As technology rapidly evolves, so do the legal expectations placed upon directors. They must now navigate a complex regulatory landscape designed to address the growing risk associated with technological advancements.
A notable development is the introduction of a statutory tort for serious invasions of privacy in Australia, effective 10 June 2025.
This law allows individuals to seek damages for privacy infringements or misuse of information, potentially resulting in significant legal and regulatory repercussions for directors and officers.
Similarly, several Asian countries are also enhancing their legal and regulatory frameworks to address cyber security and privacy concerns.
The developments across APAC point toward a global trend to hold directors and officers accountable for cyber security and privacy, stressing the need for strong risk management and vigilance against technological threats.
In South Korea, the Personal Information Protection Act is one of the world’s most stringent privacy laws. The law requires companies to implement robust data protection measures and report data breaches promptly.
Non-compliance can lead to heavy fines and criminal charges against responsible officers.
In Singapore, the Cybersecurity Act 2018 mandates that owners of critical information infrastructure take proactive steps to protect their systems and report cyber incidents.
The Personal Data Protection Commission enforces strict guidelines under the Personal Data Protection Act to safeguard personal data, with penalties reaching up to SGD 1 million or more for severe breaches.
Japan has also strengthened its regulations with the enactment of the Act on the Protection of Personal Information (APPI).
The amended APPI, effective since April 2022, imposes stricter requirements on businesses handling personal data, including mandatory breach notifications and enhanced data subject rights. Failure to comply can result in substantial fines and reputational damage.
