Skip to content

ISO 27001, SOC 2, the DPDP Act and manual VAPT. Book a Free Scoping Call

Privacy

What to Bring to a Regional Privacy Applicability Assessment in Asia-Pacific

A regional privacy applicability assessment can only be as accurate as the facts you bring to it: your legal entities and where each is established, the markets whose residents' data you process, the categories and rough volumes of that data, where it is stored and where it flows, the processors who handle it, and the notices and processes you already run. Asia-Pacific laws turn on different facts. Some reach companies outside the country, some require data to stay in the country, and their breach clocks differ. SecureRoot starts privacy work by mapping those facts against the rules it has verified at source, and leaves legal opinions to your counsel. No personal data, credentials or customer datasets are needed to do it.

Request a privacy assessmentContact SecureRoot

About this guide

Written by SecureRoot Risk Advisory LLP.

Start here

Why the inputs decide the answer

An applicability assessment answers one question per market: does this law apply to this entity's processing of this data, and if so, which duties follow? The law sets the tests, but the answer depends on facts that only you hold. A missing subsidiary, an unlisted analytics vendor or a backup region nobody mentioned can turn a market from out of scope to in scope.

The sections below take each input in turn, say what to gather and give examples of rules that turn on it. The examples come from the laws we have verified at the official source; our coverage directory lists every Asia-Pacific market with the rules verified so far and the open questions. For the short list of what to have ready on the call itself, use the privacy assessment scoping checklist.

Input 1

Legal entities and where each is established

  • Every legal entity that collects, uses or receives personal data: parent, subsidiaries, branches, and any group company that only receives data, such as a shared support centre.
  • The country of incorporation and of any office or team with a stable presence for each.
  • Which entity contracts with customers in each market, and which entity employs the staff who can access the data.
  • For Australian entities, annual turnover: the Privacy Act 1988 sets a small-business threshold of $3,000,000 turnover in section 6D, so turnover helps decide whether the Australian Privacy Principles apply.

Several laws in the region reach companies that have no entity in the country, so a missing entity does not mean a missing market. India's DPDP Act applies, under section 3(b), to processing outside India when it is connected with offering goods or services to people in India. Bangladesh's Personal Data Protection Act 2026 also states an extraterritorial reach, in section 1(2).

Input 2

Markets whose residents' data you process

  • Each country or market where you have users, customers, employees or contractors whose personal data you process, with rough numbers.
  • Whether you actively offer goods or services there: local language, local currency, local app store listing, local marketing.
  • Markets you are about to enter in the next year, so the assessment does not need repeating at launch.

Bring markets where you only have employees or contractors too. Staff data is personal data, and a regional team in a new country is often the first entity a privacy regulator there would see.

Input 3

Categories and volumes of personal data

List categories and approximate volumes per market, never records. Some categories carry their own rules, and some duties depend on volume.

  • Identity, contact and account data; payment data; location data; device and usage data.
  • Sensitive categories: health, biometric, genetic, financial, children's data, government identifiers.
  • Uzbekistan: since 27 March 2026, biometric, genetic and telecom-subscriber data must be stored in Uzbekistan (Article 27-1 of the personal data law ZRU-547). Biometric login or genetic features in a product used there need flagging early.
  • China: whether cross-border transfers need a security assessment, a standard contract or certification depends on whether you are a critical information infrastructure operator and on the volume of personal information and sensitive personal information involved, under the 2024 cross-border data provisions. Approximate counts are therefore an input, not a detail.

Input 4

Where the data is stored and where it flows

This input usually decides more than any other. Draw it as a diagram or a table: for each system, where it is hosted, where backups and logs go, and which countries staff and vendors access it from.

  • Kazakhstan: personal data must be stored in a database or digital storage facility located in Kazakhstan (Article 12(2) of the personal data law), and cross-border transfer is allowed only to protective countries or on listed grounds (Article 16).
  • Japan: transfers to a third party in a foreign country need the person's consent or one of the equivalent-protection routes in Article 28 of the Act on the Protection of Personal Information.
  • Republic of Korea: cross-border transfers need one of the bases in Article 28-8 of the Personal Information Protection Act, as amended by Act No. 21445.
  • China: the Personal Information Protection Law sets conditions for providing personal information outside China (Article 38) and requires an impact assessment before doing so (Article 55).
  • New Zealand: information sent overseas must get comparable protection under the Privacy Act 2020.
  • India: section 16 of the DPDP Act lets the Central Government restrict transfers to countries it notifies, and keeps in force any sectoral law that sets a higher standard or a stricter restriction.

Remote access counts as a flow. An engineer in one country who can query a database hosted in another is a transfer for many of these laws, so include support and operations access, not only replication.

Input 5

Processors, vendors and group companies

  • Every vendor that stores, processes or can access personal data for you: cloud hosting, email and SMS delivery, customer support, analytics, payments, background checks, payroll.
  • Each vendor's processing locations and its own sub-processors where you know them.
  • The contract you have with each: a data processing agreement, standard clauses, or nothing yet.
  • Group companies that process data for each other, which are processors or recipients in the same way as outside vendors.

