Globalaw - Home
ContactMember Login
Our social network
Insights

Data Processing Agreements Across Asia Pacific: Divergent Rulebooks, One Practical Problem

By Globalaw APAC Data Privacy & Protection Taskforce, 21 Oct 2026

Data Processing Agreements ("DPAs") have become an increasingly important part of managing personal data processing arrangements, particularly when organisations engage third-party service providers to process personal data on their behalf. DPAs typically set out the scope and purpose of processing, the parties’ respective responsibilities, security and confidentiality obligations, and requirements for sub-processing, data breaches, and the return or deletion of personal data.

Requirements vary across jurisdictions. Some expressly require agreements between controllers and processors and prescribe specific terms; others rely more heavily on general data protection obligations and contractual practice. Multi-party arrangements and cross-border transfers are also treated differently. This article summarises the position in Hong Kong, Indonesia, India, Japan, South Korea, and Taiwan, presents them side by side, and closes with practical considerations for organisations operating across the region. With data protection enforcement intensifying across the Asia-Pacific region, understanding these jurisdiction-specific nuances is essential for businesses to manage legal risk and structure compliant cross-border arrangements.

Hong Kong

Hong Kong’s Personal Data (Privacy) Ordinance (Cap. 486, "PDPO") regulates "data users" rather than imposing a GDPR-style controller-processor regime. A processor acting solely on behalf of a data user is generally not treated as a separate category, but the data user remains responsible for compliance with respect to outsourced processing. Contractual control is therefore central. Data Protection Principles 2(3) and 4(2) require a data user engaging a processor, whether in Hong Kong or elsewhere, to adopt contractual or other measures to prevent excessive retention and unauthorised or accidental access, processing, erasure, loss, or use of the data. The Office of the Privacy Commissioner for Personal Data (“PCPD”) has issued practical guidance on what those measures should be. Its Guidance Note on Data Security Measures for Information and Communications Technology (August 2022) recommends that data users engage only competent and reliable processors, specify security requirements in the contract, require immediate notification of data security incidents, conduct audits, and impose consequences for breach of contract. Its guidance note on cloud computing (revised January 2025) adds that the contract should limit use of the data to the original collection purpose, extend the same protection to subcontractors, require timely breach notification, provide for erasure or return of the data on request or on termination, and not allow the provider to lower its standards unilaterally.

In the cross-border context, section 33 of the PDPO, which would regulate transfers of personal data outside Hong Kong, has not been brought into operation. Therefore, the PDPO imposes no specific restrictions on engaging a processor outside Hong Kong, and the general Data Protection Principles, including DPP 2(3) and DPP 4(2), continue to apply. The PCPD has nonetheless set out best practice in its Guidance on Recommended Model Contractual Clauses for Cross-border Transfer of Personal Data (May 2022), which includes clauses for transfers from a data user to a data processor covering use only for designated purposes, agreed security measures, erasure, and restrictions on onward transfer and sub-processing, and recommends adding reporting, audit, and breach notification terms. Since the PCPD treats their adoption as evidence of due diligence that will be considered in any suspected breach, data users are well advised to follow them when engaging processors outside Hong Kong.

India

India's Digital Personal Data Protection Act, 2023 (“DPDPA”) and Digital Personal Data Protection Rules, 2025 (“DPDPR”) (collectively, the “DPDP Framework”) impose primary compliance responsibility on the “Data Fiduciary” (the entity determining the purpose and means of personal data processing), making contractual arrangements with “Data Processors” essential for managing statutory liability. Section 8(2) of the DPDPA requires a Data Fiduciary to engage a Data Processor “only under a valid contract,” making formal DPAs mandatory for businesses operating in India.

