--- title: "Asia-Pacific bloc Data Protection & Privacy Regulation | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/asia-pacific-bloc/ source_html: /jurisdictions/asia-pacific-bloc/index.html description: "Asia-Pacific bloc data protection and privacy regulation: 10 categories, 44 claims, updated 2026-11-04." generated_at: 2026-11-07T14:58:19Z content_sha256: d9770872a445d423639442f4ab408a21ae766610c94a3d9f40a065fac182d2d4 generator: "fe-fleet/md-twin@1.0" --- # Asia-Pacific bloc Data Protection & Privacy Regulation schema gdpri-v2 trajectory: not yet assessed unregulated gap overlaps: [Sentinel (AML/CFT)](https://sentinel.gi/jurisdictions/asia-pacific-bloc/), [World Payments](https://payments.gi/jurisdictions/asia-pacific-bloc/), artificial-intelligence Last updated 2026-11-04 · 10 categories · 44 claims · 26 sources in the cumulative register Download report (PDF) Expand all The Global CBPR Forum is understood to now count ten full Members, following the admission of the Dubai International Financial Centre (DIFC) as its first Member from outside the Asia-Pacific region on 24 October 2025, with Associates including Bermuda, Mauritius, and the United Kingdom. Data collected 2026-11-01 · Data published 2026-11-04 AI-assembled from cited sources Not covered: AdTech & Commercial Privacy, Children & Vulnerable Groups. Not fully checked this cycle: Cross-Border & Adequacy (2 open gaps). Evidence re-verified: 2026-11-04 · Position last changed: 2026-11-04 · Record history & provenance ▾ Methodology & record provenance: Module confidence is derived from the underlying claims (source tier and primary excerpt retention), while statutory legal force is tracked independently. Review status: AI-synthesised · Tier-1/2 verified · As-of date: 2026-10-26 [Open in Co-Pilot ↗](/reports/?type=copilot&j=ASIA-PACIFIC-BLOC)[Build Report](/reports/?j=ASIA-PACIFIC-BLOC)[Compare](/compare/?j=ASIA-PACIFIC-BLOC) Framework posture Unregulated gap 8 of 10 modules populated · AI-synthesised · Tier-1/2 verified Lead supervisory authority Global CBPR Forum — Global Forum Assembly (governance body; not a statutory regulator Primary statutory & supervisory perimeter Next milestone (> 2026-10-26) None scheduled No dated future statutory milestone on record Module coverage & confidence 8 / 10 modules assessed 0 Confirmed · 8 Probable · 0 Uncertain · 2 Not yet assessed 10 Categories 5 Red categories 57 Sub-modules 44 Claims 15 Tier-1 sources Traffic-light mix 5 red 3 amber 2 n/a (sums to 10 rendered categories; click to filter) 5 categories flagged red ## Jurisdiction brief Jurisdiction lead brief 1,221 Full executive summary 698 Jurisdiction sub-brief 2 154 ###### Latest update · 4 November 2026 #### Lead Signal The most consequential cross-border development touching Asia-Pacific this period is the ASEAN Digital Economy Framework Agreement (DEFA), which is understood to be targeted for signature at the 49th ASEAN Summit on 16-18 November 2026, having concluded negotiations on 29 May 2026. DEFA includes provisions on cross-border data flows among ASEAN's ten member states. It is worth being precise about scope: ASEAN's ten members are a subset of the broader Asia-Pacific grouping, so even if signed as targeted, DEFA will not create a single bloc-wide data-protection or data-flow regime across Asia-Pacific as a whole. It would, however, be the most consequential supranational instrument touching cross-border data flows that the ASEAN sub-region has produced to date. #### Other Developments Context for this pending instrument comes from the existing architecture of voluntary, non-binding cross-border mechanisms already in use across ASEAN. The ASEAN Framework on Personal Data Protection (2016) and the ASEAN Model Contractual Clauses (2021) are understood to loosely coordinate national data-protection regimes among the ten ASEAN member states without creating enforceable obligations of their own. At the 2026 ASEAN Digital Ministers' Meeting, the ASEAN Working Group on Digital Data Governance is reported to have reaffirmed continued promotion of the Model Contractual Clauses alongside continued operationalisation of the Global Cross-Border Privacy Rules system, a separate multilateral certification mechanism. None of this activity amounts to a new binding instrument; it is a reaffirmation of existing voluntary tools rather than a change in enforceable obligations. #### Cross-Monitor Connections The same ASEAN DEFA signing target and the Global Cross-Border Privacy Rules operationalisation also carry a digital-payments-harmonisation dimension that is being tracked on the world-payments monitor, where the instrument's relevance lies in payment-corridor and cross-border-payments terms rather than in data-protection obligations. Readers following the commercial and payments dimension of this same agreement should refer there; this brief addresses only the cross-border data-flow and data-protection-adjacent provisions. #### Outlook The near-term marker to watch is whether DEFA is in fact signed at the 49th ASEAN Summit in November 2026 as currently targeted, and whether its final text — after legal scrubbing — preserves the cross-border data-flow provisions as negotiated in May 2026. Until signature, and for some period after, the practical cross-border transfer architecture for the region will continue to rest on the existing voluntary mechanisms: the ASEAN Framework on Personal Data Protection, the ASEAN Model Contractual Clauses, and the Global Cross-Border Privacy Rules system. None of these functions as a bloc-wide regulator or creates a single enforceable standard across Asia-Pacific, and that structural gap is expected to persist even if DEFA is signed on schedule, given its membership is confined to the ASEAN sub-region. 4 earlier updates not shown here. ###### Standing brief · as of 17 August 2026 Written before the update above. Where they differ, the update is the more recent position. #### Lead Signal The Global CBPR Forum is understood to now count ten full Members, following the admission of the Dubai International Financial Centre (DIFC) as its first Member from outside the Asia-Pacific region on 24 October 2025, with Associates including Bermuda, Mauritius, and the United Kingdom. The Forum has also welcomed Nigeria as an Associate, effective 19 September 2025, furthering what it describes as its objective of international collaboration on privacy and data flows. The Global CBPR Forum itself was established in 2022 by Australia, Canada, Japan, the Republic of Korea, Mexico, the Philippines, Singapore, Chinese Taipei and the United States as successor to the APEC CBPR System. This cycle's research run applied a challenger-fold correction to the membership figure after identifying that a previously reported nine-member roster reflected a stale mid-2025 snapshot, since superseded by DIFC's admission. #### Other Developments Across the wider APAC bloc, oversight of data protection remains fragmented across national data-protection authorities, coordinated only through two parallel, non-converging voluntary mechanisms: the Global CBPR Forum and the ASEAN Framework on Personal Data Protection. The ASEAN Framework, adopted 25 November 2016, creates no