Asia TMT Bulletin–October 2026

Having recently had the pleasure of speaking at the Games Industry Law Summit (On Tour IV) in Porto, it is clear that the intersection of technology, creativity and regulation has never been more pressing. This October 2026 edition of our Asia TMT Bulletin reflects that same energy. From Singapore’s enhanced platform obligations to verify advertisers and tackle AI-driven deepfake scams, to China’s first judicial rules on AI disputes and Hong Kong’s new AI risk-governance strategy, regulators across the region are acting with real purpose. We hope you find this edition a valuable guide!

Data Privacy

Australia: OAIC releases guidance on automated decision-making disclosure obligations 

From 10 December 2026, entities subject to the Australian Privacy Principles ("APPs") must disclose in their privacy policies where they use computer programs or artificial intelligence systems to make, or substantially assist in making, decisions that significantly affect an individual's rights or interests. On 30 September 2026, the Office of the Australian Information Commissioner ("OAIC") updated its APP 1 Guidelines and released new guidance on the requirements, confirming the obligation extends beyond AI-driven decisions and may capture a broad range of software and embedded decision-support tools. Read more here.

Vietnam: Decree on administrative penalties for data violations officially issued 

On 19 September 2026, Vietnam's Government issued Decree No. 363/2026/ND-CP on administrative penalties for data violations which takes effect on 11 November 2026. This Decree further consolidates Vietnamese framework on data protection by extending coverage to non-personal data violations, with penalties including, among others, confiscation of economic benefits from the violations and deletion of data collected illegally.

Cybersecurity

Thailand: Cybersecurity agency consults on draft Secure Cloud Adoption Guidelines

Thailand’s National Cyber Security Agency has recently consulted on draft Secure Cloud Adoption Guidelines for cloud service users, providers and regulators. The guidelines cover access control, encryption, asset management, third-party provider management and incident handling. The consultation closed on 10 October 2026.

Intellectual Property

Hong Kong SAR: Government launches Pilot Patent Valuation Support Scheme

The Intellectual Property Department has launched a two-year Pilot Patent Valuation Support Scheme, providing eligible SMEs with matching funding of up to HK$80,000 (approximately US$10,000) based on valuations conducted of their patents and other IP assets. The Scheme also offers qualitative evaluation services for eligible Hong Kong patents. 

Digital Platform Services

Australia: Exposure draft of digital duty of care bill unveiled

On 8 September 2026, the Australian Government released the exposure draft of the Online Safety Amendment (Digital Duty of Care) Bill 2026 ("Draft Bill"), with consultation on the draft now closed. If passed, the Draft Bill would completely overhaul Australia's online safety regime by requiring a broad range of providers of 'online services' to ensure, so far as reasonably practicable, a safe online environment. Non-compliance could attract civil penalties of up to approximately $100 million per breach for corporations. Read more here.

Artificial Intelligence

Hong Kong SAR: Government sets out new AI risk-governance strategy

Hong Kong’s 2026 Policy Address outlines a new AI risk-governance strategy covering AI-related crime, protection of minors, ethics, application safety, AI product liability and AI agent governance. A new Commissioner for AI will also be established within the Digital Policy Office. Read more.

UAE: Cabinet approves resolution regulating autonomous vehicles

The UAE Cabinet has approved a resolution regulating the use of autonomous vehicles in the UAE. It establishes mechanisms and controls for inspecting, registering, licensing and renewing licences of autonomous vehicles, and introduces operational procedures for testing new vehicle technologies.

China: Supreme People’s Court issues first judicial opinions on AI disputes

Supreme People’s Court has issued its first set of judicial adjudication rules on AI-related civil, IP and procedural disputes, covering fault-based liability, notice-and-takedown duties for generative AI service providers, and the use of lawfully disclosed personal information in model training. 

China: AI Safety Governance Framework 3.0 and sector practice guides

China's National Cybersecurity Standardisation Technical Committee (TC260) has issued the third iteration of its AI Safety Governance Framework, along with four implementing practice guides including a general AI application safety guide and sector-specific guidance for education, health and broadcasting/online audio-visual.

Singapore: Platforms must verify advertisers and remove scam ads using unauthorised AI likenesses 

The Ministry of Digital Development and Information has confirmed that, in relation to advertisements using AI-generated likenesses and voices without consent, the Advertising Standards Authority of Singapore applies the same standards to all advertising content, regardless of whether AI is used, and advertisers are expected to disclose the use of AI where necessary to avoid misleading consumers. Further, designated online platforms must verify advertisers and remove suspected scam advertisements under the enhanced Codes of Practice issued under the Online Criminal Harms Act on 17 August 2026, which require designated online services to verify advertiser identities and act quickly to remove such content once identified. Inauthentic material abuse is also expected to be progressively implemented as a further harm category for artificial intelligence-generated content under the Online Safety (Relief and Accountability) Act 2025 which will allow the Online Safety Commission to act against such material. 

Singapore: Strengthening safeguards against AI-driven deepfake impersonation scams

Singapore is implementing preventive measures across multiple stages of the scam ecosystem, spanning upstream platform intervention, banking safeguards, and payment security. Key controls include the Singapore Police Force’s August 2026 Codes of Practice to prevent the impersonation of Singaporean government officials on messaging platforms, a planned prefix for government calls, stronger bank fraud surveillance with delays of 12 hours or more for higher-risk transactions, removal of PayNow nicknames, and broader resilience initiatives such as Singapore-Thailand cybersecurity cooperation and updated authentication guidelines.