November Recap

Data Processing Agreements ("DPAs") have become an increasingly important part of managing personal data processing arrangements, particularly when organisations engage third-party service providers to process personal data on their behalf. DPAs typically set out the scope and purpose of processing, the parties’ respective responsibilities, security and confidentiality obligations, and requirements for sub-processing, data breaches, and the return or deletion of personal data.

Requirements vary across jurisdictions. Some expressly require agreements between controllers and processors and prescribe specific terms; others rely more heavily on general data protection obligations and contractual practice. Multi-party arrangements and cross-border transfers are also treated differently. This article summarises the position in Hong Kong, Indonesia, India, Japan, South Korea, and Taiwan, presents them side by side, and closes with practical considerations for organisations operating across the region. With data protection enforcement intensifying across the Asia-Pacific region, understanding these jurisdiction-specific nuances is essential for businesses to manage legal risk and structure compliant cross-border arrangements.

Hong Kong

Hong Kong’s Personal Data (Privacy) Ordinance (Cap. 486, "PDPO") regulates "data users" rather than imposing a GDPR-style controller-processor regime. A processor acting solely on behalf of a data user is generally not treated as a separate category, but the data user remains responsible for compliance with respect to outsourced processing. Contractual control is therefore central. Data Protection Principles 2(3) and 4(2) require a data user engaging a processor, whether in Hong Kong or elsewhere, to adopt contractual or other measures to prevent excessive retention and unauthorised or accidental access, processing, erasure, loss, or use of the data. The Office of the Privacy Commissioner for Personal Data (“PCPD”) has issued practical guidance on what those measures should be. Its Guidance Note on Data Security Measures for Information and Communications Technology (August 2022) recommends that data users engage only competent and reliable processors, specify security requirements in the contract, require immediate notification of data security incidents, conduct audits, and impose consequences for breach of contract. Its guidance note on cloud computing (revised January 2025) adds that the contract should limit use of the data to the original collection purpose, extend the same protection to subcontractors, require timely breach notification, provide for erasure or return of the data on request or on termination, and not allow the provider to lower its standards unilaterally.

In the cross-border context, section 33 of the PDPO, which would regulate transfers of personal data outside Hong Kong, has not been brought into operation. Therefore, the PDPO imposes no specific restrictions on engaging a processor outside Hong Kong, and the general Data Protection Principles, including DPP 2(3) and DPP 4(2), continue to apply. The PCPD has nonetheless set out best practice in its Guidance on Recommended Model Contractual Clauses for Cross-border Transfer of Personal Data (May 2022), which includes clauses for transfers from a data user to a data processor covering use only for designated purposes, agreed security measures, erasure, and restrictions on onward transfer and sub-processing, and recommends adding reporting, audit, and breach notification terms. Since the PCPD treats their adoption as evidence of due diligence that will be considered in any suspected breach, data users are well advised to follow them when engaging processors outside Hong Kong.

India

India's Digital Personal Data Protection Act, 2023 (“DPDPA”) and Digital Personal Data Protection Rules, 2025 (“DPDPR”) (collectively, the “DPDP Framework”) impose primary compliance responsibility on the “Data Fiduciary” (the entity determining the purpose and means of personal data processing), making contractual arrangements with “Data Processors” essential for managing statutory liability. Section 8(2) of the DPDPA requires a Data Fiduciary to engage a Data Processor “only under a valid contract,” making formal DPAs mandatory for businesses operating in India.

In the interim period before the DPDP Framework becomes fully operational, such businesses should take proactive steps toward compliance, including executing appropriate DPAs. A robust DPA should mirror the Data Fiduciary’s obligations under the DPDP Framework, including reasonable security safeguards under Section 8(5) of the DPDPA read with Rule 6 of the DPDPR, sub‑processing arrangements, breach notification mechanisms, and obligations for erasure or return of personal data. Since Section 8(1) of the DPDPA makes the Data Fiduciary liable “irrespective of any agreement to the contrary,” an indemnity clause in the DPA is also essential. This is particularly important because substantial penalties (up to approximately USD 26.5 million) are prescribed under the DPDPA for failure to implement reasonable security safeguards, underscoring the need for strong contractual recourse against Data Processors (and sub‑processors) in the event of a breach.