legally binding obligations on ASEAN member states. A third mechanism, the Global Cooperation Arrangement for Privacy Enforcement (CAPE), established in October 2023, facilitates cross-border cooperation between privacy enforcement authorities, including joint investigations and enforcement actions. CAPE nonetheless operates as a voluntary cooperation arrangement rather than a bloc-level statutory penalty power. At its Spring 2026 workshop, held 24-26 March 2026 and hosted jointly by Peru's Ministry of Foreign Trade and Tourism and the U.S. Department of State, the Global CBPR Forum welcomed government representatives from eighteen jurisdictions across Africa, the Americas, Asia, Europe and the Middle East. The workshop's agenda included discussion of artificial intelligence and privacy-enhancing technologies, without adopting a binding bloc-level AI-risk-assessment requirement. The Forum is also understood to have updated its Global CBPR System Program Requirements, expanding from 50 Program Requirements. It has published its third Annual Report, covering April 2025 to April 2026, and endorsed its 2026/2027 Annual Work Program. Beneath these umbrella mechanisms, the Global CBPR Framework establishes only voluntary privacy principles based on the APEC Privacy Framework and consistent with OECD Guidelines, rather than an enumerated statutory lawful-basis regime. Certification applicants under the Global CBPR and Global PRP systems must have their data-protection policies and practices verified by a third-party Accountability Agent as a condition of certification, in place of any government registration or filing obligation. The ASEAN Model Contractual Clauses, finalised in January 2021, provide distinct modules for controller-to-processor and controller-to-controller cross-border data transfers and set out baseline security measures for transferring parties. ASEAN's implementing guidance notes continuing divergence among member states on data-breach-notification requirements and recommends that member states apply sector-specific rules, such as in the financial sector, where these differ from the baseline clauses. On cross-border transfers, the Global CBPR System is designed to ensure that certified companies' cross-border personal-information transfers are protected to Global CBPR Framework standards, while the ASEAN Model Contractual Clauses serve as an interoperable contractual template for the same purpose. A 2023 Joint Guide reinforces interoperability between the ASEAN clauses and the European Union's Standard Contractual Clauses. The Global CBPR Forum states its objective as facilitating data protection and the free flow of data globally, rather than mandating data localisation. #### Cross-Monitor Connections The ASEAN implementing guidelines' recommendation that member states apply sector-specific financial requirements over baseline contractual clauses, together with CAPE's cross-border enforcement cooperation, may intersect with anti-money-laundering and financial-crime data-sharing regimes tracked by the financial-integrity monitor. Separately, the Global CBPR and ASEAN cross-border transfer mechanisms that underpin APAC payments-data flows warrant assessment by the world-payments monitor for payments-specific transfer and localisation nuances. The Spring 2026 workshop's discussion of artificial intelligence and privacy-enhancing technologies, without a binding outcome, is flagged for the artificial-intelligence monitor to track for any future bloc-level AI-privacy convergence. #### Outlook Bloc-level enforcement exposure in APAC remains a national-jurisdiction question rather than a bloc-level one: CAPE's cooperation mechanism and certification decertification are the only sanctions available at bloc level, with no statutory penalty regime, collective redress mechanism, or private right of action identified. The Global CBPR Forum's territorial reach, now extending beyond the Asia-Pacific through DIFC and Nigeria, points toward the scheme's possible evolution into a broader global cross-border-privacy interoperability standard, though this reading remains preliminary. Watch for further non-APEC accessions to the Global CBPR Forum and any sign of movement toward binding bloc-wide convergence between the Global CBPR and ASEAN mechanisms, which continue to coexist without converging into a single enforceable framework. Read full brief · 1221 words ###### Latest update · 4 November 2026 #### Regulatory Status Asia-Pacific has no bloc-wide data-protection regulator, lawful-basis regime, data-subject-rights framework, controller or processor duty set, or enforcement mechanism; these matters continue to be set entirely at the national level across the region's jurisdictions. The one area of active movement at supranational level concerns cross-border data flows within the ASEAN sub-region. The ASEAN Digital Economy Framework Agreement (DEFA), which concluded negotiations on 29 May 2026 and includes provisions on cross-border data flows among ASEAN's ten member states, is understood to be targeted for signature at the 49th ASEAN Summit on 16-18 November 2026. Because ASEAN's ten members form only a subset of the wider Asia-Pacific grouping, DEFA would not, even if signed as targeted, create a single data-protection or data-flow regime spanning the bloc as a whole. Pending that signature, the practical cross-border transfer architecture across the ASEAN portion of the region continues to rest on voluntary, non-binding mechanisms: the ASEAN Framework on Personal Data Protection (2016) and the ASEAN Model Contractual Clauses (2021), alongside the separately-administered Global Cross-Border Privacy Rules system. At the 2026 ASEAN Digital Ministers' Meeting, the ASEAN Working Group on Digital Data Governance is reported to have reaffirmed continued promotion of the Model Contractual Clauses and continued operationalisation of the Global Cross-Border Privacy Rules system - a reaffirmation of existing tools rather than a new binding instrument. #### Outlook The period ahead turns on whether DEFA is signed as targeted at the 49th ASEAN Summit in November 2026, and whether the signed text retains the cross-border data-flow provisions as negotiated in May 2026. Even on a successful signature, the instrument's effect would be confined to ASEAN's ten member states rather than the Asia-Pacific bloc as a whole, leaving the broader region reliant on the existing voluntary mechanisms and on national-level regimes for the foreseeable future. ###### Standing brief · as of 17 August 2026 #### Regulatory Status APAC has no single unified data-protection regulator: national data-protection authorities remain the substantive enforcers, while two parallel, non-converging voluntary mechanisms — the Global CBPR Forum and the ASEAN Framework on Personal Data Protection — coordinate cross-border cooperation without creating bloc-wide binding law. The ASEAN Framework, adopted 25 November 2016, creates no legally binding obligations on its ten member states. The Global CBPR Forum is understood to have grown to ten full Members with the admission of the Dubai International Financial Centre on 24 October 2025 — its first Member from outside APEC — alongside