Cybersecurity and data privacy regulations across Asia Pacific are entering a period of heightened scrutiny, with stronger enforcement, higher penalties and expanded breach notification requirements increasing the potential financial exposure from cyber incidents.
A report by global insurance broker Aon and law firm Wotton Kearney said regulatory frameworks across the region are expanding faster than some organisations’ incident response and insurance strategies have adapted. The report, The Changing Cyber Risk Landscape in APAC, added that Australia and India are strengthening enforcement regimes and increasing maximum penalties, while Mainland China is expanding the extraterritorial reach of its requirements. Recent reforms in Indonesia, Japan, Malaysia, New Zealand, Singapore, South Korea, Thailand and Vietnam have also formalised breach notification requirements and strengthened regulatory powers.
Aon said the consequences of a cyber incident can vary significantly between jurisdictions, with differences in breach notification rules, enforcement thresholds and sanctions potentially resulting in parallel investigations and overlapping penalties for incidents affecting multiple markets. The report also highlighted uncertainty over the insurability of cyber-related fines and penalties, which can depend on local law, public policy and court practice rather than policy wording alone.
The changing regulatory environment could also expose gaps in cyber insurance programmes, particularly as higher penalties coincide with rising defence and incident response costs, Aon said. Emma Carolan, head of cyber claims and coverage, APAC, at Aon, said organisations should use simulations to identify gaps in notification processes, internal approvals and policy structures before a major cyber incident occurs, rather than discovering them during a claim.