Asia-Pacific data protection and AI laws

China, India, Japan, Korea, Australia, Singapore, Vietnam, Indonesia and more.

FewerMore laws

12 countries and blocs with tracked laws (US states on the US map). Tap one to open it.

Regulations

Add to calendar

Apple Calendar or Outlook Google Calendar Download .ics

India DPDP ActIndia's first comprehensive data protection law: consent-based processing with notice, data principal rights, security safeguards, breach notification to the Data Protection Board and affected individuals, verifiable parental consent for children under 18, and extra duties for Significant Data Fiduciaries. The Rules notified in November 2025 phase it in: Board and procedure now, consent managers at 12 months, and main fiduciary obligations at 18 months.Next: Nov 13 Consent Manager registration rule in force (12 months) · in 17 days

AmendedAustralia

Australia Privacy ActAustralia's federal privacy law (13 Australian Privacy Principles, Notifiable Data Breaches scheme). The 2024 amendment adds a statutory tort for serious invasions of privacy, tiered civil penalties and infringement notices, a mandate for a Children's Online Privacy Code, clearer security duties, and privacy-policy transparency for substantially automated decisions from 10 December 2026. It also adds criminal doxxing offences.Next: Dec 10 Children's Online Privacy Code must be registered · in 44 days

In forceMalaysia

Malaysia Online Safety ActPuts duties on licensed application service providers and content application service providers to reduce users' exposure to harmful content. They must issue user guidelines, give users safety tools and reporting channels, protect child users, make priority harmful content (such as child sexual abuse material) inaccessible, and prepare an Online Safety Plan. An Online Safety Appeal Tribunal hears appeals.Next: Dec 28 Online Safety Plan due to MCMC · in 2 months

AmendedIndonesia

Indonesia PDP LawIndonesia's GDPR-style data protection law: lawful bases, data subject rights, DPIAs for high-risk processing, DPOs, breach notification within 3x24 hours, and cross-border transfer rules. Full compliance was required after a 2-year transition ending 17 October 2024. Government Regulation 33/2026 (enacted 16 July 2026, effective 16 January 2027) adds implementing detail, including parental consent for children and cross-border transfer mechanisms.Next: Jan 16, 2027 Implementing regulation GR 33/2026 takes effect · in 3 months

In forceVietnam

Vietnam AI LawVietnam's first standalone AI law (35 articles). It classifies AI systems as high, medium or low risk based on their impact on life, health, rights and public order, requires human oversight, and requires disclosure when users interact with AI and labeling of AI-generated audio, image and video content. It applies to domestic and foreign actors in AI activities in Vietnam, with transition periods for existing systems.Next: Mar 1, 2027 Transition ends for existing AI systems (general) · in 4 months

AmendedSouth Korea

South Korea PIPAKorea's comprehensive privacy law, with consent-centric processing, breach notification, cross-border transfer rules, automated decision rights (since 2024), and revenue-based penalty surcharges. The 2026 amendment, effective 11 September 2026, raises the maximum fine to 10% of total revenue for aggravated cases, makes the CEO the ultimate responsible person, requires notice when a breach is merely possible, and makes ISMS-P certification mandatory for certain entities from 1 July 2027.Next: Jul 1, 2027 Mandatory ISMS-P certification · in 8 months

In forceVietnam

Vietnam Cybersecurity Law 2025A single cybersecurity law that replaces both the Law on Network Information Security (2015) and the Cybersecurity Law (2018) from 1 July 2026. It covers cybersecurity protection, the security of information systems by classification level, cybersecurity products and services, and the duties of domestic and foreign organisations. Systems and products approved under the old laws have 12 months to meet the new requirements.Next: Jul 1, 2027 Transition ends for existing systems and products · in 8 months

EnactedJapan

Japan Active Cyber Defense ActJapan's active cyber defense law. Designated critical infrastructure operators must register the important computers they bring in (product and maker) with their sector minister and report cyber intrusions and precursor events to that minister and the Prime Minister. The Act also lets the government collect and analyse communications data on foreign cyber attacks under oversight by a new Cyber Communications Information Supervisory Commission.Next: Nov 22, 2027 Communications data measures in force (latest date) · in 13 months