Associates including Nigeria, which joined 19 September 2025. Beneath these mechanisms, lawful processing rests on voluntary APEC- and OECD-derived privacy principles rather than an enumerated statutory lawful-basis regime, and the only quasi subject-rights concept identified is a voluntary, certification-verified access-and-correction principle. Controller and processor accountability operates through third-party Accountability Agent verification and the ASEAN Model Contractual Clauses' security and breach-notification templates, rather than through statutory DPO, ROPA, or retention rules. Cross-border transfers run through two interoperable voluntary tracks — the Global CBPR/PRP certification system and the ASEAN Model Contractual Clauses, the latter reinforced by a 2023 Joint Guide aligning it with the EU's Standard Contractual Clauses — with no bloc-level adequacy or data-localisation regime. Sectoral specificity appears only as a soft ASEAN recommendation that financial-sector requirements take precedence over baseline contractual clauses where the two diverge. Algorithmic governance remains at the discussion stage: the Global CBPR Forum's Spring 2026 workshop discussed artificial intelligence and privacy-enhancing technologies without adopting a binding bloc-level AI-risk-assessment requirement. Enforcement is likewise voluntary: the Global Cooperation Arrangement for Privacy Enforcement (CAPE) facilitates cross-border cooperation among Privacy Enforcement Authorities, with decertification as the only sanction available at bloc level. #### Outlook This is a first baseline characterisation of the APAC bloc row, and it establishes an 'unregulated gap' at bloc level across all ten modules of the spine, with enforceable data-protection law continuing to sit at the national-jurisdiction level rather than at the bloc level. Watch for further Global CBPR Forum membership growth beyond APEC, for any move toward convergence between the Global CBPR and ASEAN tracks, and for confirmation of national-level APAC regimes that this bloc-level row does not itself cover. Read full brief · 698 words Standing brief, as of 21 September 2026. #### Regulatory Status Hong Kong's data-protection enforcement posture tightened materially through 2025, with the Office of the Privacy Commissioner for Personal Data recording 4,228 complaints, up 23 percent year-on-year, and 246 voluntary data breach notifications, up 21 percent, including 81 hacking-related incidents. These figures were reported in the PCPD's February 2026 report on 2025 activity. Hong Kong has no mandatory breach-notification requirement; the 246 figure represents purely voluntary organisational disclosures. A separate proposed amendment to the Personal Data (Privacy) Ordinance, which would introduce mandatory breach notification alongside retention-policy requirements, administrative fines and processor regulation, remains unenacted, with reporting on its current status understood to be mixed. #### Outlook Whether the proposed PDPO reform package advances toward enactment is the key open question for Hong Kong's data-protection trajectory. Rising enforcement-activity volumes under the current statutory toolkit, absent administrative fining power, will remain the operative baseline until any reform is enacted. Read full brief · 154 words Key regulatory facts for Asia-Pacific bloc Regulatory Dimension Asia-Pacific bloc Standing Position Jurisdiction Asia-Pacific bloc (APAC) Regulatory Scope Data Protection & Privacy Regulation (10 modules, 44 sourced findings) Regulator & Framework No comprehensive, binding, bloc-wide DP framework exists; both mechanisms are explicitly voluntary/certification-based. Lawful Processing & Special Data Absence of enforceable lawful-basis, special-category, or anonymisation standards at the bloc level; searched Global CBPR Framework documentation and ASEAN Framework text for GDPR Art 6/9-equivalent provisions and... Data Subject Rights No enforceable subject-rights regime at bloc level; only voluntary certification-linked principles found. Controller/Processor Duties Voluntary accountability and template contractual security/breach clauses exist, but no binding bloc-wide DPIA, DPO, ROPA, or retention regime. Primary Instruments Cited Global CBPR Forum, Global CBPR Forum, ASEAN, ASEAN, Global CBPR Forum Last Confirmed / Updated 2026-11-04 (26 sources in cumulative register) 10 of 10 categories Signal Red Amber Green Density Comfortable Compact Expand all sources Reset all Selections OR within a group, AND across groups. Press / to search. ### Asia-Pacific bloc: D1 Regulator & Framework5 sub-modulesRedEnacted in forceModule confidence: Probable▾ No comprehensive, binding, bloc-wide DP framework exists; both mechanisms are explicitly voluntary/certification-based. Primary framework None (fragmented: ASEAN Framework on Personal Data Protection 2016 + Global CBPR Forum certification system — both voluntary, non-converging) Supervisory authority [Global CBPR Forum — Global Forum Assembly (governance body; not a statutory regulator)](https://www.globalcbpr.org/) Traffic-light rationale — Red No comprehensive, binding, bloc-wide DP framework exists; both mechanisms are explicitly voluntary/certification-based. #### Sub-modules (5) #### Regulator And AuthorityRed No single regulator; oversight is fragmented across national DPAs. Cross-border enforcement cooperation runs through the voluntary Global Cooperation Arrangement for Privacy Enforcement (CAPE), established October 2023. Claims (4): - APAC has no single unified data-protection regulator; oversight is fragmented across national DPAs, with cross-border coordination occurring through the voluntary Global CBPR Forum and the ASEAN Framework on Personal Data Protection, which operate as parallel, non-converging mechanisms. - The Global Cooperation Arrangement for Privacy Enforcement (CAPE), established in October 2023, is a multilateral mechanism facilitating cross-border cooperation between Privacy Enforcement Authorities, including joint investigations and enforcement actions. - Global Cross-Border Privacy Rules (CBPR) Forum — Voluntary certification system with membership extending beyond APAC (Australia, Canada, Japan, Korea, Mexico, Philippines, Singapore, Chinese Taipei, US, DIFC, plus UK/Bermuda/Mauritius/Nigeria as associates), creating no enforceable obligations on non-certified entities - Global Cross-Border Privacy Rules Forum — voluntary certification mechanism established 21 April 2022 as successor to APEC CBPR System, with membership extending beyond Asia-Pacific #### Act And InstrumentsAmber Instruments are the non-binding ASEAN Framework on PDP (2016), the voluntary ASEAN Model Contractual Clauses (2021), and the Global CBPR Forum's Policies, Rules and Guidelines (2024) underpinning its certification system. Claims (5): - The ASEAN Framework on Personal Data Protection was adopted 25 November 2016 and explicitly states it creates no legally binding or enforceable obligations on ASEAN member states. - The Global CBPR Forum was established in 2022 by Australia, Canada, Japan, the Republic of Korea, Mexico, the Philippines, Singapore, Chinese Taipei, and the United States as a successor to the APEC