Indonesia

Indonesia’s Personal Data Protection Law Regulations (Law No. 27 of 2022, "UU PDP," and its implementing regulation, Government Regulation No. 33 of 2026. “GR 33/2026”) require data processors to process personal data on the instructions of data controllers. The UU PDP does not set out every term of a controller-processor agreement, but the implementing regulation expressly requires processors to be appointed through an agreement. That agreement should cover the method and purpose of processing, the types of personal data, the processing period, the parties’ rights and obligations, and audit and inspection mechanisms. The regulation also distinguishes agreements involving processors, joint controllers, and cross-border transfers. In a joint-controller setting, it contemplates an agreement allocating the parties’ roles, responsibilities, and relationship. This is not just a drafting point: administrative fines under the UU PDP may reach up to 2% of annual revenue, depending on the violation.

Japan

Japan’s Act on the Protection of Personal Information (Act No. 57 of 2003, "APPI") does not define "processing" as a legal concept and does not adopt the controller-processor distinction. The analogous concept is "entrustment": causing another person to handle personal data, regardless of the form of contract. Entrustment is important because, within the necessary scope of the purpose of use, it is excluded from the ordinary consent requirement for third-party provision under Article 27(5)(i). A standalone DPA is not mandated, but Article 25 requires the entrusting party to exercise necessary and appropriate supervision over the entrusted party. In practice, this means selecting an appropriate vendor, agreeing on security controls, and maintaining a reasonable understanding of how the data is handled through audits or equivalent review. PPC guidance confirms that the agreement does not need a prescribed form, that an on-site audit clause is not mandatory if supervision is effective, and that supervision should be risk-based. A narrow cloud-services exception may apply where the provider is not contractually permitted or technically able to access or handle the relevant data, although cross-border rules may still need to be considered. Obligations currently rest mainly with the entrusting party, but a pending amendment bill would expressly restrict entrusted parties from handling data beyond the scope necessary to perform the entrusted services.

South Korea

South Korea’s Personal Information Protection Act ("PIPA") regulates DPAs through outsourcing. Article 26 requires a controller that outsources personal information processing to document the arrangement in writing and include specified safeguards. The clauses may be included in a broader services or outsourcing agreement, but should address the purpose and scope of processing, security and confidentiality, limits on sub-processing, supervision and audit rights, and responsibility for violations. The controller remains responsible for supervising processors, and a processor may not further outsource without the controller’s consent. Korea also has a practical disclosure requirement that is easy to miss: controllers must generally disclose outsourced activities and the identities of processors, including relevant sub-processors, in a manner accessible to data subjects. Processors also have direct obligations under PIPA and may be sanctioned even when acting on a controller’s instructions.

Taiwan

Taiwan’s Personal Data Protection Act ("PDPA") addresses these arrangements through commissioned processing. The PDPA distinguishes among the collection, processing, and use of personal data, and under Article 4, a commissioned party is treated as acting on behalf of the commissioning entity. Primary regulatory liability therefore remains with the commissioning entity. Unlike the GDPR, Taiwan’s PDPA neither recognizes the concept of joint controllership nor adopts a formal controller-processor distinction. Furthermore, Article 8 of the PDPA Enforcement Rules requires proper supervision of the commissioned entity. Accordingly, any agreement governing commissioned processing should extend beyond a short confidentiality clause. It should cover the purpose, categories, scope, and period of the engagement; processing within instructions; immediate notification if an instruction appears unlawful; regular inspections with documented findings; security measures under Article 12 of the Enforcement Rules; restrictions on sub-commissioning; breach protocols; and the return or deletion of data upon termination or cancellation. Enforcement and sector-specific security inspections have intensified since the Personal Data Protection Commission was established.

Comparison: What Should the Contract Deal With?

