Navigating Cross-Border Data Transfers in the APAC Region: An Analysis of Developments from 2023 to 2026

Today, the Future of Privacy Forum (FPF) published an Issue Brief comparatively analyzing developments in cross-border data transfer regulations in the Asia-Pacific (APAC) from 2023 to 2026. Titled Navigating Cross-Border Data Transfers in the APAC Region: An Analysis of Developments from 2023 to 2026, the Issue Brief examines the rapidly evolving landscape of cross-border data transfers in the last few years, and builds upon a 2023 Issue Brief first released by FPF covering developments from 2021 to 2023. The jurisdictions analyzed in this issue brief are Australia, Bangladesh, China, India, Indonesia, Malaysia, Sri Lanka, Thailand, and Vietnam.

Cross-border data transfers are pivotal in enabling the global digital economy and facilitating digital trade. These transfers allow businesses to provide services globally, while allowing individuals access to a wide range of digital services and platforms. Yet, cross-border data transfers also raise legitimate concerns regarding the protection of individuals’ privacy and security.

This tension remains the core challenge for data protection laws in the APAC region. The Report, however, finds that there are shifts in the balance, particularly along the following the trends:

• APAC jurisdictions are increasingly converging around safeguards-based mechanisms, such as Standard Contractual Clauses (SCCs) and Binding Corporate Rules (BCRs);
• The adoption of “whitelisting” mechanisms is expanding in the APAC region, while some APAC jurisdictions have adopted a “blacklisting” approach;
• Despite the liberalisation of requirements in some jurisdictions, new restrictions on CBDTs are emerging in others;
• There is a growing trend towards requiring organisations to conduct Transfer Impact Assessments (TIAs); 
• Regional frameworks and initiatives are gaining traction to reduce fragmentation; and
• Regulators are equipping themselves with stronger enforcement tools, thus raising the possible repercussions for organizations that fail to comply with CBDT requirements.

These trends, along with the emergence of several new data protection laws as well as the amendment of several existing data protection laws across a number of key APAC jurisdictions, marks a more complex and yet, in some ways, converging, compliance picture for organizations in the region. In particular, it illustrates a dual dynamic: convergence towards international safeguards and accountability standards, along with divergence in localisation and sovereignty-driven measures. 

Beyond these, the Issue Brief now provides detailed jurisdictional updates of 14 APAC jurisdictions — a significant increase from the six covered in the first edition of the Issue Brief.

For deeper analysis of these points and of the cross-border data transfer provisions for each of the 14 jurisdictions covered, download the Issue Brief here.

For inquiries about this Issue Brief, please contact Josh Lee Kok Thong, Managing Director (APAC), at [email protected], or Dominic Paulger, Deputy Director (APAC), at [email protected].

Please note that nothing in this Issue Brief should be construed as legal advice.