In the interim period before the DPDP Framework becomes fully operational, such businesses should take proactive steps toward compliance, including executing appropriate DPAs. A robust DPA should mirror the Data Fiduciary’s obligations under the DPDP Framework, including reasonable security safeguards under Section 8(5) of the DPDPA read with Rule 6 of the DPDPR, sub‑processing arrangements, breach notification mechanisms, and obligations for erasure or return of personal data. Since Section 8(1) of the DPDPA makes the Data Fiduciary liable “irrespective of any agreement to the contrary,” an indemnity clause in the DPA is also essential. This is particularly important because substantial penalties (up to approximately USD 26.5 million) are prescribed under the DPDPA for failure to implement reasonable security safeguards, underscoring the need for strong contractual recourse against Data Processors (and sub‑processors) in the event of a breach.

Indonesia

Indonesia’s Personal Data Protection Law Regulations (Law No. 27 of 2022, "UU PDP," and its implementing regulation, Government Regulation No. 33 of 2026. “GR 33/2026”) require data processors to process personal data on the instructions of data controllers. The UU PDP does not set out every term of a controller-processor agreement, but the implementing regulation expressly requires processors to be appointed through an agreement. That agreement should cover the method and purpose of processing, the types of personal data, the processing period, the parties’ rights and obligations, and audit and inspection mechanisms. The regulation also distinguishes agreements involving processors, joint controllers, and cross-border transfers. In a joint-controller setting, it contemplates an agreement allocating the parties’ roles, responsibilities, and relationship. This is not just a drafting point: administrative fines under the UU PDP may reach up to 2% of annual revenue, depending on the violation.

Japan

Japan’s Act on the Protection of Personal Information (Act No. 57 of 2003, "APPI") does not define "processing" as a legal concept and does not adopt the controller-processor distinction. The analogous concept is "entrustment": causing another person to handle personal data, regardless of the form of contract. Entrustment is important because, within the necessary scope of the purpose of use, it is excluded from the ordinary consent requirement for third-party provision under Article 27(5)(i). A standalone DPA is not mandated, but Article 25 requires the entrusting party to exercise necessary and appropriate supervision over the entrusted party. In practice, this means selecting an appropriate vendor, agreeing on security controls, and maintaining a reasonable understanding of how the data is handled through audits or equivalent review. PPC guidance confirms that the agreement does not need a prescribed form, that an on-site audit clause is not mandatory if supervision is effective, and that supervision should be risk-based. A narrow cloud-services exception may apply where the provider is not contractually permitted or technically able to access or handle the relevant data, although cross-border rules may still need to be considered. Obligations currently rest mainly with the entrusting party, but a pending amendment bill would expressly restrict entrusted parties from handling data beyond the scope necessary to perform the entrusted services.

South Korea

South Korea’s Personal Information Protection Act ("PIPA") regulates DPAs through outsourcing. Article 26 requires a controller that outsources personal information processing to document the arrangement in writing and include specified safeguards. The clauses may be included in a broader services or outsourcing agreement, but should address the purpose and scope of processing, security and confidentiality, limits on sub-processing, supervision and audit rights, and responsibility for violations. The controller remains responsible for supervising processors, and a processor may not further outsource without the controller’s consent. Korea also has a practical disclosure requirement that is easy to miss: controllers must generally disclose outsourced activities and the identities of processors, including relevant sub-processors, in a manner accessible to data subjects. Processors also have direct obligations under PIPA and may be sanctioned even when acting on a controller’s instructions.

Taiwan

Taiwan’s Personal Data Protection Act ("PDPA") addresses these arrangements through commissioned processing. The PDPA distinguishes among the collection, processing, and use of personal data, and under Article 4, a commissioned party is treated as acting on behalf of the commissioning entity. Primary regulatory liability therefore remains with the commissioning entity. Unlike the GDPR, Taiwan’s PDPA neither recognizes the concept of joint controllership nor adopts a formal controller-processor distinction. Furthermore, Article 8 of the PDPA Enforcement Rules requires proper supervision of the commissioned entity. Accordingly, any agreement governing commissioned processing should extend beyond a short confidentiality clause. It should cover the purpose, categories, scope, and period of the engagement; processing within instructions; immediate notification if an instruction appears unlawful; regular inspections with documented findings; security measures under Article 12 of the Enforcement Rules; restrictions on sub-commissioning; breach protocols; and the return or deletion of data upon termination or cancellation. Enforcement and sector-specific security inspections have intensified since the Personal Data Protection Commission was established.