In forceTaiwan

Taiwan AI Basic ActTaiwan's framework law for AI. It sets seven principles (including privacy, security, transparency, fairness and accountability), names the National Science and Technology Council as the lead authority, and has the Ministry of Digital Affairs build a risk classification framework that sector regulators use for risk-based rules. High-risk AI must carry warnings, and the government must set liability and remedy rules for high-risk AI.Next: Jan 14, 2028 Agencies must align laws with the Act · in 15 months

In forceAustralia

Australia Cyber Security Act (ransomware reporting)Australia's first standalone cyber law: mandatory reporting of ransomware or cyber-extortion payments within 72 hours, security standards for consumer smart devices, 'limited use' protections for information shared with ASD and the National Cyber Security Coordinator, and a Cyber Incident Review Board. Ransomware payment reporting has applied since 30 May 2025.In effect since Nov 30, 2024

AmendedAustralia

Australia Online Safety ActSets up the eSafety Commissioner and removal schemes for cyber-bullying of children, adult cyber-abuse, non-consensual intimate images and abhorrent violent material. It also sets Basic Online Safety Expectations with reporting duties, and binding industry codes and standards. The Unlawful Material codes and standards cover class 1A and 1B material such as child sexual exploitation and pro-terror content. The Age-Restricted Material codes cover class 1C and class 2 material such as online pornography, and require age assurance and other measures to protect children.In effect since Jan 23, 2022

AmendedAustralia

Australia SOCI ActAustralia's critical infrastructure security law. Owners and operators of critical infrastructure assets must register ownership and operational information, and many must report cyber security incidents to the Australian Signals Directorate. Responsible entities for many asset classes must also keep a critical infrastructure risk management program. Systems of national significance face enhanced cyber security obligations, and the government has step-in and assistance powers.In effect since Jul 11, 2018

In forceAustralia

Australia Social Media Minimum AgeRequires providers of age-restricted social media platforms to take reasonable steps to stop Australians under 16 from having accounts. Platforms may not rely only on government ID for age assurance, and must protect data collected for age checks and destroy it after use. eSafety has named platforms including Facebook, Instagram, Snapchat, TikTok, X, YouTube, Reddit, Threads, Twitch and Kick.In effect since Dec 10, 2025

In forceChina

China AI Content Labeling MeasuresRequires generative AI service providers to add explicit (visible) labels to AI-generated text, images, audio, video and virtual scenes, and implicit labels (metadata) to generated files. Content distribution platforms must detect and label AI-generated content, and app stores must check labeling functions when apps are listed. A mandatory national standard (GB 45438-2025) takes effect on the same date.In effect since Sep 1, 2025

In forceChina

China Algorithmic Recommendation ProvisionsRegulates recommendation, ranking, personalization, generation and dispatch algorithms used in internet services in China. Users must be able to switch off personalized recommendations and manage tags, and providers may not use algorithms for price discrimination or to induce addiction. Providers with public opinion attributes or social mobilization capacity must file their algorithms with the CAC within 10 working days of launching a service.In effect since Mar 1, 2022

In forceChina

China Anthropomorphic AI MeasuresRegulates AI companion and emotional interaction services that simulate human personality. Providers must tell users they are talking to AI, remind users after every 2 hours of use, intervene in crises such as self-harm, offer easy exit, and may not offer virtual partner or relative services to minors. Users' interaction data may not be shared or used for training on sensitive data without consent, and services with 1 million registered or 100,000 monthly active users need a security assessment filed with the provincial CAC.In effect since Jul 15, 2026

In forceChina

China Cross-Border Data Flow ProvisionsRelaxes China's data export regime by exempting common transfers (contracts with the individual, cross-border HR, emergencies, and non-CII transfers of PI of fewer than 100,000 people a year) and setting volume thresholds for when a CAC security assessment, standard contract or certification is needed. Data is not 'important data' unless regulators have notified or published it as such.In effect since Mar 22, 2024

In forceChina

China Cyber Incident Reporting MeasuresRequires network operators in China to grade cybersecurity incidents using an annexed grading guide and report incidents rated relatively major or above. CII operators must report within 1 hour, central government bodies within 2 hours, and other operators to the provincial CAC within 4 hours. A full post-incident report is due within 30 days after handling ends, and ransom demands must be disclosed.In effect since Nov 1, 2025

AmendedChina

China Cybersecurity LawChina's base cybersecurity statute: multi-level protection scheme duties for network operators, localization and security review duties for critical information infrastructure (CII) operators, and content controls. The 2025 amendment, in force from 1 January 2026, adds AI governance support, ties PI processing to PIPL, allows fines on first violations and sharply raises maximum fines.In effect since Jun 1, 2017