CBPR System. - The ASEAN Model Contractual Clauses for Cross-Border Data Flows were finalised/endorsed in January 2021 and are designed to be interoperable with the APEC/Global CBPR certification system, while remaining voluntary. - ASEAN Framework on Personal Data Protection — No legally binding or enforceable obligations on ASEAN member states - the ASEAN Framework on Personal Data Protection, adopted 25 November 2016, explicitly states it creates no legally binding or enforceable obligations #### Material ScopeRed The ASEAN Framework sets out high-level principles for personal data processing but by its own text creates no legally binding or enforceable obligations on member states or organisations. Claims (1): - The ASEAN Framework on Personal Data Protection addresses personal data processing principles but is explicitly non-binding, creating no enforceable material-scope obligations at bloc level. #### Territorial ScopeAmber The Global CBPR Forum's membership extends beyond the Asia-Pacific region (Canada, Mexico, US are members), while the ASEAN Framework and MCCs apply only to the 10 ASEAN member states. Claims (2): - Global CBPR Forum membership is Australia, Canada, Japan, Republic of Korea, Mexico, Philippines, Singapore, Chinese Taipei and the United States, extending its territorial reach beyond the Asia-Pacific region. - The ASEAN Framework on Personal Data Protection and its Model Contractual Clauses apply only to the ten ASEAN member states, a narrower territorial scope than the Global CBPR Forum. #### Regulator Registration And FilingRed There is no bloc-level government registration or filing obligation. The Global CBPR/PRP System instead relies on voluntary third-party certification by accredited Accountability Agents. Claims (2): - There is no government registration or filing regime at bloc level; Global CBPR and Global PRP certifications instead require verification by third-party Accountability Agents, a voluntary private-sector process. - Macau Office for Personal Data Protection (OPDP) — Data controllers must notify OPDP of personal-data processing within 8 days of commencing the processing activity, absent exemption. APAC as a bloc has no single unified data-protection regulator or comprehensive statute. Two parallel, non-converging voluntary mechanisms exist: the Global CBPR Forum (successor to the APEC CBPR System, established 21 April 2022) and the ASEAN Framework on Personal Data Protection (2016) plus its 2021 Model Contractual Clauses. Neither creates enforceable, unified obligations across the bloc; actual binding DP law resides at the national level (SG, JP, KR, AU, etc.), which is out of scope for this bloc-level row. Periodic update · new data 2026-09-14 #### Regulator & Framework APAC's bloc-level data-protection framework architecture remains a patchwork of voluntary instruments rather than a single regulator or binding regional statute. The most recent addition to this architecture is the ASEAN Framework on Cross-Border Cloud Computing, endorsed at the 6th ASEAN Digital Ministers' Meeting in February 2026. This instrument sets common principles for cloud-computing governance and cross-border data hosting among ASEAN member states, extending the region's existing non-binding framework stack into a new subject-matter area rather than consolidating what already exists. This new framework sits alongside, and does not supersede, the 2016 ASEAN Framework on Personal Data Protection, which remains the foundational, and still non-binding, regional instrument addressing personal data protection principles generally. Neither instrument creates an ASEAN-level regulator or supervisory authority; both operate as sets of common principles that member states are expected to implement through their own domestic legal and institutional frameworks, with no regional enforcement mechanism attached to either. The Global Cross-Border Privacy Rules Forum represents a parallel, and institutionally distinct, framework track operating across and beyond the APAC bloc. Established 21 April 2022 with nine founding economies as the successor to the APEC CBPR System, the Global CBPR Forum operates as a voluntary certification mechanism rather than a regulator, allowing certified organisations to demonstrate compliance with a common set of cross-border privacy principles independent of the ASEAN-specific instruments. Its membership base extends beyond ASEAN, giving it a broader geographic scope than the region-specific frameworks even though several ASEAN member states participate in both tracks simultaneously. The practical consequence of this architecture is that no single body functions as an APAC-wide data-protection regulator or standard-setter. Instead, member states operate their own domestic regulators and legal frameworks, layered against a growing but still entirely voluntary stack of regional and cross-regional instruments: the ASEAN PDP Framework, the new ASEAN Cloud Computing Framework, and the Global CBPR system. Whether the February 2026 cloud-computing framework creates any obligations distinct from the non-binding 2016 PDP Framework, or whether it too operates purely as a set of aspirational common principles, remains an open question that has not been resolved by the material available this cycle; the framework's full text and its binding status relative to the 2016 instrument were not independently verified. #### Outlook The framework-architecture picture is likely to continue accreting new voluntary instruments addressing specific subject areas, cloud computing being the latest example, rather than consolidating into a single binding regional standard or giving rise to an ASEAN-level regulatory authority. The open question of the new cloud-computing framework's precise legal status relative to the 2016 PDP Framework should be prioritised for verification in a future cycle, as it bears directly on whether member states face any enforceable obligation under the new instrument or merely a further aspirational commitment. Sources and claims (14) - [Global CBPR Forum](https://www.globalcbpr.org/about/) — APAC has no single unified data-protection regulator; oversight is fragmented across national DPAs, with cross-border coordination occurring through the voluntary Global CBPR Forum and the ASEAN Framework on Personal Data Protection, which operate as parallel, non-converging mechanisms. - [Global CBPR Forum](https://www.globalcbpr.org/) — The Global Cooperation Arrangement for Privacy Enforcement (CAPE), established in October 2023, is a multilateral mechanism facilitating cross-border cooperation between Privacy Enforcement Authorities, including joint investigations and enforcement actions. - [ASEAN](https://asean.org/wp-content/uploads/2012/05/10-ASEAN-Framework-on-PDP.pdf) — The ASEAN Framework on Personal Data Protection was adopted 25 November 2016 and explicitly states it creates no legally binding or enforceable obligations on ASEAN member states. - [Global CBPR Forum](https://www.globalcbpr.org/about/) — The Global CBPR Forum was established in 2022 by Australia, Canada, Japan, the Republic of Korea, Mexico, the Philippines, Singapore, Chinese Taipei, and the United States as a successor to the