Data Breaches: Is Your Organisation Following Reporting Best Practices?
Every new and existing creation of personal data carries some risk of a possible data breach. Every organisation and data user must have clear policies and procedures for best practices in reporting data breaches and responding to data leakage incidents.
Different jurisdictions have their own criteria or laws governing how organisations should respond to data leak incidents. Most require data users to take all reasonable steps to protect personal data from unauthorized or accidental access, taking into consideration the type of data, potential harm from a breach, and measures to maintain the data's integrity for those who have access to it.
This article provides an overview of the criteria and laws applicable to jurisdictions within Globalaw’s Asia Pacific region, including Hong Kong, India, Japan, South Korea, and Taiwan.
Hong Kong
Business operators in Hong Kong are encouraged to voluntarily report data breaches in accordance with the best practices published by the Office of the Privacy Commissioner for Personal Data (PCPD).
Currently, there are no specific criminal penalties for data breaches, although civil liabilities may arise from breaches of contract, confidentiality, and negligence.
The newly enacted Protection of Critical Infrastructures (Computer Systems) Ordinance, expecting to take effect on 1 January 2026, will require the operators of crucial infrastructures in Hong Kong in eight industries — energy, information technology, banking and financial services, air transportation, land transportation, maritime transport, healthcare services, and telecommunications and broadcasting services — to implement security plans and protocols, and report on security incidents. Failure to comply will result in fines ranging from HK$500,000 to HK$5 million.
India
India’s forthcoming Digital Personal Data Protection Act (DPDPA) requires data breaches to be reported promptly to both the Data Protection Board of India and the data principal. If data fiduciaries fail to provide such notice, they could face severe penalties of up to approximately USD 24 million.
Japan
In the event of serious data security breaches in Japan, business operators are required to notify both the Personal Information Protection Commission (JPIPC) and data subjects. The Act on the Protection of Personal Information (APPI) imposes criminal penalties for various improper handling of personal data as well as failure to comply with the JPIPC rectification requests and orders.
South Korea
For any leak of sensitive personal data in South Korea, business operators must notify the Korean Personal Information Protection Commission and the affected data subjects within 72 hours of discovering the leak. Criminal penalties apply to intentional or severe negligence (such as illegal data sales or leaks), along with administrative fines, corrective orders, potential suspension of processing, and public disclosure.
Taiwan
In Taiwan, the Personal Data Protection Act (PDPA) currently requires organisations to notify affected individuals of data breaches only after the relevant facts have been verified. Criminal penalties are imposed for intentional misconduct, with a tiered system of administrative fines for other violations. Notably, proposed amendments to the PDPA announced in March 2025 include increased reporting requirements, and business operators should closely monitor these upcoming changes.
--
This article is part of a series by our Globalaw APAC Data Privacy & Protection Taskforce members.
Globalaw’s APAC Data Privacy & Protection Taskforce comprises 15 law firms in the Asia-Pacific region with specialized expertise in advising international companies on how to implement and manage a multijurisdictional data protection program. Taskforce member firms combine a strategic, business-minded approach with cross-border collaboration to help clients build and maintain sophisticated and resilient data practices, effectively mitigate and respond to incidents, and provide sophisticated representation to resolve disputes or regulatory investigations.
Explore the Globalaw APAC Data Privacy & Protection Taskforce brochure for more information and regional contacts.
Disclaimer: The information provided in this article is for general informational purposes only and does not constitute legal advice. Information, including laws and statutes, cited are subject to change and is accurate as of 30 June 2025, but readers should verify such current status. We and our member firms shall not be held liable for any loss and/or damage incurred by any person acting as a result of the information contained in this article. Reliance on this content is at the reader’s own risk, and no attorney-client relationship is formed by reading or acting upon this article. Always seek professional legal counsel to ensure compliance with applicable laws and regulations.
