Understand AI.
No technical background needed.

1. One register, five columns. For every AI feature: purpose, personal data in and out, the market it serves, the role you play there, the owner. The roles differ: Singapore's PDPA speaks of organisations and data intermediaries; China's PIPL of personal information handlers; Korea's AI Basic Act of AI business operators, with extra duties for "high-impact" AI in credit, healthcare, hiring and public services.
2. Classify by consequence, as every regime does in substance: AI that scores, ranks or decides about people (lending, employment, education, essential services) carries the heaviest duties, from Korea's high-impact obligations to China's algorithm filing for recommendation and generative services.
3. Check the territorial reach. China's PIPL and generative-AI measures reach services offered to the public in mainland China from anywhere; Korea's Act applies to conduct abroad that affects the Korean market or users (Article 4), and foreign operators above the decree's thresholds must also appoint a domestic representative (Article 36); India's DPDP Act covers processing outside India connected with offering goods or services to people in India.
4. Decide where the model runs. Residency and localisation duties (China for important data and large volumes; India's sectoral rules for payments) are architecture decisions, cheaper on the whiteboard than in production.
5. Keep it living. Quarterly review; Hong Kong's PCPD and Singapore's PDPC both expect an AI governance structure with named accountability, and both have published model frameworks to copy.

Toto-Rex's note: the column that matters is "who is answerable". If the answer is "the vendor", it is wrong in all five markets.

1. Singapore. Consent plus exceptions (business improvement, legitimate interests, research). The PDPC's Advisory Guidelines on Use of Personal Data in Generative AI (20 July 2026) confirm the "publicly available" exception can cover training data, require an AI-specific notification when personal data is used to train a model, and expect access and correction requests to be handled in good faith even for trained models.
2. China. The PIPL requires a lawful basis (usually separate consent for sensitive data and cross-border transfers), a personal information protection impact assessment for sensitive data, automated decision-making and transfers, and the generative-AI Interim Measures (15 August 2023) add training-data legality, labelling and a security assessment or algorithm filing for services with public-opinion attributes.
3. Hong Kong. The PDPO's six Data Protection Principles apply to model training and use; the PCPD's Model Personal Data Protection Framework for AI (2024), its generative-AI checklist for employees (2025) and its agentic-AI guidance (2026) are the regulator's statement of what "reasonably practicable" steps look like.
4. India. The DPDP Act 2023 applies in stages under the Rules notified on 13 November 2025: the Data Protection Board provisions at once, consent-manager registration from 13 November 2026, and the core duties (notices, consent, children's data with verifiable parental consent, security and breach notification) from 13 May 2027. Penalties reach ₹250 crore for the most serious contraventions. Personal data the person made public, or that someone was legally required to publish, is outside the Act; check whether a scraped dataset really qualifies, because other laws, licences and site terms still apply.
5. Japan and Korea. Japan's APPI allows training on personal data within the stated purpose, with the Personal Information Protection Commission's 2023 warning to OpenAI as the reference point; Korea's PIPA requires consent or a listed basis, and the PIPC has fined Meta, Kakao and others for using data beyond what users were told.

Toto-Rex's note: "publicly available" is a defence in Singapore, a question in Hong Kong and India, and a filing in China. Same words, different weight.

1. Design. Run a privacy impact assessment where the law names one: China's PIPL for sensitive data, automated decisions and transfers; Korea's AI Basic Act expects an impact assessment before high-impact AI is used; Singapore's PDPC expects a DPIA under its accountability guidance; Hong Kong's PCPD framework asks for a risk assessment before adoption. Decide the human-oversight model now.
2. Build. Test for accuracy, bias and robustness and keep the evidence. Singapore's AI Verify toolkit and Project Moonshot are free, open-source and accepted by the regulator as governance evidence; Korea's enforcement decree expects documented risk management for high-impact systems.
3. Launch. Check the duties for each country and service before release. Korea's Act is in force; the January 2026 MSIT announcement separately described a grace policy for investigations and penalties, including transparency duties.
4. Operate. Monitor outputs, log decisions, re-assess on every model change, and keep a complaints channel. China's CAC runs enforcement campaigns against AI misuse (the Qinglang sweep of 2026 handled 2,400 sites and apps); Korea and Singapore both expect incident response plans that name a person.
5. Exit. Retention and deletion schedules that reach training sets, embeddings and backups; the Singapore guidelines and Hong Kong's PDPO both expect data to go when its purpose does.

