south-korea-pipc-prevention-transition-2026+2.
- [UPDATED] The Meta fine rumor resolved as a misreading of history. The ~US$49M figure matches Meta's cumulative six-year total — five fines from 2020–2024 totaling ₩72.962B — and the ~$668K Instagram figure matches the July 2023 Instagram fine. No new Meta action exists; nothing has been imposed since November 2024 south-korea-pipc-prevention-transition-2026+2.
- [NEW] Japan is making data-sharing deals publicly machine-readable. The crawlable, no-robots.txt publication requirement will turn Japanese data-sharing partnerships into something anyone — regulators, journalists, competitors — can search. That's a reputational exposure layer on top of the compliance one.
- [NEW] Korea's PIPC is optimizing for predictability, not just severity. Published fine-calculation standards and tiered deadlines cut both ways: faster enforcement, but outcomes you can actually model.
Open threads
- Closed — Coupang / 10% ceiling test: resolved this cycle, but not the way October expected — the decision was grandfathered under the old regime. The thread survives in mutated form as the new watch item below.
- Closed — Meta fine verification: confirmed a misreading of cumulative 2020–2024 fines; no new action exists.
- Dropped without resolution — CAC DeepSeek/Moonshot decision: this October watch item is absent from the November briefing entirely. If you were tracking the AI-export compliance perimeter question, there's no update here.
- [watch] First PIPA penalty decision applying the 10% turnover ceiling — still the open question after the Coupang decision was grandfathered under the old regime.