APEC CBPR System. - [ASEAN](https://asean.org/wp-content/uploads/3-ASEAN-Model-Contractual-Clauses-for-Cross-Border-Data-Flows_Final.pdf) — The ASEAN Model Contractual Clauses for Cross-Border Data Flows were finalised/endorsed in January 2021 and are designed to be interoperable with the APEC/Global CBPR certification system, while remaining voluntary. - [ASEAN](https://asean.org/wp-content/uploads/2012/05/10-ASEAN-Framework-on-PDP.pdf) — The ASEAN Framework on Personal Data Protection addresses personal data processing principles but is explicitly non-binding, creating no enforceable material-scope obligations at bloc level. - [Global CBPR Forum](https://www.globalcbpr.org/global-cbpr-forum-launches-international-data-protection-and-privacy-certifications-and-opens-participation-to-new-members/) — Global CBPR Forum membership is Australia, Canada, Japan, Republic of Korea, Mexico, Philippines, Singapore, Chinese Taipei and the United States, extending its territorial reach beyond the Asia-Pacific region. - [ASEAN](https://asean.org/wp-content/uploads/2012/05/10-ASEAN-Framework-on-PDP.pdf) — The ASEAN Framework on Personal Data Protection and its Model Contractual Clauses apply only to the ten ASEAN member states, a narrower territorial scope than the Global CBPR Forum. - [Global CBPR Forum](https://www.globalcbpr.org/) — There is no government registration or filing regime at bloc level; Global CBPR and Global PRP certifications instead require verification by third-party Accountability Agents, a voluntary private-sector process. - [Global CBPR Forum](https://www.globalcbpr.org/wp-content/uploads/Global-CBPR-Policies-Rules-and-Guidelines_Final-as-of-April-11-2024.pdf) — Global Cross-Border Privacy Rules (CBPR) Forum — Voluntary certification system with membership extending beyond APAC (Australia, Canada, Japan, Korea, Mexico, Philippines, Singapore, Chinese Taipei, US, DIFC, plus UK/Bermuda/Mauritius/Nigeria as associates), creating no enforceable obligations on non-certified entities - [mdec.my](https://www.mdec.my/media-release/news-press-release/415/asean-endorses-malaysia-led-regional-framework-on-cross%02border-cloud-computing) — ASEAN Framework on Personal Data Protection — No legally binding or enforceable obligations on ASEAN member states - [DLA Piper Data Protection Laws of the World](https://www.dlapiperdataprotection.com/sites/default/files/guide.pdf?c=MO) — Macau Office for Personal Data Protection (OPDP) — Data controllers must notify OPDP of personal-data processing within 8 days of commencing the processing activity, absent exemption. - [asean.org](https://asean.org/wp-content/uploads/2012/05/10-ASEAN-Framework-on-PDP.pdf) — Global Cross-Border Privacy Rules Forum — voluntary certification mechanism established 21 April 2022 as successor to APEC CBPR System, with membership extending beyond Asia-Pacific - [Lexology](https://www.lexology.com/library/detail.aspx?g=b0a53b46-54c7-4066-b916-a49440288a94) — the ASEAN Framework on Personal Data Protection, adopted 25 November 2016, explicitly states it creates no legally binding or enforceable obligations ### Asia-Pacific bloc: D2 Lawful Processing & Special Data4 sub-modulesRedEnacted in forceModule confidence: Probable▾ Absence of enforceable lawful-basis, special-category, or anonymisation standards at the bloc level; searched Global CBPR Framework documentation and ASEAN Framework text for GDPR Art 6/9-equivalent provisions and found only voluntary principles. Primary framework Global CBPR Privacy Principles (voluntary, APEC Privacy Framework-derived) Traffic-light rationale — Red Absence of enforceable lawful-basis, special-category, or anonymisation standards at the bloc level; searched Global CBPR Framework documentation and ASEAN Framework text for GDPR Art 6/9-equivalent provisions and found only voluntary principles. D2 · Lawful Processing — Full Module Record 4 sub-modules · 45 words · 2 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login) [Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Asia-Pacific bloc: D3 Data Subject Rights5 sub-modulesRedEnacted in forceModule confidence: Probable▾ No enforceable subject-rights regime at bloc level; only voluntary certification-linked principles found. Primary framework Global CBPR Privacy Principles (voluntary) Traffic-light rationale — Red No enforceable subject-rights regime at bloc level; only voluntary certification-linked principles found. #### Sub-modules (5) #### Access RightAmber Global CBPR Privacy Principles include an access/correction-type concept drawn from the APEC Privacy Framework, verified only through voluntary Accountability Agent review, not statutory enforcement. Claims (1): - The Global CBPR Privacy Principles, based on the APEC Privacy Framework, include an access/correction-type concept, but compliance is verified only via voluntary third-party Accountability Agent review rather than statutory enforcement. #### Rectification And ErasureRed No bloc-level rectification/erasure right was identified beyond the general access/correction principle noted above. #### Restriction And ObjectionRed No bloc-level restriction or objection right was identified. #### Data PortabilityRed No bloc-level portability right was identified. #### Deadlines And Response WindowsRed No bloc-level statutory response-window deadlines were identified. No bloc-level statutory data-subject-rights framework (access, rectification, erasure, restriction, objection, portability, or response-window deadlines) exists. The Global CBPR Privacy Principles reference access/correction-type concepts drawn from the APEC Privacy Framework, but enforcement is limited to certification review by Accountability Agents rather than statutory rights enforceable in court. No periodic updates recorded in this cycle Sources and claims (1) - [Global CBPR Forum](https://www.globalcbpr.org/about/membership/) — The Global CBPR Privacy Principles, based on the APEC Privacy Framework, include an access/correction-type concept, but compliance is verified only via voluntary third-party Accountability Agent review rather than statutory enforcement. ### Asia-Pacific bloc: D4 Controller/Processor Duties7 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Voluntary accountability and template contractual security/breach clauses exist, but no binding bloc-wide DPIA, DPO, ROPA, or retention regime. Primary framework Global CBPR/PRP Systems (voluntary certification) + ASEAN Model Contractual Clauses (voluntary contract template) Traffic-light rationale — Amber Voluntary accountability and template contractual security/breach clauses exist, but no binding bloc-wide DPIA, DPO, ROPA, or retention regime. D4 · Controller & Processor — Full Module Record 7 sub-modules · 60 words · 5 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Asia-Pacific bloc: D5 Cross-Border & Adequacy6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Voluntary certification and contractual-clause mechanisms are well-documented, but no adequacy, TIA, or localisation regime exists at bloc level. Primary framework Global CBPR/PRP Systems + ASEAN Model Contractual Clauses (both voluntary) Supervisory authority [Global CBPR Forum — Global Forum Assembly](https://www.globalcbpr.org/) Traffic-light