Comparison: What Should the Contract Deal With?

Image

Practical Considerations

  • Use a global template carefully. A GDPR Article 28-style agreement may be a useful starting point for multinational businesses, but it should not be used as a one-size-fits-all solution. Pair a regional template with short local schedules covering the points that matter in each jurisdiction.
  • Use the local legal vocabulary. Calling everyone a "controller" or "processor" may be convenient, but it can be misleading in Japan, Taiwan, Korea and Hong Kong. The contract should make clear who gives instructions, who handles the data, who supervises, and who answers to individuals or regulators.
  • Make supervision something you can prove. Vendor review should not exist only on paper. Depending on the risk, parties should use questionnaires, certifications, audit reports, regular review meetings, site visits or incident-led checks, and keep records of what was reviewed and what was fixed.
  • Do not bury sub-processing in boilerplate. Korea requires controller consent for further outsourcing, Taiwan expects prior notice or approval controls for sub-commissioning, and Hong Kong requires contractual or other controls over processors. A standard "notify and object" clause should be checked against the strictest jurisdiction in scope.
  • Plan the exit before signing the contract. Return, deletion and certification procedures are often treated as end-of-project details. Agree on them at the outset, especially where the vendor stores copies, backups, logs or physical media.

Given jurisdictional differences in data governance, multinational businesses operating across multiple markets across the APAC region would be well served by tailoring their DPAs to each jurisdiction’s applicable framework. If you have any queries regarding how jurisdictional requirements apply to your specific arrangements, we would be happy to offer a complimentary 30 (thirty) minute consultation to address them.

--

Globalaw’s APAC Data Privacy & Protection Taskforce comprises 13 law firms in the Asia-Pacific region with specialized expertise in advising international companies on how to implement and manage a multijurisdictional data protection program.

Taskforce member firms combine a strategic, business-minded approach with cross-border collaboration to help clients build and maintain sophisticated and resilient data practices, effectively mitigate and respond to incidents, and provide sophisticated representation to resolve disputes or regulatory investigations.

Explore the Globalaw APAC Data Privacy & Protection Taskforce brochure for more information and regional contacts.

Disclaimer: The information provided in this article is for general informational purposes only and does not constitute legal advice. Information, including laws and statutes, cited is subject to change and is accurate as of 08 September 2026, but readers should verify its current status. We and our member firms shall not be held liable for any loss and/or damage incurred by any person acting as a result of the information contained in this article. Reliance on this content is at the reader’s own risk, and no attorney-client relationship is formed by reading or acting upon this article. Always seek professional legal counsel to ensure compliance with applicable laws and regulations.

Latest News

Insights
25 Sep 2026

What Goes Around, Comes Around: Where We See Opportunity in U.S. Real Estate

For international businesses and investors looking at the United States, the 2026 real estate market offers both surprises and interesting opportunities.

Start with retail, perhaps the biggest surprise of all. Not long ago, conventional wisdom held that e-commerce and the pandemic might spell the end of the American shopping mall. Instead, their values increased approximately 13% over the past year, making malls the best-performing major commercial real estate sector.

Part of the explanation is simple: very little new retail has been built, and available “good” space is tight. But retail itself is also changing. Successful properties increasingly combine traditional stores with restaurants, grocery, fitness, entertainment, and services. Many mall properties are also becoming true mixed-use destinations, adding residential, office, and hospitality use to create “live, work, stay, play” environments. Younger Americans are contributing to the resurgence as well, with consumers ages 18 to 24 making a surprisingly large percentage of their purchases in “brick-and-mortar” stores.