In forceChina

China Data Export Security Assessment MeasuresSets the CAC security assessment that must be passed before certain data leaves China, including exports of important data and large-scale personal information exports. Data handlers must run a self-assessment, then apply through the provincial CAC for a national CAC review. Transfers already under way had six months to come into compliance.In effect since Sep 1, 2022

In forceChina

China Data Security LawSets up China's data classification and grading system, with heightened protection for 'important data' and 'core data'. Requires data processors to run data security management systems, risk monitoring and incident handling, and restricts giving data stored in China to foreign judicial or law-enforcement bodies without approval.In effect since Sep 1, 2021

In forceChina

China Data Security Risk Assessment MeasuresImplements the annual risk assessment duty for important data handlers under the DSL and Network Data Security Regulations. Important data handlers must assess risk every year and submit the report to their regulator within 20 working days of finishing; general data handlers are encouraged to assess at least every 3 years. Regulators can order an assessment by a certified third party after serious risks or large leaks.In effect since Aug 20, 2026

In forceChina

China Deep Synthesis ProvisionsRegulates deepfakes and other deep synthesis services such as synthetic text, voice cloning, face swapping and immersive scenes. Providers must verify user identity, review content, add technical marks to generated content, and add prominent labels where content could confuse the public. Providers with public opinion attributes must file algorithms, and app stores must check filings and security assessments.In effect since Jan 10, 2023

In forceChina

China Facial Recognition MeasuresSets rules for using facial recognition to process face data in China. Handlers need a specific purpose and necessity, separate consent (guardian consent under 14), a prior impact assessment, local storage on the device unless consent or law allows otherwise, and a non-face alternative. Handlers storing face data of 100,000 people or more must file with the provincial CAC within 30 working days.In effect since Jun 1, 2025

In forceChina

China Generative AI MeasuresChina's main rule for generative AI services offered to the public in China. Providers must use lawfully sourced training data, respect IP and personal information rights, label generated content, handle illegal content, and protect minors. Services with public opinion attributes or social mobilization capacity need a security assessment and algorithm filing.In effect since Aug 15, 2023

In forceChina

China Minors Online Protection RegulationsChina's State Council regulation on online protection of minors. Platforms with huge numbers of minor users or significant influence on minors must run impact assessments, offer minor modes, set up independent oversight and publish annual reports. Handlers of minors' personal information must run annual compliance audits, and online services must have anti-addiction systems.In effect since Jan 1, 2024

In forceChina

China Network Data Security RegulationsImplementing regulations under the CSL, DSL and PIPL covering personal information, important data, cross-border data and platform duties. Processors of PI of 10 million+ people must also meet important-data processor duties, such as naming a security lead and filing annual risk assessments. Platforms must offer an easy opt-out from personalized recommendations.In effect since Jan 1, 2025

In forceChina

China PI Compliance Audit MeasuresImplements PIPL Arts. 54 and 64: PI processors must audit their own PIPL compliance regularly, and regulators can order an audit by a professional firm when they find high risk or an incident. Processors of PI of more than 10 million people must audit at least once every two years.In effect since May 1, 2025

In forceChina

China PI Export Certification MeasuresSets the third route for exporting personal information from China: certification by an accredited certification body. Available to non-CII handlers exporting personal information of 100,000 to under 1 million people (non-sensitive) or under 10,000 people's sensitive data in a year. Certificates last three years; overseas handlers apply through a local entity or representative.In effect since Jan 1, 2026

In forceChina

China PI Export Standard Contract MeasuresLets personal information handlers export personal information by signing China's standard contract with the overseas recipient instead of a security assessment, if volume limits are met. Handlers must do a personal information protection impact assessment and file the signed contract with the provincial CAC. Transfers already under way had six months to comply.In effect since Jun 1, 2023

In forceChina

China PIPLChina's comprehensive personal information law: requires a legal basis (usually consent) for processing, separate consent for sensitive data and cross-border transfers, PI impact assessments, and data subject rights. Applies extraterritorially to processing of data of people in China to provide products/services or analyze their behavior. Cross-border transfers need a CAC security assessment, standard contract, or certification.In effect since Nov 1, 2021