rationale — Amber Voluntary certification and contractual-clause mechanisms are well-documented, but no adequacy, TIA, or localisation regime exists at bloc level. Periodic update · new data 2026-11-04 #### Cross-Border & Adequacy The central development for Asia-Pacific's cross-border data-transfer architecture is the ASEAN Digital Economy Framework Agreement (DEFA), which is understood to be targeted for signature at the 49th ASEAN Summit on 16-18 November 2026. Negotiations on the agreement concluded on 29 May 2026, and the instrument, as negotiated, includes provisions addressing cross-border data flows among ASEAN's ten member states. It should be read precisely for scope: ASEAN's membership is a subset of the wider Asia-Pacific grouping this brief covers, so DEFA, even if signed on schedule, would not establish a bloc-wide data-protection or cross-border-transfer regime across Asia-Pacific as a whole. It would nonetheless represent the most consequential supranational instrument touching cross-border data flows that the ASEAN sub-region has produced, moving the region's transfer architecture a step beyond the voluntary mechanisms that have governed it to date. Those voluntary mechanisms remain the operative framework pending any such signature. The ASEAN Framework on Personal Data Protection, adopted in 2016, and the ASEAN Model Contractual Clauses, introduced in 2021, are understood to loosely coordinate the data-protection regimes of ASEAN's ten member states without themselves creating enforceable cross-border obligations. Separately, the Global Cross-Border Privacy Rules system - a multilateral certification mechanism with a membership that extends beyond ASEAN - continues to be promoted as a complementary route for organisations seeking a recognised basis for cross-border transfers. At the 2026 ASEAN Digital Ministers' Meeting, the ASEAN Working Group on Digital Data Governance is reported to have reaffirmed its continued promotion of the Model Contractual Clauses and continued operationalisation of the Global Cross-Border Privacy Rules system. This is a reaffirmation of existing tools, not the introduction of a new instrument, and it does not change the voluntary, non-binding character of either mechanism. Taken together, the picture for cross-border transfers into and within the ASEAN portion of Asia-Pacific remains one of layered voluntary coordination rather than a single enforceable standard. DEFA's pending signature is the one development with the potential to shift that picture, but only for the ten states that are party to it, and only once its final text - after the legal scrubbing that typically follows a negotiated conclusion - is confirmed to retain the cross-border data-flow provisions as negotiated in May 2026. #### Outlook The clearest marker ahead is the 49th ASEAN Summit itself on 16-18 November 2026, where DEFA's signature is currently targeted. Confirmation of signature, and of whether the signed text preserves the cross-border data-flow provisions agreed in principle in May 2026, will determine whether the region's reliance on voluntary mechanisms - the ASEAN Framework on Personal Data Protection, the Model Contractual Clauses, and the Global Cross-Border Privacy Rules system - begins to give way to a binding supranational instrument, at least for the ASEAN sub-region. Whatever the outcome at signature, the instrument's reach will remain confined to ASEAN's ten member states rather than extending to Asia-Pacific as a whole, so the broader bloc will continue to lack a single cross-border transfer standard regardless of DEFA's fate. Periodic update · new data 2026-09-14 #### Cross-Border & Adequacy Cross-border data-transfer mechanisms in the APAC bloc continue to operate through a set of parallel, voluntary instruments rather than a formal adequacy-decision architecture comparable to the EU model. At the 6th ASEAN Digital Ministers' Meeting, member states reaffirmed their continued promotion of the ASEAN Model Contractual Clauses, approved in January 2021 and designed to be interoperable with the Global Cross-Border Privacy Rules system, alongside continued operationalisation of the Global CBPR system itself. This dual reaffirmation is a continuity signal: rather than selecting one transfer mechanism as primary, ASEAN member states are sustaining both tracks concurrently, with the explicit design intent that the two remain interoperable rather than competing. The newly endorsed ASEAN Framework on Cross-Border Cloud Computing adds a further dimension to this picture, establishing common principles specifically for cloud-computing governance and cross-border data hosting. While this framework is distinct in subject matter from the Model Contractual Clauses and the CBPR certification system, all three now sit within the same broader voluntary cross-border data-governance architecture that ASEAN has been building incrementally since at least 2021. A persistent feature of this architecture is uneven implementation across member states. Implementation of the ASEAN Framework's cross-border transfer principles varies considerably: Singapore, Thailand, the Philippines and Malaysia have implemented with relative rigor, while Indonesia and Vietnam sit at a more moderate level of implementation. This unevenness means the practical cross-border transfer environment a data controller or processor faces varies materially depending on the specific member states involved in a given transfer, even where the same nominal regional framework technically applies to all parties. The Global CBPR system's own membership and adoption trajectory as of September 2026 was not independently verified this cycle, representing an open sourcing gap. Given that continued CBPR operationalisation was explicitly reaffirmed at the February 2026 ministers' meeting, the current adoption count among APAC economies specifically would be a useful figure to establish in a subsequent research cycle to assess whether the reaffirmation reflects growing adoption or merely institutional continuity. #### Outlook Expect the region's multi-track approach to cross-border data transfer, ASEAN Model Contractual Clauses, Global CBPR certification, and now the cloud-computing framework, to continue operating in parallel rather than converging into a single mechanism. The persistent implementation gap between more rigorous adopters (Singapore, Thailand, Philippines, Malaysia) and moderate adopters (Indonesia, Vietnam) is likely to remain a structural feature of the bloc's cross-border data environment absent a harmonisation initiative that has not yet been signalled in the material examined this cycle. D5 · Cross-Border & Adequacy — Full Module Record 6 sub-modules · 94 words · 9 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Asia-Pacific bloc: D6 Sectoral Watch7 sub-modulesRedEnacted in forceModule confidence: Probable▾ Only a single soft recommendation on sector-specific divergence was found; no bloc-level sectoral regimes exist. Primary framework ASEAN Data Management Framework / MCC Implementing Guidelines (non-binding) Traffic-light rationale — Red Only a single soft recommendation on sector-specific divergence was found; no