Another interesting trend is “medtail”—the convergence of healthcare and retail real estate. Patients increasingly expect more immediate and convenient access to healthcare services, closer to where they live, work, and shop. In response, urgent care, primary care, imaging, physical therapy, and other outpatient services are opening in shopping centers and other retail locations. Healthcare providers gain visibility, parking, and convenient access to patients, while property owners gain service-oriented tenants that generate regular foot traffic. For healthcare companies, retailers, and investors considering U.S. expansion, that convergence presents interesting opportunities.

The office market is also showing opportunities to maximize investment. Remote work continues to reshape the market as corporations take different approaches to office space use and configurations, with many favoring newer, amenity-rich buildings. This creates opportunities to reposition and redevelop older properties. In many U.S. cities, obsolete office buildings are being renovated to provide the modern, flexible spaces tenants are seeking, while other office buildings are being converted to multifamily apartments. In addition to location and cost, residential conversions require a detailed review of zoning, lease restrictions, suitability of building floor plates and windows, life safety and building codes, and adaptability of existing plumbing and HVAC.

That leads directly to another key sector: housing. The United States remains significantly undersupplied, with zoning, entitlement delays, construction costs, and access to financing often dictating development. Increasingly, the availability of water and sewer is driving where, and whether, new housing projects can get off the ground. For international developers and investors, understanding and navigating local approvals and infrastructure constraints is critical.

Lastly, AI. Data centers have become one of America’s fastest-growing real estate sectors, but the critical constraint increasingly is not land, but electricity. Power availability, transmission capacity, water, and infrastructure are determining where major investments can occur. At the same time, data centers have become controversial in many states, as communities grapple with their enormous power demands, water use, environmental impacts, and effects on surrounding communities.

Key Takeaways

  • Scarcity creates opportunity.
  • Preserve flexibility—the best use of a property tomorrow may not be its use today. Entitlements create value.
  • Infrastructure matters.
  • Real estate is a long-term play.
  • Access to capital is key.

For international companies entering or expanding in the United States, success requires understanding the real estate and the business, regulatory, and infrastructure environment surrounding it.

For more information, contact:

Image

John H. Sokul Jr., Partner

Hinckley Allen

Hinckley Allen’s Real Estate attorneys work closely with the firm’s Retail, Construction, Corporate, and Healthcare practices to assist U.S. and international clients with acquisitions, development, leasing, land use, financing, and opportunities at the intersection of these industries.

news
23 Sep 2026

Globalaw Announces Strategic Relationship with MDD Forensic Accountants

Globalaw announces a new strategic relationship with MDD Forensic Accountants, a leading global forensic accounting firm, providing litigation support services and expert witness testimony in courts and arbitrations. Through this collaboration, Globalaw member firms gain exclusive access to complementary capabilities and expertise that enhance their services and help deliver better client outcomes.

“We are intentional about collaborating with trusted experts who share our commitment to high quality and exceptional service,” said Globalaw Executive Director Ángela López Molina. “With professionals in over 40 worldwide offices who speak over 30 languages, MDD’s expertise strengthens the support our member firms provide to their clients on a local and international basis.”

Strategic relationships reinforce Globalaw’s commitment to giving member firms a distinct competitive edge through access to the innovative tools, resources and technology associated with large global firms. Earlier this year, Globalaw formed a first-of-its-kind global collaboration with Legora, providing members with exclusive access to leading-edge AI solutions. The network also has a long-standing strategic relationship with the AESIS Network, an international network of insurance brokerage and consulting firms based in the Netherlands, with over 75 offices worldwide.

About Globalaw

Founded in 1994, Globalaw is a Band 1 Chambers-ranked global network of approximately 80 independent law firms and 4,000 lawyers in more than 60 countries. Our mission is to foster seamless legal collaboration among member firms and help them deliver high-quality, cost-effective solutions to clients worldwide. We take pride in our commitment to excellence, global reach and innovative approach to legal services. Visit www.globalaw.net to learn more.