In forceChina

China Small PI Handler Simplified MeasuresEases PIPL compliance for handlers processing personal information of fewer than 100,000 people. They can use short notices, rely on platform privacy rules, run simplified compliance audits at least every five years using a self-check form, and use simplified impact assessments. It also exempts common cross-border transfers from the assessment, contract and certification routes and limits penalties for minor first violations.In effect since Sep 1, 2026

In forceHong Kong

Hong Kong Critical Infrastructure Cyber OrdinanceHong Kong's critical infrastructure cybersecurity law. Designated critical infrastructure operators (CIOs) must keep a Hong Kong office, set up a computer-system security management unit, run risk assessments and audits, keep security and emergency plans, take part in drills, and report incidents. Serious incidents must be reported within 12 hours and other incidents within 48 hours.In effect since Jan 1, 2026

AmendedHong Kong

Hong Kong PDPOHong Kong's privacy law for public and private data users, built on six Data Protection Principles covering collection, accuracy and retention, use, security, openness and access. Amendments in 2012 added direct marketing rules. The 2021 amendment made doxxing a crime and gave the Privacy Commissioner powers to investigate, prosecute and order removal of doxxing content.In effect since Dec 20, 1996

In forceIndia

India CERT-In Cyber Security DirectionsRequires service providers, intermediaries, data centres, body corporates and government bodies to report listed cyber incidents to CERT-In within 6 hours of noticing them. Entities must sync clocks to Indian NTP servers, keep ICT logs for a rolling 180 days within India, and name a point of contact. Data centre, VPS, cloud and VPN providers must keep validated subscriber details for 5 years.In effect since Jun 27, 2022

In forceIndia

India IT Rules amendment on synthetic contentAmends India's IT Rules 2021 to regulate synthetically generated information (AI-made or AI-altered audio, images and video). Intermediaries that enable such content must label it prominently, keep labels and metadata from being removed, and significant social media intermediaries must get a user declaration and verify it. Takedown clocks are cut sharply: 3 hours after a court or government order, 36 hours for certain grievances, and 2 hours for intimate or morphed images.In effect since Feb 20, 2026

In forceIndonesia

Indonesia PP 17/2025 (Child Protection Online)Implements the child protection provisions added to Indonesia's Electronic Information and Transactions Law by Law No. 1 of 2024. It sets rules for how electronic system operators must protect children who use their products and services, how the government supervises them, and which administrative sanctions apply. Ministries and the public also have defined roles.In effect since Mar 27, 2025

In forceJapan

Japan AI Promotion ActA framework law to promote AI R&D and use, not to restrict it. It sets up the AI Strategy Headquarters under the Prime Minister and an AI Basic Plan. The government can investigate cases where AI causes harm to rights and publish guidance and names. It sets no direct compliance obligations or fines for businesses, beyond a duty to cooperate with government measures.In effect since Jun 4, 2025

AmendedJapan

Japan APPIJapan's general privacy law covering purpose specification, security, third-party transfer consent (with an opt-out scheme), cross-border transfer rules, mandatory breach reporting, and pseudonymized data. The 2026 amendment (promulgated 17 July 2026) adds Japan's first administrative fine (disgorgement of gains from serious violations), guardian consent for children under 16, stricter rules on facial-feature data, relaxed breach notification to individuals, and a consent exemption for statistics and AI development.In effect since Apr 1, 2005

In forceKazakhstan

Kazakhstan AI LawKazakhstan's first AI statute. Owners sort their AI systems into minimal, medium or high risk and must run yearly risk management, keep documentation and inform users when AI is used. Some AI functions are banned outright, including manipulation, exploiting vulnerable people, social scoring, biometric categorisation for discrimination and emotion recognition without consent. AI-generated synthetic content must carry machine-readable marking and a visible warning.In effect since Jan 18, 2026

In forceMalaysia

Malaysia Cyber Security ActMalaysia's first standalone cybersecurity law. It sets up the National Cyber Security Committee, gives powers to the Chief Executive of NACSA, and places duties on national critical information infrastructure (NCII) sector leads and entities. NCII entities must follow codes of practice, run a risk assessment at least once a year and an audit at least once every two years, and notify cybersecurity incidents within 6 hours. Cybersecurity service providers must be licensed.In effect since Aug 26, 2024

AmendedMalaysia

Malaysia PDPAMalaysia's commercial-sector data protection law. The 2024 amendments, phased in during 2025, rename 'data users' as 'data controllers', add biometric data to sensitive data, apply the Security Principle directly to processors, replace the transfer whitelist with adequacy and safeguards tests, raise fines, and add mandatory DPOs, data breach notification and data portability.In effect since Nov 15, 2013

