Accept or Reject: Obtaining Consent from Data Subjects
While obtaining informed and voluntary consent from data subjects, organisations should clearly state the reasons for collecting the data, how it will be handled, and how it will be used.
Being transparent with subjects about data collection and use is especially important as data creation has proliferated across social media, streaming, digital transactions, smart devices, logins and other identifying information on search browsers, and the rise of AI and metadata in files.
In practice, the manner in which informed and voluntary data subject consent is conducted may vary from jurisdiction to jurisdiction.
This article explores guidelines and best practices for informing data subjects and obtaining voluntary consent in countries within Globalaw’s APAC region, including Hong Kong, India, Japan, South Korea, and Taiwan.
Hong Kong
In Hong Kong, where the governing body is the Office of the Privacy Commissioner for Personal Data (PCPD), a data user must expressly inform the data subject of the purpose for which the data is to be used on or before collection of the data.
Provision of personal data pursuant to such information by the data subject shall be deemed sufficient consent, which is implied.
However, new consent from the data subject is required if such personal data shall be used for a new purpose. For example, changing policies to begin sharing data with a third-party partner for direct marketing.
For cross-border transfers, the Personal Data (Privacy) Ordinance stipulates, among other requirements, that the data subject must also provide written consent specifically; however, this requirement has not yet come into effect.
India
In India, where the governing body is the country’s Ministry of Electronics and Information Technology (MeitY), principal data subject consent should be free, specific, informed, unconditional and unambiguous.
Also, while seeking consent from data principals, a notice must be displayed informing them about: (i) the personal data and the purpose for which the same has been processed; (ii) the manner in which they may exercise their rights; and (iii) the manner in which the data principal may make a complaint to the board. These basic requirements also apply to consent for cross-border transfer of personal information.
Japan
In Japan, where the governing body is the country’s Personal Information Protection Commission, business operators must clearly outline the purpose of data collection and obtain specific consent for the cross-border transfer of personal information, with certain exceptions.
South Korea
In South Korea, where the governing body is the country’s Personal Information Protection Commission, informed and voluntary consent is essential for collecting and using personal data, unless a legal exception applies.
Additionally, consent for collection, third-party provision, and cross-border transfers must be obtained separately and clearly distinguished.
Since March 2023, amendments have expanded the grounds for data collection to include cases necessary for fulfilling contracts or implementing measures requested by data subjects during the contract formation process. The practical application of these changes continues to develop and adapt.
Taiwan
In Taiwan, where the Taiwanese government is in the process of forming the Personal Data Protection Commission, organisations must expressly inform data subjects when collecting personal data.
Organisations must detail the purposes of collection, types of data, usage scope (including duration, geography, territory, and methods), data subject rights, and consequences of non-disclosure, unless exempt by law. When collection involves planning for cross-border transfers, intended overseas jurisdictions should also be specified.
--
This article is part of a series by our Globalaw APAC Data Privacy & Protection Taskforce members.
Globalaw’s APAC Data Privacy & Protection Taskforce comprises 15 law firms in the Asia-Pacific region with specialized expertise in advising international companies on how to implement and manage a multijurisdictional data protection program.
Taskforce member firms combine a strategic, business-minded approach with cross-border collaboration to help clients build and maintain sophisticated and resilient data practices, effectively mitigate and respond to incidents, and provide sophisticated representation to resolve disputes or regulatory investigations.
Explore the Globalaw APAC Data Privacy & Protection Taskforce brochure for more information and regional contacts.
Disclaimer: The information provided in this article is for general informational purposes only and does not constitute legal advice. Information, including laws and statutes, cited are subject to change and is accurate as of 30 June 2025, but readers should verify such current status. We and our member firms shall not be held liable for any loss and/or damage incurred by any person acting as a result of the information contained in this article. Reliance on this content is at the reader’s own risk, and no attorney-client relationship is formed by reading or acting upon this article. Always seek professional legal counsel to ensure compliance with applicable laws and regulations.
