Asia TMT Bulletin – May 2026

We are delighted to share a series of recent successes for our Asia TMT team across multiple awards platforms. At the IJGlobal APAC Awards 2026 and TMT Finance APAC Awards 2026, we were recognised for our work on market leading digital infrastructure mandates, including advising AirTrunk on its A$16bn sustainability-linked refinancing and advising CP Group and True IDC on the successful closing of a US$550m project financing to support its development and construction of a greenfield data centre in Rayong Province Thailand. We were also shortlisted for several awards at the Legal 500 Southeast Asia Awards 2026 and I am happy to share that I won TMT Associate of the Year! We are deeply grateful to our clients for their trust and continued partnership, which makes these achievements possible.

Data privacy

China: Consultation on simplified rules for small personal information processors

The Cyberspace Administration of China (CAC) has released a draft of the Simplified Personal Information Protection Measures for Small Personal Information Processors for public consultation, which proposes reduced compliance obligations for businesses that handle the personal information of fewer than 100,000 individuals. Read more.

Malaysia: Data protection regulator issues three new guidelines

Malaysia's data protection regulator, the Jabatan Perlindungan Data Peribadi, has issued three new guidelines under the Personal Data Protection Act 2010 on data protection impact assessments, data protection by design, and automated decision-making and profiling. Organisations should review and update their compliance frameworks accordingly.

Hong Kong: HKMA issues consumer protection principles for alternative data use

The Hong Kong Monetary Authority (HKMA) has issued consumer protection principles for banks using "alternative data" (such as e-commerce and social media data) in credit and other banking processes. Authorised institutions should review and update their policies and procedures to align with these guiding principles.

Thailand: Proposed requirements on data subject access rights 

Thailand's Personal Data Protection Committee has launched a public consultation on a draft notification setting out criteria under which data subjects may obtain copies of their personal data, and request disclosure of how personal data held by data controllers was obtained without their consent.

Australia: Amended AML/CTF record-keeping obligations and updated OAIC privacy guidance 

Amended record-keeping obligations under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) (AML/CTF) commenced from 31 March 2026. The Office of the Australian Information Commissioner (OAIC) recently released updated guidance on balancing the new AML/CTF obligations with the Privacy Act 1988 (Cth). Read more.

Cybersecurity 

Singapore: Advisory on risks associated with Frontier AI ModelsThe Cyber Security Agency of Singapore issued an advisory cautioning that, while frontier AI models can reduce the time taken to identify vulnerabilities and engineer exploits, this same capability could also be misused by cyber threat actors. 

Digital Platform Services

Singapore: Designated app stores in Singapore required to implement age assurance measures 

From 1 April 2026, selected app distribution services (e.g. Apple App Store, Google Play Store) are required by the Info-communications Media Development Authority to implement age assurance measures to screen and restrict users under 18 from accessing and downloading age-inappropriate apps.

Australia: Draft Children's Online Privacy Code released

The OAIC has released an exposure draft of the Children’s Online Privacy Code which proposes to impose stricter privacy obligations on online services likely to be accessed by children. Read more.

Artificial Intelligence

China: Interim measures on AI companionship services

The CAC has issued the Interim Measures for the Administration of AI Anthropomorphic Interaction Services, effective from 15 July 2026. The measures will regulate AI tools and services which simulate human personalities for the purpose of providing emotional companionship. The measures prohibit emotional manipulation and virtual intimate relationships with minors.

Hong Kong: Financial regulators expand GenAI sandbox

Hong Kong's four financial regulators have upgraded their GenAI sandbox to "GenAI Sandbox++", open to banks, insurers, MPF trustees, intermediaries, licensed corporations and stored value facility licensees. Participants receive free AI supercomputing access and supervisory support. Applications close 30 June 2026.

Digital Transformation

Hong Kong: HKMA issues digital transformation guidance to banks

The HKMA has issued a digital transformation steer to all authorised institutions. Authorised institutions’ boards must, within six months, approve a formal long-term business plan addressing DLT, agentic AI, cloud and high-performance computing, including potential pilot use cases. 

Vietnam: Draft Decree on activities relating to product and goods identification, authentication, and traceability

On 31 March 2026, the Ministry of Public Security issued the draft Decree on activities relating to product and goods identification, authentication, and traceability for public consultation. It proposes a blockchain‑enabled national digital infrastructure integrating a central platform, national database, and standardised data‑sharing mechanisms between all entities for the identification, authentication, and traceability of product and goods-related data.