In forceNew Zealand

New Zealand Biometric Processing Privacy CodeA binding code of practice under the Privacy Act 2020. It sets the privacy rules for organisations that collect and use biometric information, such as face, fingerprints, voice, keystroke patterns or gait, in automated biometric processing like facial recognition. Agencies already using biometrics had a nine-month grace period, which ended on 3 August 2026. Amendment No. 1 aligns the code with the new indirect collection principle (IPP 3A) from 1 May 2026.In effect since Nov 3, 2025

AmendedNew Zealand

New Zealand Privacy ActNew Zealand's privacy law, built on 13 Information Privacy Principles plus mandatory notification of serious privacy breaches. The Privacy Amendment Act 2025 adds IPP 3A from 1 May 2026: agencies that collect personal information indirectly (from third parties) must take reasonable steps to tell the individual about the collection, its purpose, recipients and their rights.In effect since Dec 1, 2020

AmendedPakistan

Pakistan PECAPakistan's main cybercrime law, covering unauthorised access, data interference, cyber stalking and related offences, plus investigation powers. The 2025 amendment creates a Social Media Protection and Regulatory Authority that enlists social media platforms, orders removal or blocking of unlawful content, and can block non-compliant platforms. It also adds a Social Media Protection Tribunal, a new National Cyber Crime Investigation Agency, and an offence of spreading false information.No date set

In forcePhilippines

Philippines Data Privacy ActThe Philippines' general data privacy law. It sets consent and lawful processing rules, protects sensitive personal information, gives data subjects access, correction, erasure and portability rights, and creates the National Privacy Commission. Its 2016 Implementing Rules require breach notice to the NPC and affected people within 72 hours, plus registration of data processing systems.In effect since Sep 8, 2012

AmendedSingapore

Singapore Cybersecurity ActSingapore's framework for protecting critical information infrastructure (CII). CII owners must meet codes of practice, run audits and risk assessments, and report prescribed cybersecurity incidents to the Commissioner of Cybersecurity. Providers of licensable services (penetration testing and managed SOC) need a licence. The 2024 amendments extend oversight to foundational digital infrastructure providers, entities of special cybersecurity interest, systems of temporary cybersecurity concern, and CII located overseas, and add civil penalties.In effect since Aug 31, 2018

In forceSingapore

Singapore Online Safety (Relief and Accountability) ActCreates a Commissioner of Online Safety, supported by the Online Safety Commission (OSC), who can direct platforms, posters and group administrators to stop or limit specified online harms. The first phase covers online harassment, doxxing, online stalking, intimate image abuse and image-based child abuse; eight further harm categories, including inauthentic material abuse, will be brought in later. The Act also creates statutory torts so victims can sue communicators, administrators and prescribed platforms in court.In effect since Jun 29, 2026

In forceSingapore

Singapore PDPASingapore's baseline private-sector data protection law covering consent, purpose limitation, notification, access and correction, protection, retention, transfer limitation, and the Do Not Call registry. The 2020 amendments added mandatory breach notification, expanded deemed consent and legitimate-interests exceptions, and raised fines.In effect since Jul 2, 2014

In forceSouth Korea

South Korea AI Basic ActKorea's comprehensive AI law: transparency duties (notify users in advance that AI is used, label generative AI outputs and deepfakes), risk management, explainability and human oversight for 'high-impact' AI (e.g. hiring, lending, healthcare), safety duties for very large models (10^26 FLOPs+ training compute), and a domestic representative for large foreign providers. MSIT is running a grace period of at least one year, deferring fact-finding and fines except in serious cases.In effect since Jan 22, 2026

AmendedTaiwan

Taiwan PDPATaiwan's general privacy law for public and private bodies, covering collection, processing and use, special data, data subject rights, breach notice and cross-border transfer limits. The 2023 amendment raised fines and created an independent Personal Data Protection Commission. The 2025 amendment makes the PDPC the sole regulator, adds breach reporting to the PDPC, security maintenance duties and audits, but its start date is still to be set.In effect since Oct 1, 2012

In forceThailand

Thailand Cybersecurity ActThailand's cybersecurity framework for government agencies and critical information infrastructure (CII) operators. It creates the National Cyber Security Committee and the National Cyber Security Agency (NCSA). It also sets codes of practice and standards, incident reporting and response duties, and escalating powers for serious and critical cyber threats. The Committee issues binding standards under the Act, such as the Website Security Standard B.E. 2568.In effect since May 28, 2019