Practical Considerations

• Use a global template carefully. A GDPR Article 28-style agreement may be a useful starting point for multinational businesses, but it should not be used as a one-size-fits-all solution. Pair a regional template with short local schedules covering the points that matter in each jurisdiction.
• Use the local legal vocabulary. Calling everyone a "controller" or "processor" may be convenient, but it can be misleading in Japan, Taiwan, Korea and Hong Kong. The contract should make clear who gives instructions, who handles the data, who supervises, and who answers to individuals or regulators.
• Make supervision something you can prove. Vendor review should not exist only on paper. Depending on the risk, parties should use questionnaires, certifications, audit reports, regular review meetings, site visits or incident-led checks, and keep records of what was reviewed and what was fixed.
• Do not bury sub-processing in boilerplate. Korea requires controller consent for further outsourcing, Taiwan expects prior notice or approval controls for sub-commissioning, and Hong Kong requires contractual or other controls over processors. A standard "notify and object" clause should be checked against the strictest jurisdiction in scope.
• Plan the exit before signing the contract. Return, deletion and certification procedures are often treated as end-of-project details. Agree on them at the outset, especially where the vendor stores copies, backups, logs or physical media.

Given jurisdictional differences in data governance, multinational businesses operating across multiple markets across the APAC region would be well served by tailoring their DPAs to each jurisdiction’s applicable framework. If you have any queries regarding how jurisdictional requirements apply to your specific arrangements, we would be happy to offer a complimentary 30 (thirty) minute consultation to address them.

Download Article PDF ↓

--

Globalaw’s APAC Data Privacy & Protection Taskforce comprises 13 law firms in the Asia-Pacific region with specialized expertise in advising international companies on how to implement and manage a multijurisdictional data protection program.

Taskforce member firms combine a strategic, business-minded approach with cross-border collaboration to help clients build and maintain sophisticated and resilient data practices, effectively mitigate and respond to incidents, and provide sophisticated representation to resolve disputes or regulatory investigations.

Explore the Globalaw APAC Data Privacy & Protection Taskforce brochure for more information and regional contacts.

Disclaimer: The information provided in this article is for general informational purposes only and does not constitute legal advice. Information, including laws and statutes, cited is subject to change and is accurate as of 08 September 2026, but readers should verify its current status. We and our member firms shall not be held liable for any loss and/or damage incurred by any person acting as a result of the information contained in this article. Reliance on this content is at the reader’s own risk, and no attorney-client relationship is formed by reading or acting upon this article. Always seek professional legal counsel to ensure compliance with applicable laws and regulations.

For international businesses and investors looking at the United States, the 2026 real estate market offers both surprises and interesting opportunities.

Start with retail, perhaps the biggest surprise of all. Not long ago, conventional wisdom held that e-commerce and the pandemic might spell the end of the American shopping mall. Instead, their values increased approximately 13% over the past year, making malls the best-performing major commercial real estate sector.

Part of the explanation is simple: very little new retail has been built, and available “good” space is tight. But retail itself is also changing. Successful properties increasingly combine traditional stores with restaurants, grocery, fitness, entertainment, and services. Many mall properties are also becoming true mixed-use destinations, adding residential, office, and hospitality use to create “live, work, stay, play” environments. Younger Americans are contributing to the resurgence as well, with consumers ages 18 to 24 making a surprisingly large percentage of their purchases in “brick-and-mortar” stores.

Another interesting trend is “medtail”—the convergence of healthcare and retail real estate. Patients increasingly expect more immediate and convenient access to healthcare services, closer to where they live, work, and shop. In response, urgent care, primary care, imaging, physical therapy, and other outpatient services are opening in shopping centers and other retail locations. Healthcare providers gain visibility, parking, and convenient access to patients, while property owners gain service-oriented tenants that generate regular foot traffic. For healthcare companies, retailers, and investors considering U.S. expansion, that convergence presents interesting opportunities.

The office market is also showing opportunities to maximize investment. Remote work continues to reshape the market as corporations take different approaches to office space use and configurations, with many favoring newer, amenity-rich buildings. This creates opportunities to reposition and redevelop older properties. In many U.S. cities, obsolete office buildings are being renovated to provide the modern, flexible spaces tenants are seeking, while other office buildings are being converted to multifamily apartments. In addition to location and cost, residential conversions require a detailed review of zoning, lease restrictions, suitability of building floor plates and windows, life safety and building codes, and adaptability of existing plumbing and HVAC.