Processor duties differ by market. Kyrgyzstan's Digital Code, for example, sets a 48-hour notice from a processor alongside a 72-hour incident notice to the sectoral regulator (Article 63). Your contracts need to carry the shortest deadline that applies to each flow.

Input 6

Incident contacts and the breach clocks you would face

Bring your current incident response plan and the names of who would decide whether a breach is notifiable in each market. The clocks below show why one regional procedure needs market-specific branches.

  • Singapore: under the PDPC's guide, a breach is notifiable if it is likely to cause significant harm or affects 500 or more individuals; assess within 30 calendar days and notify the PDPC within 3 calendar days of assessing it as notifiable.
  • Malaysia: since 1 June 2025, notify the Personal Data Protection Commissioner as soon as practicable and within 72 hours, and affected individuals within 7 days after that, under section 12B as set out in the Commissioner's guideline.
  • Indonesia: written notice to the individuals and the agency within 3 x 24 hours of a failure of personal data protection (Article 46 of Law No. 27 of 2022).
  • Australia: assess a suspected eligible data breach within 30 days (section 26WH) and notify as soon as practicable once it is eligible (section 26WL).
  • Japan and the Republic of Korea: report qualifying leaks to the regulator and notify individuals (APPI Article 26; PIPA Article 34, without delay).
  • Philippines: prompt notification to the National Privacy Commission and affected individuals for qualifying breaches (section 20 of the Data Privacy Act of 2012).
  • New Zealand: notify the Privacy Commissioner and affected people of breaches that cause or are likely to cause serious harm.

Input 7

Existing notices, consent flows and rights processes

  • Every privacy notice in use, per website, app and market, with its date and language.
  • Consent screens and cookie banners as they appear today, as screenshots.
  • How individuals ask for access, correction or deletion now, who answers, and in how many days.
  • Any regulator correspondence or customer audit findings on privacy.

Existing processes are measured against local timing and content rules. Sri Lanka's amended Personal Data Protection Act gives one month to respond to a data subject request, extendable to three months in total. New Zealand's new information privacy principle 3A, in force from 1 May 2026, requires you to tell individuals when you collect their information from another source, unless an exception applies.

Before you send anything

What the assessment does not need

Describe the data; do not send it. No personal data, customer datasets, production exports, passwords, credentials or keys are needed to scope or run an applicability assessment. Category names, counts, system names and diagrams are enough, and they are what the assessment is built from.

SecureRoot's part

How SecureRoot uses these inputs

SecureRoot's privacy programmes begin with data discovery and mapping, which produces a data flow and inventory map. For a regional assessment, those inputs are set against the rules we have verified at the official source for each market, recorded with the date the source was opened. Where a rule could not be verified, it is recorded as an open question rather than a finding.

SecureRoot's published privacy programmes are the DPDP Act, GDPR, CCPA and ISO/IEC 27701. SecureRoot is not a law firm, so where a market's answer turns on legal interpretation, the assessment says so and the opinion stays with your counsel in that market. Scoping starts with a call of 30 to 45 minutes, and the quote is fixed against a written scope.

Scope boundaries

What this does not cover

  • An applicability assessment maps facts against rules; it is not legal advice and does not guarantee compliance in any market. SecureRoot is not a law firm, and legal opinions and representation before any regulator stay with your counsel.
  • There is no DPDP certificate and no universal GDPR certification, and SecureRoot does not certify privacy compliance in any market.
  • Rules not verified at the official source are reported as open questions, not as findings. Laws in the region change often; the coverage directory records the date each source was checked.
  • SecureRoot works remotely from India and has no offices outside India.
  • Singapore and Malaysia license penetration-testing providers, and penetration testing is not offered through this site to organisations in either market; ask SecureRoot before enquiring about any other service there.
  • You remain responsible for the accuracy of the inputs. An entity, vendor or data flow left out is a market the assessment cannot answer for.

Questions

Common questions

  • Do we need to send customer data for the assessment?

    No. Categories, approximate counts, system names and data flow diagrams are enough. No personal data, customer datasets, credentials or keys are needed.

  • We have no office in a country. Can its privacy law still apply?

    Yes, in several markets. India's DPDP Act reaches processing outside India connected with offering goods or services to people in India, and Bangladesh's Personal Data Protection Act 2026 states an extraterritorial reach. That is why markets are an input separate from entities.

  • Where do we find the rules for a specific market?

    The Asia-Pacific coverage directory lists every market in the region with the rules we have verified at source, the source itself and the date it was checked, plus open questions.

  • When do the DPDP Rules apply?

    The DPDP Rules, 2025 commence in tranches. Rule 1 says rules 3, 5 to 16, 22 and 23 come into force eighteen months after publication in the Gazette in November 2025, and rule 4 one year after it.

Primary Sources

Where the Figures on This Page Come From

Figures and requirements above are taken from the sources below, linked to the primary text wherever one exists rather than to a summary of it.

Related

Services and help that go with this

Bring the inputs, get a written scope

Tell SecureRoot which entities, markets and systems are involved. We will agree a written scope for the mapping and the markets it covers, say which questions need local counsel, and quote a fixed price.

Request a privacy assessmentContact SecureRoot