In forceThailand

Thailand PDPAThailand's GDPR-style data protection law: lawful bases including explicit consent for sensitive data, data subject rights, DPOs for large-scale or sensitive processing, breach notification to the PDPC within 72 hours, and cross-border transfer restrictions. Main obligations applied from 1 June 2022 after two postponements.In effect since Jun 1, 2022

In forceVietnam

Vietnam Law on DataVietnam's framework law for digital data. It classifies data as core, important or other, with lists of core and important data set by the Prime Minister, and requires cross-border transfer and processing of core and important data to protect national defence, security and the public interest. It also sets up the National Data Center and national database, and governs data products, data services and data exchanges.In effect since Jul 1, 2025

In forceVietnam

Vietnam PDPLVietnam's first statute on personal data protection, replacing Decree 13/2023. It covers consent, data subject rights, processing and transfer impact assessments filed with the regulator, cross-border transfers, breach reporting, and bans on buying and selling personal data. Decree 356/2025 took effect alongside it and details DPIA/TIA and DPO requirements.In effect since Jan 1, 2026

Upcoming deadlines

Transition endsNov 13 · in 17 days

India DPDP ActConsent Manager registration rule in force (12 months)Rule 4 (registration and obligations of Consent Managers) comes into force one year after publication.India

ComplianceDec 10 · in 44 days

Australia Privacy ActChildren's Online Privacy Code must be registeredOAIC must develop and register the Children's Online Privacy Code within 24 months of Royal Assent.Australia

ComplianceDec 10 · in 44 days

Australia Privacy ActAutomated decision-making transparency appliesPrivacy policies must disclose the kinds of personal information used in substantially automated decisions that significantly affect individuals (24 months after assent).Australia

ComplianceDec 28 · in 2 months

Malaysia Online Safety ActOnline Safety Plan due to MCMCLicensed providers must prepare an Online Safety Plan and submit it to MCMC within 180 days of 1 July 2026. Updates are due each year and after material changes.Malaysia

ComplianceJan 16, 2027 · in 3 months

Indonesia PDP LawImplementing regulation GR 33/2026 takes effectDetailed PDP implementing rules (DPIA, cross-border, children's consent) apply, 6 months after the 16 Jul 2026 enactment.Indonesia

Transition endsMar 1, 2027 · in 4 months

Vietnam AI LawTransition ends for existing AI systems (general)Existing AI systems in most sectors must comply (12-month transition).Vietnam

ComplianceMay 13, 2027 · in 7 months

India DPDP ActMain data fiduciary obligations apply (18 months)Rules 3, 5-16, 22 and 23 (notice, security safeguards, breach notification, retention, children's consent, SDF duties, cross-border) come into force 18 months after publication.India

ComplianceJul 1, 2027 · in 8 months

South Korea PIPAMandatory ISMS-P certificationISMS-P certification becomes mandatory for private entities meeting the statutory criteria.South Korea

Transition endsJul 1, 2027 · in 8 months

Vietnam Cybersecurity Law 2025Transition ends for existing systems and productsInformation systems classified under the 2015 law, and security products already in use, must meet the new law's conditions within 12 months of its effective date.Vietnam

Transition endsSep 1, 2027 · in 10 months

Vietnam AI LawTransition ends for existing AI systems in health, education and financeExisting AI systems in healthcare, education and finance must comply (18-month transition).Vietnam

Takes effectTentativeNov 22, 2027 · in 13 months

Japan Active Cyber Defense ActCommunications data measures in force (latest date)Chapters 3 to 7 on agreements with operators and collection of communications data take effect by Cabinet Order within 2 years and 6 months of promulgation. e-Gov lists 22 Nov 2027 as the outer limit, not a fixed date.Japan

Transition endsTentativeJan 14, 2028 · in 15 months

Taiwan AI Basic ActAgencies must align laws with the ActGovernment agencies must finish amending or adopting laws and administrative measures within 2 years of entry into force (art. 18). Date is computed from the statute.Taiwan

Past deadlines

ComplianceOct 1 · 26 days ago

Japan Active Cyber Defense ActRegistration and incident reporting duties startMain provisions take effect, including Chapter 2 duties for special social infrastructure operators to register important computers and report specified intrusion incidents.Japan

ComplianceSep 16 · 41 days ago

Thailand Cybersecurity ActWebsite Security Standard B.E. 2568 enforcedThe website security standard announced on 16 September 2025 becomes enforceable for government agencies, regulators and CII organisations.Thailand

EnforcementSep 12 · 45 days ago

Australia Social Media Minimum AgeStrengthened enforcement amendments commenceThe Online Safety Amendment (Strengthening Enforcement for the Social Media Minimum Age) Act 2026 (No. 83, 2026) commences. The maximum civil penalty for platforms doubles from 30,000 to 60,000 penalty units, and eSafety gains new information-gathering powers.Australia

Takes effectSep 11 · 46 days ago

South Korea PIPA2026 PIPA amendments take effect10%-of-revenue fines, CEO accountability, and notice duties for possible breaches apply.South Korea

Takes effectSep 1 · 56 days ago

China Small PI Handler Simplified MeasuresSimplified measures for small handlers take effectSmall handlers may use simplified notice, audit and assessment methods.China

Takes effectAug 20 · 2 months ago

China Data Security Risk Assessment MeasuresRisk assessment measures take effectAnnual risk assessment and reporting duties for important data handlers apply.China

Transition endsAug 3 · 3 months ago

New Zealand Biometric Processing Privacy CodeGrace period ends for existing biometric processingAgencies already using biometrics before the code started must comply by this date.New Zealand

MilestoneJul 17 · 3 months ago

Japan APPI2026 APPI amendment act promulgatedAmendment enacted by the Diet on 10 July 2026 and promulgated; main provisions take effect by cabinet order within two years of promulgation.Japan

Takes effectJul 15 · 3 months ago

China Anthropomorphic AI MeasuresAnthropomorphic AI measures take effectAI disclosure, usage reminders, minor protection, data and security assessment duties apply.China

Takes effectJul 1 · 4 months ago

Vietnam Cybersecurity Law 2025Cybersecurity Law 2025 takes effectThe new law takes effect. Law 86/2015/QH13 and Law 24/2018/QH14 cease to have effect.Vietnam

Takes effectJul 1 · 4 months ago

Malaysia Online Safety ActOnline Safety Plan and compounding regulations in forceP.U. (A) 244/2026 and P.U. (A) 245/2026 take effect.Malaysia

Takes effectJun 29 · 4 months ago

Singapore Online Safety (Relief and Accountability) ActOSC begins operations and first provisions commenceOSC starts taking reports for five harms, and the statutory torts for those harms take effect.Singapore

ComplianceMay 1 · 6 months ago

New Zealand Privacy ActIPP 3A indirect-collection notification appliesAgencies collecting personal information from third parties must take reasonable steps to notify individuals, subject to exceptions.New Zealand

Takes effectMay 1 · 6 months ago

New Zealand Biometric Processing Privacy CodeAmendment No. 1 applies (IPP 3A)The amended code, which reflects IPP 3A, is in force from 1 May 2026.New Zealand

Takes effectApr 1 · 7 months ago

Japan Active Cyber Defense ActSupervisory Commission provisions in forceProvisions setting up the Cyber Communications Information Supervisory Commission take effect, per the e-Gov revision history.Japan

Takes effectApr 1 · 7 months ago

China Minors Online Protection RegulationsMeasures identifying large or influential platforms for minors take effectPlatforms meeting the thresholds (for example 10 million registered or 1 million monthly active minor users) must apply to be designated.China

MilestoneMar 10 · 8 months ago

South Korea PIPA2026 PIPA amendment promulgated (Act No. 21445)Amendment raising fines to 10% of revenue and adding CEO accountability promulgated.South Korea

ComplianceMar 4 · 8 months ago

Australia Cyber Security Act (ransomware reporting)Smart device security standard appliesPart 2 and Schedule 1 of the Cyber Security (Security Standards for Smart Devices) Rules 2025 commence. Manufacturers and suppliers of relevant connectable products must meet the security standard.Australia

Takes effectMar 1 · 8 months ago

Vietnam AI LawAI Law takes effectRisk classification, transparency and labeling obligations apply to new AI systems.Vietnam

Takes effectMar 1 · 8 months ago

China Minors Online Protection RegulationsClassification measures for content harmful to minors take effectImplementing measures classify online information that may affect minors' physical and mental health.China