Toto-Rex's note: Record the duty, commencement and enforcement policy separately. Check current official sources before launch.

1. China. The Measures for Labelling AI-Generated Content (in force 1 September 2025) require explicit labels users can see and implicit metadata labels in the file for text, image, audio, video and virtual scenes; the anthropomorphic-interaction Measures (15 July 2026) add disclosure that the user is talking to AI, dependency monitoring, self-harm intervention and minors' safeguards for emotional-companion services.
2. Korea. Assess the required notice for each generated output. The ministry's January 2026 grace announcement also covered transparency enforcement; exceptional investigations for serious harm remained possible.
3. India. The IT Rules amendments on synthetically generated information (February 2026) require platforms to label and to act on deepfakes, with liability turning on how quickly they do.
4. Singapore and Hong Kong have no labelling statute but expect transparency: the PDPC's generative-AI guidelines ask for notices when personal data trains a model and when AI shapes decisions; the PCPD's framework asks for meaningful explanation of AI-assisted decisions.
5. Japan. The AI Promotion Act (Act No. 53 of 2025) carries no penalties, but the Second AI Basic Plan (Cabinet decision, 14 July 2026) and the AI Guidelines for Business set the transparency expectations that sector regulators and courts will read against you.

Toto-Rex's note: if the same product ships to Shanghai, Seoul and Singapore, build the label once, to the strictest standard, and switch the wording by market.

1. Know the clocks. Singapore: assess within 30 days, notify the PDPC within 3 calendar days of deciding a breach is notifiable; India: notify the Data Protection Board and affected individuals, with details within 72 hours under the 2025 Rules; Korea: PIPA notification within 72 hours; China: notify the regulator and individuals "immediately" with the measures taken; Hong Kong: no statutory duty yet, but the PCPD expects voluntary notification and investigates.
2. Security proportionate to the data. China's Data Security Law and the MLPS grading scheme, Singapore's Cybersecurity Act for critical infrastructure, India's CERT-In six-hour incident reporting directions for covered entities: check which of these your customers will push into your contract.
3. AI-specific controls belong in the programme: prompt injection, training-data poisoning, model extraction, and the permissions you give agents. Singapore's Cyber Security Agency and Hong Kong's PCPD both publish guidance on securing AI systems.
4. Rehearse. The fines that stung most in the region followed breaches where the company could not say what it held: run the exercise before the incident.
5. Insurance and contracts. Check that cyber cover reaches regulatory penalties where the law allows it, and that vendor contracts require notice within 24 to 72 hours.

Toto-Rex's note: five clocks, one runbook. The runbook says who calls whom, in which language, with which form.

1. China. Three routes out: CAC security assessment, standard contract filing or certification, with the 2024 facilitation rules exempting smaller volumes; important data, and personal information held by critical-infrastructure operators, must be stored in China, and exporting them needs a CAC security assessment unless an exemption applies; some sector rules bar export altogether. Build the data map before the architecture, not after.
2. Singapore, Hong Kong, India. Singapore's transfer limitation obligation requires comparable protection abroad (contracts, binding rules or consent); Hong Kong's section 33 is still not in force but the PCPD's recommended model clauses are market practice; India permits transfers except to countries the government blacklists, with sectoral localisation for payments and some financial data.
3. Japan and Korea. Japan's APPI requires consent or an equivalent-protection assessment, with the EU and UK recognised as adequate; Korea's PIPA requires consent or a recognised safeguard, and the PIPC enforces (DeepSeek's app was suspended in 2025 over undisclosed transfers to China).
4. Vendors and models. Contract for processing on your instructions, no training on your data without consent, residency, sub-processor approval, breach notice and deletion; ask the model provider for the documentation you need to answer your own regulators.
5. One architecture, many flags. Regional hosting in Singapore or Japan covers most of ASEAN and Northeast Asia; mainland China almost always needs a separate deployment and a local partner. Decide early; migrations are the expensive part.

Toto-Rex's note: the cheapest compliance decision in Asia is where the server sits. Make it before the first customer, not after the first complaint.

Find legal help for an AI decision: which expert, where to check them (55 official routes, 35 places), and a first-meeting card →
Founder's AI compliance file: what to decide and what to keep at every stage, from idea to exit →
Build and run AI with safeguards: cloud, APIs, retrieval, training, red-team and A/B tests, launch →