That leads directly to another key sector: housing. The United States remains significantly undersupplied, with zoning, entitlement delays, construction costs, and access to financing often dictating development. Increasingly, the availability of water and sewer is driving where, and whether, new housing projects can get off the ground. For international developers and investors, understanding and navigating local approvals and infrastructure constraints is critical.

Lastly, AI. Data centers have become one of America’s fastest-growing real estate sectors, but the critical constraint increasingly is not land, but electricity. Power availability, transmission capacity, water, and infrastructure are determining where major investments can occur. At the same time, data centers have become controversial in many states, as communities grapple with their enormous power demands, water use, environmental impacts, and effects on surrounding communities.

Key Takeaways

• Scarcity creates opportunity.
• Preserve flexibility—the best use of a property tomorrow may not be its use today. Entitlements create value.
• Infrastructure matters.
• Real estate is a long-term play.
• Access to capital is key.

For international companies entering or expanding in the United States, success requires understanding the real estate and the business, regulatory, and infrastructure environment surrounding it.

For more information, contact:

John H. Sokul Jr., Partner

Hinckley Allen

Hinckley Allen’s Real Estate attorneys work closely with the firm’s Retail, Construction, Corporate, and Healthcare practices to assist U.S. and international clients with acquisitions, development, leasing, land use, financing, and opportunities at the intersection of these industries.

Globalaw announces a new strategic relationship with MDD Forensic Accountants, a leading global forensic accounting firm, providing litigation support services and expert witness testimony in courts and arbitrations. Through this collaboration, Globalaw member firms gain exclusive access to complementary capabilities and expertise that enhance their services and help deliver better client outcomes.

“We are intentional about collaborating with trusted experts who share our commitment to high quality and exceptional service,” said Globalaw Executive Director Ángela López Molina. “With professionals in over 40 worldwide offices who speak over 30 languages, MDD’s expertise strengthens the support our member firms provide to their clients on a local and international basis.”

Strategic relationships reinforce Globalaw’s commitment to giving member firms a distinct competitive edge through access to the innovative tools, resources and technology associated with large global firms. Earlier this year, Globalaw formed a first-of-its-kind global collaboration with Legora, providing members with exclusive access to leading-edge AI solutions. The network also has a long-standing strategic relationship with the AESIS Network, an international network of insurance brokerage and consulting firms based in the Netherlands, with over 75 offices worldwide.

About Globalaw

Founded in 1994, Globalaw is a Band 1 Chambers-ranked global network of approximately 80 independent law firms and 4,000 lawyers in more than 60 countries. Our mission is to foster seamless legal collaboration among member firms and help them deliver high-quality, cost-effective solutions to clients worldwide. We take pride in our commitment to excellence, global reach and innovative approach to legal services. Visit www.globalaw.net to learn more.

Media Contact:

Jaime Luckey

marketing@globalaw.net

Globalaw is pleased to announce that its Indonesian member firm, Bagus Enrico & Partners, has entered into a Strategic Partnership Agreement with the Ministry of Youth and Sports of the Republic of Indonesia (Kemenpora RI).

"This is a significant milestone not only for Bagus Enrico & Partners but also for the broader development of sports law in Indonesia and the work of Globalaw's Sports Law Taskforce," said Jonathan Cheong, Co-Chairman of the Globalaw Sports Law Taskforce. "It creates a meaningful bridge between Indonesia's sporting institutions and the international legal community and provides an opportunity to further connect Indonesian sport with Globalaw's international network,"

Through Globalaw's international network of sports law practitioners, this partnership can help drive cross-border knowledge exchange, international collaboration, and access to specialised legal expertise, while bringing Indonesia's sporting opportunities and perspectives onto the global stage.

About the Globalaw Sports Law Taskforce

Globalaw’s Sports Law Taskforce is a dedicated advisory group offering specialized legal counsel and representation for athletes and stakeholders across all areas of sports law. From negotiating and drafting athlete contracts, sponsorship agreements, and marketing deals to providing expert counsel on intellectual property rights, endorsements, tax advice and dispute resolution, our cross-border advisory group is equipped to handle all legal aspects of the sports industry, ensuring that our clients receive top-tier support and protection in their careers and business ventures. Learn more about Globalaw's sports law capabilties.