Takes effectFeb 20 · 8 months ago

India IT Rules amendment on synthetic contentSynthetic content rules take effectSGI labeling, user declaration and verification duties, and the shorter 3 hour, 36 hour and 2 hour takedown timelines apply.India

Takes effectJan 22 · 9 months ago

South Korea AI Basic ActAI Basic Act and Enforcement Decree take effectTransparency, labeling, high-impact AI, and domestic representative obligations apply (fines deferred during the grace period).South Korea

Takes effectTentativeJan 18 · 9 months ago

Kazakhstan AI LawAI Law takes effectThe Law takes effect after 60 calendar days from first official publication on 18 Nov 2025 (art. 31). The day is computed, not stated.Kazakhstan

Takes effectJan 14 · 9 months ago

Taiwan AI Basic ActAI Basic Act in forcePromulgated and in force on the same day (art. 20).Taiwan

Takes effectJan 1 · 10 months ago

Vietnam PDPLPDPL and Decree 356/2025 take effectPersonal data protection obligations, DPIA/TIA filing and penalty framework apply; Decree 13/2023 replaced.Vietnam

Takes effectJan 1 · 10 months ago

Malaysia Online Safety ActOnline Safety Act and first regulations in forceThe Act and the Period, Fees, Form of Undertaking and Appeal Tribunal regulations take effect.Malaysia

Takes effectJan 1 · 10 months ago

Hong Kong Critical Infrastructure Cyber OrdinancePCICSO comes into operationCommissioner's Office is established and designation of CIOs begins; obligations apply to designated operators.Hong Kong

Takes effectJan 1 · 10 months ago

China PI Export Certification MeasuresPI export certification measures take effectThe certification route for personal information exports applies.China

Takes effectJan 1 · 10 months ago

China Cybersecurity Law2025 amendments take effectHigher fines, first-violation fines, AI governance provisions and PIPL-alignment duties apply under the 28 Oct 2025 NPCSC Decision.China

EnforcementJan 1 · 10 months ago

Australia Cyber Security Act (ransomware reporting)Ransomware reporting moves to compliance phaseThe education-first phase (30 May-31 Dec 2025) ends; Home Affairs moves to a compliance and education approach for missed reports.Australia

Takes effectDec 10, 2025 · 11 months ago

Australia Social Media Minimum AgeSocial media minimum age obligation appliesAge-restricted platforms must take reasonable steps to prevent under-16s from holding accounts.Australia

MilestoneNov 25, 2025 · 11 months ago

Singapore Online Safety (Relief and Accountability) ActAct assented toPassed by Parliament on 5 November 2025 and assented to by the President on 25 November 2025.Singapore

Takes effectNov 13, 2025 · 11 months ago

India DPDP ActDPDP Rules published; Board and procedural rules in forceRules 1, 2 and 17-21 (Data Protection Board constitution and functioning) take effect on publication in the Official Gazette.India

MilestoneTentativeNov 11, 2025 · 12 months ago

Taiwan PDPA2025 amendment promulgatedAmendment adds PDPC powers, breach reporting and security duties. Its start date will be set by the Executive Yuan and is not yet known.Taiwan

Takes effectNov 3, 2025 · 12 months ago

New Zealand Biometric Processing Privacy CodeBiometric code in forceThe Biometric Processing Privacy Code applies to new biometric processing.New Zealand

Takes effectNov 1, 2025 · 12 months ago

China Cyber Incident Reporting MeasuresIncident reporting measures take effect1, 2 and 4 hour reporting windows apply to relatively major and higher incidents.China

Takes effectOct 31, 2025 · 12 months ago

Singapore Cybersecurity Act2024 amendments commenceMost of the Cybersecurity (Amendment) Act 2024 takes effect, covering foundational digital infrastructure, entities of special cybersecurity interest and systems of temporary cybersecurity concern.Singapore

Takes effectSep 24, 2025 · 13 months ago

New Zealand Privacy ActPrivacy Amendment Act 2025 technical changes commenceTechnical amendments commence the day after Royal Assent (23 Sep 2025).New Zealand

Takes effectSep 1, 2025 · 14 months ago

Japan AI Promotion ActAI Promotion Act fully in forceProvisions establishing the AI Strategy Headquarters and AI Basic Plan take effect.Japan

Takes effectSep 1, 2025 · 14 months ago

China AI Content Labeling MeasuresAI content labeling measures and GB 45438-2025 take effectExplicit and implicit labeling duties for AI-generated content and platform detection duties apply.China