bloc-level sectoral regimes exist. Periodic update · new data 2026-09-14 #### Sectoral Watch This cycle's principal sectoral-watch signal concerns what the new ASEAN Framework on Cross-Border Cloud Computing does not contain rather than a discrete sectoral development. The framework, endorsed at the 6th ASEAN Digital Ministers' Meeting in February 2026, is cross-sectoral in design, establishing common principles for cloud-computing governance and cross-border data hosting that apply generally rather than carving out finance-specific, health-specific, or other vertical-sector provisions. No sectoral overlay or vertical extension of the framework has been identified within the material examined this cycle. This absence is itself worth flagging as a signal of limited scope: a cloud-computing governance framework of this kind could plausibly have included sector-specific provisions given that cloud hosting arrangements for financial-services data or health data often carry materially different risk profiles and regulatory expectations than general-purpose cloud hosting. That the endorsed framework instead adopts a general, cross-sectoral approach suggests ASEAN member states chose breadth of application over sectoral specificity at this stage of the framework's development, at least in the form endorsed in February 2026. Given the confidence level attached to this module this cycle, Uncertain, and the absence of any sector-specific development identified in the underlying source material, this sub-brief is necessarily thin. No finance-sector, health-sector, or other vertical regulatory development distinct from the general cross-border cloud-computing framework was surfaced for the APAC bloc this cycle. #### Outlook Whether ASEAN member states will pursue sector-specific overlays to the cloud-computing framework, for financial services or health data specifically, in a subsequent development cycle remains an open question not addressed by this cycle's material. This should be monitored as the framework moves toward implementation, since sector-specific guidance is a common secondary step following the endorsement of a general cross-sectoral framework of this kind. D6 · Sectoral Watch — Full Module Record 7 sub-modules · 48 words · 2 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Asia-Pacific bloc: D7 AdTech & Commercial Privacy 6 sub-modules Not assessed ▾ Absence of any bloc-level adtech/commercial-privacy provisions; searched Global CBPR Forum and ASEAN Framework materials directly. Traffic-light rationale — Not assessed Absence of any bloc-level adtech/commercial-privacy provisions; searched Global CBPR Forum and ASEAN Framework materials directly. #### Sub-modules (6) #### Cookies And TrackersRed No bloc-level cookie/tracker regime identified. #### Dark PatternsRed No bloc-level dark-pattern prohibition identified. #### Opt Out SignalsRed No bloc-level opt-out-signal standard identified. #### Clean Rooms And DcrRed No bloc-level clean-room/data-collaboration-room rule identified. #### Cross Context AdvertisingRed No bloc-level cross-context-advertising rule identified. #### Direct MarketingRed No bloc-level direct-marketing consent/suppression rule identified. No bloc-level cookie/tracker consent regime, dark-pattern prohibition, opt-out signal standard, clean-room rule, cross-context advertising rule, or direct-marketing rule exists under either the Global CBPR Forum or ASEAN Framework mechanisms. ### Asia-Pacific bloc: D8 Algorithmic, Biometric & Surveillance Governance6 sub-modulesRedEnacted in forceModule confidence: Probable▾ Only agenda-level discussion of AI found; no binding bloc-level algorithmic/biometric governance provisions exist. Traffic-light rationale — Red Only agenda-level discussion of AI found; no binding bloc-level algorithmic/biometric governance provisions exist. D8 · AI, Biometrics & Automated — Full Module Record 6 sub-modules · 41 words · 2 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Asia-Pacific bloc: D9 Children & Vulnerable Groups 5 sub-modules Not assessed ▾ Absence of any bloc-level children/vulnerable-groups provisions found via direct search of both mechanisms' governing documents. Traffic-light rationale — Not assessed Absence of any bloc-level children/vulnerable-groups provisions found via direct search of both mechanisms' governing documents. #### Sub-modules (5) #### Age VerificationRed No bloc-level age-verification standard identified. #### Parental ConsentRed No bloc-level parental-consent mechanism identified. #### Minor Profiling BansRed No bloc-level minor-profiling ban identified. #### Education SettingsRed No bloc-level education-settings rule identified. #### Dependent AdultsRed No bloc-level dependent-adults protection identified. No bloc-level age-of-consent, parental-consent mechanism, minor-profiling ban, education-settings rule, or dependent-adults protection exists under either the Global CBPR Forum or ASEAN Framework mechanisms. ### Asia-Pacific bloc: D10 Enforcement & Redress6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Cooperative enforcement mechanism (CAPE) and active Forum expansion exist, but no bloc-level statutory penalty regime, collective redress, or private right of action. Primary framework Global Cooperation Arrangement for Privacy Enforcement (CAPE) — voluntary Supervisory authority [Global CBPR Forum — Global Forum Assembly](https://www.globalcbpr.org/) Traffic-light rationale — Amber Cooperative enforcement mechanism (CAPE) and active Forum expansion exist, but no bloc-level statutory penalty regime, collective redress, or private right of action. Periodic update · new data 2026-09-28 #### Enforcement & Redress Hong Kong's Office of the Privacy Commissioner for Personal Data reported a marked escalation in enforcement-relevant activity across 2025. Its February 2026 report recorded 4,228 complaints received, a 23 percent increase over 2024, alongside 246 voluntary data breach notifications, up 21 percent year-on-year, of which 81 were hacking-related incidents. Both figures point in the same direction: a rising volume of both consumer-initiated complaints and organisation-initiated breach disclosures, suggesting increased activity on both sides of the regulator's enforcement and redress function, from complainants seeking recourse to organisations proactively engaging with the regulator over incidents. The voluntary character of the breach notifications deserves particular emphasis, because it is understood to be true of the entire 246-notification figure. Hong Kong's Personal Data (Privacy) Ordinance does not currently impose a mandatory breach-notification obligation, so the 21 percent year-on-year increase in voluntary notifications reflects organisations choosing to disclose incidents to the PCPD in the absence of a legal requirement to do so. This is a meaningfully different regulatory dynamic from jurisdictions where breach notification volumes are driven by a statutory deadline and penalty regime; in Hong Kong's case, the increase is more plausibly attributable to a combination of rising organisational risk-awareness, reputational considerations, and possibly genuine growth in the underlying incident rate, particularly given