Media Contact:

Jaime Luckey

marketing@globalaw.net

news
13 Aug 2026

Indonesian Member Firm Enters Strategic Agreement with Ministry of Youth & Sports

Globalaw is pleased to announce that its Indonesian member firm, Bagus Enrico & Partners, has entered into a Strategic Partnership Agreement with the Ministry of Youth and Sports of the Republic of Indonesia (Kemenpora RI).

"This is a significant milestone not only for Bagus Enrico & Partners but also for the broader development of sports law in Indonesia and the work of Globalaw's Sports Law Taskforce," said Jonathan Cheong, Co-Chairman of the Globalaw Sports Law Taskforce. "It creates a meaningful bridge between Indonesia's sporting institutions and the international legal community and provides an opportunity to further connect Indonesian sport with Globalaw's international network,"

Through Globalaw's international network of sports law practitioners, this partnership can help drive cross-border knowledge exchange, international collaboration, and access to specialised legal expertise, while bringing Indonesia's sporting opportunities and perspectives onto the global stage.

About the Globalaw Sports Law Taskforce

Globalaw’s Sports Law Taskforce is a dedicated advisory group offering specialized legal counsel and representation for athletes and stakeholders across all areas of sports law. From negotiating and drafting athlete contracts, sponsorship agreements, and marketing deals to providing expert counsel on intellectual property rights, endorsements, tax advice and dispute resolution, our cross-border advisory group is equipped to handle all legal aspects of the sports industry, ensuring that our clients receive top-tier support and protection in their careers and business ventures. Learn more about Globalaw's sports law capabilties.

Insights
07 Aug 2026

Tax Disputes in Italy: A Guide

This summary outlines how tax disputes arise and proceed in Italy, covering the self-assessment system and taxpayer registration, how the tax authority reviews and challenges returns, the treatment of tax fraud, the conduct of audits, options for resolving disputes before litigation, the appeal process through the tax courts, and the penalties and areas of dispute taxpayers are most likely to encounter.

Tax Registration

In Italy, every individual and legal entity receives a tax identification number. Legal entities and partnerships are always assigned a VAT number, while individuals receive one only if they engage in business or self-employment activities, not for salaried employment. Once a taxpayer holds a VAT number, the tax authority is fully aware of that person's existence and economic activity.

Self-Assessment and Amending Returns

The Italian system operates on self-assessment: taxpayers prepare and file their own annual returns, and the tax authority has five years from the following year to review the return and challenge any errors or omissions. A late challenge is null and void, though the taxpayer must still formally seek its annulment through an administrative appeal or legal action.

Returns may be amended to report higher income at any time before an assessment notice is served, substantially reducing potential penalties, or amended to report lower income, subject to specific time limits.

Assessment Notices and Time Limits

The tax authority must issue a reasoned assessment notice that sets out the factual and legal grounds for the challenge, which provision was violated and why, and separately justify any related penalties. In principle, notices must be issued within five years of the filing year (a 2025 return can be assessed until December 31, 2031).

Notices issued later can still be challenged: the taxpayer files a self-protection request for annulment and, failing that, a formal appeal within 60 days, citing the expiration of the deadline.

Tax Fraud

Tax fraud is a criminal, not an administrative, matter, defined by two articles of criminal tax law that cover the use of false invoices (documents recording costs for services never rendered) and other deceptive practices intended to mislead the authorities. It is punished severely, and if charges are filed, the deadlines for serving assessment notices are doubled. It is particularly relevant internationally—for instance, regarding management fees, where Italian companies can struggle to obtain precise supporting documentation for intercompany services. Fraud investigations are conducted by the local public prosecutor, assisted by the Guardia di Finanza under the Code of Criminal Procedure, and may involve restrictions on personal liberty and the seizure of assets. Tax and criminal proceedings run in parallel and both require careful handling

Audit Conduct and Standards

There is no formal code of conduct for audits beyond a general duty of fair cooperation. The Guardia di Finanza has issued a manual outlining audit procedures, and taxpayer rights are set out in the Taxpayer's Charter. Audit reports must invite the taxpayer to provide documentation, note the right to be assisted by a tax lawyer or Chartered Accountant, and state that withheld documentation cannot later be used in court. Audits now typically focus on three main risk areas for multinationals: transfer pricing, interest/dividend/royalty payments and beneficial ownership, and intercompany services.

During audits, inspectors may request any relevant documents, including those from foreign subsidiaries via international information exchange; a refusal generally bars later use of those documents in court. Requests to third parties to cross-check data (e.g., verifying that invoices were recorded by the issuer) are also routinely permitted.

Pre-Litigation Settlement Options

Before litigation, taxpayers have three main options: accept the audit report and pay in full to secure a significant penalty reduction; take voluntary corrective action on specific issues; or negotiate a settlement with the tax authority ("accertamento con adesione"). If none of these options succeed, the only remaining route is the courts, where judicial settlement may still be attempted. The audit relationship is governed by the Taxpayer's Bill of Rights; taxpayers should always respond carefully and in writing. Auditors may remain on the taxpayer's premises for up to 30 days (extendable to 60), though in practice the overall audit, including off-site document review, often takes three to four months.

The Appeal Process

A taxpayer has 60 days from the date of service of an assessment notice to appeal, first to the Revenue Agency that issued it and then, within 30 days, to the Tax Court of First Instance. The appeal must include all arguments at the outset, as further objections cannot be added later. First-instance hearings in Milan take about nine months; the losing party may then appeal to the Second-Instance Tax Court and, finally, to the Court of Cassation, which reviews only legal principles and the soundness of reasoning.

The Tax Court is an independent judicial body covering all tax and related charges. Hearings and judgments are public, and Court of Cassation decisions are published on its website. The procedure is mainly written, with only brief oral argument; the appeal must concisely set out procedural and substantive objections, which may later be clarified—but not expanded—in further briefs. Written documentary evidence is admissible; witness testimony is not generally central, though it can matter in specific disputes, such as demonstrating non-payment.

Burden of Proof

On the burden of proof: the tax authority must justify its challenge in detail (e.g., explaining why an expense should not be considered business-related), while the taxpayer must substantiate the item's legitimacy and show that the authority's findings are unreasonable; the authority cannot rely on generic, unsupported challenges.

Duration and Payment Obligations

Proceedings can be lengthy—up to about 12 years from assessment to a Court of Cassation decision in complex cases. Upon assessment, taxpayers must pay one-third of the additional tax claimed; a stay of payment is possible but difficult to obtain, requiring both urgency (periculum in mora) and a reasonable likelihood of success (fumus boni iuris), and is particularly hard to secure for large corporations, banks, or insurers.

Representation, Costs, and Alternative Dispute Resolution

Representation before the first two levels of the tax courts must be by qualified professionals, and for cassation proceedings, by an attorney qualified before the Court of Cassation. It is advisable to use a Chartered Accountant and a tax lawyer together. The losing party generally bears the costs of the proceedings. There are two levels of tax adjudication before the Court of Cassation.

For international disputes, particularly transfer pricing, arbitration (conventional or EU) is available to avoid double taxation. Purely domestic disputes have no alternative to litigation apart from mechanisms like "accertamento con adesione."

Penalties

Penalties for additional assessed tax are generally 70% of the tax due, plus interest. Penalties may be mitigated or waived in cases of objective legal uncertainty, assessed on a case-by-case basis; for transfer pricing specifically, penalties can be avoided by preparing appropriate documentation in advance.

Outlook

Looking ahead, the main areas expected to generate disputes are tax avoidance (abuse of right), transfer pricing, and beneficial ownership. No single area is seen as uniquely difficult, though the relationship with tax authorities remains complex: local offices are sometimes aggressive, rely on one-sided ministerial circular interpretations while disregarding contrary case law, and case law itself is not always fully consistent.

For more information, contact:

Image

Paolo Comuzzi, Partner

Lawal Legal & Tax Advisory