that 81 of the 246 notifications, roughly a third, were specifically hacking-related. This enforcement-activity increase sits alongside, rather than as a consequence of, statutory reform. Understood reporting indicates that mandatory data-breach notification remains a proposed rather than enacted amendment to the PDPO, and that available media coverage of the broader reform package, which is also understood to include retention-policy requirements, administrative fines and processor regulation, is mixed as to whether the reform effort has stalled. The PCPD is consequently in the position of recording rising enforcement and disclosure activity using its existing statutory toolkit, which notably lacks the administrative fining power that many comparable regional and international data-protection authorities now hold. Rising complaint and breach-notification volumes, absent an administrative-fines power to accompany them, is itself an analytically distinct posture worth tracking: it indicates growing regulatory engagement and organisational responsiveness even without the strongest available enforcement lever having been added to the statute. No primary PCPD source was reached directly this cycle; the enforcement-activity figures rest on a Tier 4 secondary source summarising the PCPD's own February 2026 report, so the finding should be treated as probably accurate pending direct verification against the PCPD's original publication. #### Outlook The trajectory of the proposed PDPO reform package, particularly whether mandatory breach notification and administrative fining powers move toward enactment, is the central variable to watch for Hong Kong's enforcement and redress posture going forward. A future cycle that reaches the PCPD's own primary report directly, rather than relying on secondary summarisation, would also meaningfully strengthen the evidentiary basis for this finding. Continued year-on-year growth in either complaint volume or voluntary breach notifications in a subsequent reporting period would corroborate the rising-enforcement-activity thesis; a plateau or decline would suggest 2025 was an anomalous year rather than the start of a sustained trend. Periodic update · new data 2026-09-14 #### Enforcement & Redress No bloc-level enforcement or redress mechanism exists within the ASEAN or broader APAC data-protection architecture examined this cycle, and this structural absence itself remains the standing finding for this module. Enforcement of data-protection obligations continues to sit entirely at the level of individual member states' domestic regulators, with no ASEAN-level or APAC-wide body empowered to investigate complaints, issue sanctions, or provide redress mechanisms across borders. Within this structural context, the most recent bloc-level development bearing on this module within the window examined is the endorsement of the ASEAN Framework on Cross-Border Cloud Computing at the 6th ASEAN Digital Ministers' Meeting in early 2026. This is not itself an enforcement or redress mechanism, it is a non-binding governance framework, but it represents the most recent bloc-level data-protection-adjacent development identified within the relevant recent-developments window, and is recorded here on that basis rather than as a substantive enforcement development. The practical consequence of the continuing absence of a bloc-level enforcement mechanism is that any redress available to individuals or organisations affected by cross-border data-handling issues within ASEAN member states must be pursued through domestic regulatory or judicial channels in the relevant member state, without recourse to a regional body. This remains true notwithstanding the region's growing stack of voluntary governance frameworks addressing substantive data-protection principles, none of which carries an accompanying enforcement or redress architecture of its own. #### Outlook Absent a specific ASEAN initiative to establish a regional enforcement or redress body, which has not been signalled in the material examined this cycle, this structural gap is likely to persist. Any future development materially altering this picture would represent a significant departure from the bloc's current governance model and should be treated as a high-priority signal if it emerges in a future cycle. D10 · Enforcement & Redress — Full Module Record 6 sub-modules · 89 words · 9 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ## GDPR article map Cross-reference: which category/sub-module covers each UK GDPR article (37 mapped). Show article map GDPR article to category mapping Article Category Sub-module Art. 5 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 6 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) lawful bases Art. 7 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) consent thresholds Art. 9 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) special categories Art. 13 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 14 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 15 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 16 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 17 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 18 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 19 [Data Subject Rights](#sec-cat-data_subject_rights) deadlines and response windows Art. 20 [Data Subject Rights](#sec-cat-data_subject_rights) data portability Art. 21 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 22 [Algorithmic, Biometric & Surveillance Governance](#sec-cat-algorithmic_biometric_and_surveillance_governance) automated decision making transparency Art. 25 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 28 [Controller/Processor Duties](#sec-cat-controller_processor_duties) joint controller arrangements Art. 30 [Controller/Processor Duties](#sec-cat-controller_processor_duties) ropa requirements Art. 32 [Controller/Processor Duties](#sec-cat-controller_processor_duties) security measures Art. 33 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 34 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 35 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 37 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 38 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 39 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 44 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 45 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) adequacy received Art. 46 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 47 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 48 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) data localisation Art. 49 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 77 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 78 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 79 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 80 [Enforcement & Redress](#sec-cat-enforcement_and_redress) collective redress and class actions Art. 82 [Enforcement & Redress](#sec-cat-enforcement_and_redress) collective redress and class actions Art. 83 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 84 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties