Globalaw Insights 

This summary outlines how tax disputes arise and proceed in Italy, covering the self-assessment system and taxpayer registration, how the tax authority reviews and challenges returns, the treatment of tax fraud, the conduct of audits, options for resolving disputes before litigation, the appeal process through the tax courts, and the penalties and areas of dispute taxpayers are most likely to encounter.

Tax Registration

In Italy, every individual and legal entity receives a tax identification number. Legal entities and partnerships are always assigned a VAT number, while individuals receive one only if they engage in business or self-employment activities, not for salaried employment. Once a taxpayer holds a VAT number, the tax authority is fully aware of that person's existence and economic activity.

Self-Assessment and Amending Returns

The Italian system operates on self-assessment: taxpayers prepare and file their own annual returns, and the tax authority has five years from the following year to review the return and challenge any errors or omissions. A late challenge is null and void, though the taxpayer must still formally seek its annulment through an administrative appeal or legal action.

Returns may be amended to report higher income at any time before an assessment notice is served, substantially reducing potential penalties, or amended to report lower income, subject to specific time limits.

Assessment Notices and Time Limits

The tax authority must issue a reasoned assessment notice that sets out the factual and legal grounds for the challenge, which provision was violated and why, and separately justify any related penalties. In principle, notices must be issued within five years of the filing year (a 2025 return can be assessed until December 31, 2031).

Notices issued later can still be challenged: the taxpayer files a self-protection request for annulment and, failing that, a formal appeal within 60 days, citing the expiration of the deadline.

Tax Fraud

Tax fraud is a criminal, not an administrative, matter, defined by two articles of criminal tax law that cover the use of false invoices (documents recording costs for services never rendered) and other deceptive practices intended to mislead the authorities. It is punished severely, and if charges are filed, the deadlines for serving assessment notices are doubled. It is particularly relevant internationally—for instance, regarding management fees, where Italian companies can struggle to obtain precise supporting documentation for intercompany services. Fraud investigations are conducted by the local public prosecutor, assisted by the Guardia di Finanza under the Code of Criminal Procedure, and may involve restrictions on personal liberty and the seizure of assets. Tax and criminal proceedings run in parallel and both require careful handling

Audit Conduct and Standards

There is no formal code of conduct for audits beyond a general duty of fair cooperation. The Guardia di Finanza has issued a manual outlining audit procedures, and taxpayer rights are set out in the Taxpayer's Charter. Audit reports must invite the taxpayer to provide documentation, note the right to be assisted by a tax lawyer or Chartered Accountant, and state that withheld documentation cannot later be used in court. Audits now typically focus on three main risk areas for multinationals: transfer pricing, interest/dividend/royalty payments and beneficial ownership, and intercompany services.

During audits, inspectors may request any relevant documents, including those from foreign subsidiaries via international information exchange; a refusal generally bars later use of those documents in court. Requests to third parties to cross-check data (e.g., verifying that invoices were recorded by the issuer) are also routinely permitted.

Pre-Litigation Settlement Options

Before litigation, taxpayers have three main options: accept the audit report and pay in full to secure a significant penalty reduction; take voluntary corrective action on specific issues; or negotiate a settlement with the tax authority ("accertamento con adesione"). If none of these options succeed, the only remaining route is the courts, where judicial settlement may still be attempted. The audit relationship is governed by the Taxpayer's Bill of Rights; taxpayers should always respond carefully and in writing. Auditors may remain on the taxpayer's premises for up to 30 days (extendable to 60), though in practice the overall audit, including off-site document review, often takes three to four months.

The Appeal Process

A taxpayer has 60 days from the date of service of an assessment notice to appeal, first to the Revenue Agency that issued it and then, within 30 days, to the Tax Court of First Instance. The appeal must include all arguments at the outset, as further objections cannot be added later. First-instance hearings in Milan take about nine months; the losing party may then appeal to the Second-Instance Tax Court and, finally, to the Court of Cassation, which reviews only legal principles and the soundness of reasoning.

The Tax Court is an independent judicial body covering all tax and related charges. Hearings and judgments are public, and Court of Cassation decisions are published on its website. The procedure is mainly written, with only brief oral argument; the appeal must concisely set out procedural and substantive objections, which may later be clarified—but not expanded—in further briefs. Written documentary evidence is admissible; witness testimony is not generally central, though it can matter in specific disputes, such as demonstrating non-payment.

Burden of Proof

On the burden of proof: the tax authority must justify its challenge in detail (e.g., explaining why an expense should not be considered business-related), while the taxpayer must substantiate the item's legitimacy and show that the authority's findings are unreasonable; the authority cannot rely on generic, unsupported challenges.

Duration and Payment Obligations

Proceedings can be lengthy—up to about 12 years from assessment to a Court of Cassation decision in complex cases. Upon assessment, taxpayers must pay one-third of the additional tax claimed; a stay of payment is possible but difficult to obtain, requiring both urgency (periculum in mora) and a reasonable likelihood of success (fumus boni iuris), and is particularly hard to secure for large corporations, banks, or insurers.

Representation, Costs, and Alternative Dispute Resolution

Representation before the first two levels of the tax courts must be by qualified professionals, and for cassation proceedings, by an attorney qualified before the Court of Cassation. It is advisable to use a Chartered Accountant and a tax lawyer together. The losing party generally bears the costs of the proceedings. There are two levels of tax adjudication before the Court of Cassation.

For international disputes, particularly transfer pricing, arbitration (conventional or EU) is available to avoid double taxation. Purely domestic disputes have no alternative to litigation apart from mechanisms like "accertamento con adesione."

Penalties

Penalties for additional assessed tax are generally 70% of the tax due, plus interest. Penalties may be mitigated or waived in cases of objective legal uncertainty, assessed on a case-by-case basis; for transfer pricing specifically, penalties can be avoided by preparing appropriate documentation in advance.

Outlook

Looking ahead, the main areas expected to generate disputes are tax avoidance (abuse of right), transfer pricing, and beneficial ownership. No single area is seen as uniquely difficult, though the relationship with tax authorities remains complex: local offices are sometimes aggressive, rely on one-sided ministerial circular interpretations while disregarding contrary case law, and case law itself is not always fully consistent.

For more information, contact:

Paolo Comuzzi, Partner

Lawal Legal & Tax Advisory

India’s approach to personal data protection has undergone a decisive shift. The Digital Personal Data Protection Act, 2023, read with accompanying Rules, 2025 (collectively, the “DPDPA”), is currently being implemented in India in a phased manner. Once operational (by May 2027) it will apply to all businesses processing personal data in connection with any goods or service offerings in India – including offshore entities.

While India’s DPDPA draws inspiration from the EU GDPR, businesses should note that it introduces terminology, rights and roles unique to its framework. The DPDPA operates on a binary consent regime – where personal data may only be processed with the individual’s explicit consent or for specified “certain legitimate uses.” Data Fiduciaries (entities determining means and purposes of processing personal data) are required to discharge comprehensive obligations under the DPDPA, with non-compliance entailing significant penalties (to the tune of $25 million).

For Fiduciaries, formal Data Processing Agreements comprise a statutory requirement as well as a practical necessity – since they bear non-delegable statutory liability for the Data Processors they engage.

The DPDPA’s implementation will place India alongside a growing number of APAC jurisdictions that provide for extraterritorial application of data protection laws. For multinationals operating in India, the regulatory divergence between India and other data protection regimes, including in the EU or APAC, may present immediate and material compliance challenges.

Key Compliance Considerations

Given the extensive compliance requirements under the DPDPA and its structural divergences with other data protection frameworks, multinational businesses operating in India should engage qualified counsel at the earliest to determine their specific roles and cross-border obligations under the DPDPA. Carefully structured and interoperable Data Processing Agreements, in particular, may serve as a practical compliance pathway for businesses navigating obligations across multiple jurisdictions.

Our lawyers advise clients on DPDPA compliance, cross-border data transfer arrangements, and DPA structuring. If your organization is seeking clarity on its obligations under India’s evolving data protection regime, please contact our member firm identified below.

For more information, contact:

Ashneet Hanspal, Senior Associate

Ahlawat & Associates

In the past, third-country citizens (citizens of a country outside of the European Union) always required a valid residence permit (“Niederlassungsbewilligung”) in order to obtain a work permit and be employed in Austria. As a consequence, many skilled workers, who were citizens of third countries and resided in regions close to the Austrian border, could not work in Austria, even if no suitable workforce was available on the Austrian labour market. Vacancies regularly remained unfilled, exacerbating the shortage of skilled workers in Austria. To address this shortage of skilled workers and to provide third-country citizens residing in neighbouring countries with access to the Austrian labour market, legislative measures have now been implemented in Austria.

Effective from 1 December 2025, a new settlement permit for ‘cross-border workers’ (“Aufenthaltsberechtigung Grenzgänger”) was introduced. The settlement permit for ‘cross-border workers’ is a combined work and settlement permit for individuals who reside in a country bordering Austria. It entitles the holder to stay in Austria temporarily for the purpose of employment without establishing a residence.

In order to obtain a settlement permit for ‘cross border workers’, the (future) employee must have a long-term residence permit with unrestricted access to the labour market in a neighbouring country of Austria. Consequently, certain individuals are not eligible, such as seasonal workers or students. Furthermore, the place of prospective employment must be located in an administrative district of Austria that borders the neighboring country directly. A further prerequisite for the granting of a settlement permit for ‘cross-border workers’ is a positive assessment by the Public Employment Agency, confirming that no suitable replacement worker is available on the Austrian labour market and that the general requirements for a national work permit are met. Finally, the employee must return to his main residence in the neighbouring country at least once a week. For example, a Japanese citizen, having a permanent residence- and work permit in Slovenia may work in the Austrian border region with Slovenia, provided that the other requirements are met.

An application for a settlement permit may be submitted to the competent residence authority at the (future) place of employment by either the employer or the employee him/herself. An employment contract and a statement from the employer confirming the employee’s (future) employment with him/her must be submitted with the application. The settlement permit is usually issued for a period of 12 months and can subsequently be renewed.

The introduction of this new status facilitates the recruiting of skilled workers in border regions and enables third-country nationals residing in a neighbouring country to access the Austrian labour market. It is expected that through this legislative measure, a contribution will be made towards addressing the shortage of skilled workers.

--

For more information, contact:

Dr. Philipp Spatz, LL.M.

Mag. Markus Koroschetz

hba Rechtsanwälte GmbH

The article briefly analyses possible practical implications of the U.S. Supreme Court decision in Learning Resources, Inc. v. Trump, which declared tariffs imposed by the President of the U.S. in 2025 under the International Emergency Economic Powers Act (IEEPA) unlawful and outlines the resulting refund claims for EU importers.

Shortly after taking office, the President of the U.S., based on IEEPA, issued Executive Order No. 14257, 90 Fed. Reg. 15041 (2025)¹ due to large and persistent deficits, which allegedly led to undermining of critical supply chains in the U.S.

On February 20th, 2026, the Supreme Court of the U.S. concluded in Learning Resources, Inc. v. Trump² with respect to tariffs based on IEEPA imposed on importers to the U.S. that “Fulfilling that role, we hold that IEEPA does not authorize the President to impose tariffs.”³

Based on the court’s opinion, IEEPA was designed to address extraordinary situations in national security and foreign policy by enabling economic measures such as sanctions. However, under the administration of the U.S. President, it was interpreted broadly to impose tariffs on imports⁴. The Supreme Court rejected this approach, emphasizing that tariff-setting authority belongs to Congress unless expressly delegated.

The Supreme Court of the U.S. stated that the President of the U.S. does not have the authority to unilaterally impose taxes and tariffs under IEEPA at will. On the contrary, the Supreme Court of the U.S. emphasized that to assert such extraordinary power (specifically unlimited amount, duration, and scope), the President of the U.S. must identify clear congressional authorization⁵.

The decision represents a significant development in U.S. tariffs and international trade law. The Supreme Court of the United States held that import tariffs imposed under the IEEPA lack a valid legal basis, as the statute does not authorize tariffs as a fiscal measure.

As a result, the tariffs collected under IEEPA are considered unlawful. The ruling could affect more than 300,000 importers and approximately USD 175 billion in tariffs⁶. In response, U.S. Customs and Border Protection has ceased collecting such tariffs and is addressing refund claims⁷.

Affected importers may seek refunds of tariffs paid without a legal basis. However, such claims must be actively pursued. Claimants need to identify relevant import transactions and substantiate the amounts paid, as also reflected in the underlying material.

In practice, claims are typically initiated through administrative procedures, with judicial proceedings available if necessary.

The decision has important implications for EU companies exporting to the U.S. While it creates a significant financial opportunity, successful recovery depends on timely action and proper legal strategy.

From a practical perspective, importers should assess their exposure by reviewing imports into the U.S., identifying tariffs paid, and evaluating recovery options. Given potential time limits, prompt action is advisable.

EU companies that imported goods into the U.S. during the relevant period April 2025 – February 2026 should promptly assess their position, secure the necessary documentation, and consider appropriate legal steps, including cooperation with U.S. counsel.

--

For more information, contact:

JUDr. Norbert Havrila, Partner

LEGATE

--

¹Executive Order No. 14257 of President of the U.S. (https://public-inspection.federalregister.gov/2025-06063.pdf)

²Ruling of the Supreme Court of the U.S. in Nos. 24–1287 and 25–250 (https://www.supremecourt.gov/opinions/25pdf/24-1287_4gcj.pdf)

³Article III (Pg. 20) of the Opinion of the Supreme Court of the U.S. in Nos. 24–1287 and 25–250;

⁴Article II.A.2  (Pg. 11 – 12) of the Opinion of the Supreme Court of the U.S. in Nos. 24–1287 and 25–250;

⁵Article III (Pg. 20) of the Opinion of the Supreme Court of the U.S. in Nos. 24–1287 and 25–250;

⁶PWM – University of Pennsylvania (https://budgetmodel.wharton.upenn.edu/p/2026-02-20-supreme-court-tariff-ruling)

⁷Consolidated Administration and Processing of Entries (CAPE) for IEEPA Refunds, April 20, 2026 Deployment (https://content.govdelivery.com/accounts/USDHSCBP/bulletins/4126a9c?reqfrom=share)

Costa Rica has established itself as an attractive destination for foreign investment thanks to its political stability, qualified human capital, and a solid legal framework that provides security to investors. According to the Costa Rican Foreign Trade Promotion Agency (PROCOMER), 89% of employment related to free trade zones comes from companies with foreign capital, highlighting the direct impact of international investment on local job creation. This model not only promotes economic development but also strengthens Costa Rica’s competitiveness.

Between 1990 and 2024, the number of companies operating under the free trade zone regime increased from 56 to 626, demonstrating significant sector expansion. During this period, free trade zone companies generated a cumulative economic value of USD 13.893 billion, representing 15% of Costa Rica’s national GDP. In comparison, in 1990 their contribution amounted to only USD 215 million (1% of GDP), underscoring the growing strategic importance of free trade zones for the Costa Rican economy.

“Between 1990 and 2024, the number of companies under the free trade zone regime increased from 56 to 626, demonstrating significant sector expansion.”

A Success Model in Continuous Development

Since its introduction in the 1990s, Costa Rica’s free trade zone regime has evolved from an export-oriented industrial system into an advanced ecosystem for innovation, services, and high-tech manufacturing. According to the PROCOMER study “Free Trade Zone: 35 Years Building Value for Costa Rica”, the country has experienced sustained growth under this system.

Innovation and Technological Security

Over the past three decades, high-tech sectors within free trade zones have experienced exponential growth, bringing new regulatory challenges. Maintaining a balance between openness, innovation, and technological sovereignty requires close cooperation between the public and private sectors to safeguard national security without undermining international competitiveness.

This approach ensures that technological development and foreign investment continue contributing sustainably to economic growth.

Legal Framework and Tax Incentives

The Free Trade Zone Regime Law in Costa Rica establishes several categories of companies eligible for incentives, including manufacturing and export-oriented companies, service providers, research institutes, healthcare and audiovisual companies, as well as enterprises that promote economic development outside the Greater Metropolitan Area of San José.

The legal framework aims to attract new investment, foster technological innovation, and strengthen regional competitiveness—under modalities that ensure real job creation and modernization of production processes.

For national manufacturing companies operating under this regime, legislation allows access to tax exemptions and benefits regardless of export levels. According to Article 20, subsection d) of Law No. 7210 (Free Trade Zone Regime Law), companies are exempt for a period of ten years from the start of operations from capital taxes, net worth taxes, property taxes, and real estate transfer taxes.

In other words, incentives are not tied to export performance but to the strategic or territorial importance of the investment.

However, if goods produced under the free trade zone regime are sold in the domestic market, all corresponding taxes must be paid, applying the same customs procedures as imports from abroad.

In this context, the law introduces a key customs principle: tariffs apply only to imported raw materials used in production, not to the total value of the final product. This differentiated treatment—regulated under Article 21, subsection a) of the Free Trade Zone Law—ensures that tariffs reflect only the imported portion of the production process, in line with Costa Rica’s international obligations, and promotes a balanced, competitive, and transparent investment policy.

“Tax incentives are not linked to export performance, but to the strategic or territorial importance of the investment.”

Internal Competitiveness: Structural Challenges

According to the Costa Rican Free Trade Zone Association (AZOFRAS), in order to maintain growth within the regime, the country must address key national competitiveness factors, including:

• Flexible labor regulations that allow operational adaptability in key industries;
• Exchange rate fluctuations affecting financial planning for exporting companies;
• Energy costs, which directly impact industrial production;
• High social security contributions influencing wage competitiveness and talent planning;
• Logistics and digital infrastructure, essential for efficiency and global market connectivity;
• Human capital development, crucial for innovation and productivity in high-tech sectors.

Free trade zones represent a central pillar of Costa Rica’s economic model. Their future depends on the country’s ability to anticipate risks, adapt to global changes, and strengthen cooperation between government, business, and society. They represent more than a special tax system; they embody a development vision based on innovation, stability, and openness.

--

For more information, contact:

Philip André, Partner

Lexincorp Central American Law Firm, San José

Ireland has established itself as one of the world’s most attractive jurisdictions for companies seeking legal certainty, efficiency, and internationally recognised dispute resolution mechanisms. Its combination of a common law foundation, EU membership, specialist courts, and growing technological capability makes it a compelling choice for international business.

A Stable, Predictable Common Law System

Ireland’s common law framework provides reliability through the doctrine of precedent, giving businesses clarity and reducing legal ambiguity. As an English-speaking jurisdiction, Ireland also offers seamless communication and a familiar legal environment for global companies.

An EU Member with Strong Cross-Border Enforceability

As part of the European Union, Ireland benefits from the supremacy of EU law and automatic EU-wide recognition of Irish judgments, with limited exceptions. The country is also a party to key international agreements, including the Lugano and Hague Conventions, thereby enhancing enforceability beyond the EU.

Efficient Courts and Cost-Competitive Litigation

Ireland offers a competitive cost regime compared with jurisdictions such as the UK and the US. The “costs follow the event” principle allows successful parties to recover fees, helping manage financial exposure.

The court structure supports efficient dispute resolution, with the High Court handling major commercial matters and the Circuit and District Courts managing lower-value disputes.

A Commercial Court Built for Speed and Complexity

Ireland’s Commercial Court is highly regarded for its expertise, strict case management, and fast-track procedures. Complex and high-value business disputes are fast-tracked, and more than 60% of cases conclude within a year. Specialist lists—such as Intellectual Property & Technology and Planning & Environment—ensure cases receive expert judicial attention.

A Modern, Streamlined Appeals Process

The Court of Appeal usually hears appeals within 3–5 months, supported by weekly case management sessions held in person and remotely. The Supreme Court focuses on cases of major public importance, processing applications quickly and listing accepted appeals without delay.

A Global Centre for Arbitration and Mediation

Ireland is a leading destination for alternative dispute resolution.

• Arbitration benefits from confidentiality, finality, the UNCITRAL Model Law, and Ireland’s status as a New York Convention signatory.

• Mediation enjoys success rates of 80% and statutory support via the Mediation Act 2017. Courts can also encourage mediation even after litigation begins.

Other ADR mechanisms, such as conciliation and adjudication, offer additional flexibility.

Innovation Driven Courts and Industry Expertise

Ireland is investing heavily in digital transformation. Legal professionals and judges possess deep expertise in sectors such as pharmaceuticals, life sciences, financial services, and technology—reflecting Ireland’s role as a global business hub.

A Supportive Restructuring Environment

Ireland’s insolvency and restructuring framework is creditor-friendly and flexible, with processes such as Examinership and the Small Company Administrative Rescue Process (SCARP) helping businesses navigate financial difficulty efficiently.

--

For more information, contact:

Eamon Harrington

Partner & Head of CKT’s Healthcare and Litigation Departments

Comyn Kelleher Tobin

Every new and existing creation of personal data carries some risk of a possible data breach. Every organisation and data user must have clear policies and procedures for best practices in reporting data breaches and responding to data leakage incidents.

Different jurisdictions have their own criteria or laws governing how organisations should respond to data leak incidents. Most require data users to take all reasonable steps to protect personal data from unauthorized or accidental access, taking into consideration the type of data, potential harm from a breach, and measures to maintain the data's integrity for those who have access to it.

This article provides an overview of the criteria and laws applicable in Globalaw’s Asia Pacific region, including Hong Kong, India, Japan, South Korea, and Taiwan.

Hong Kong

Business operators in Hong Kong are encouraged to voluntarily report data breaches in accordance with the best practices published by the Office of the Privacy Commissioner for Personal Data (PCPD).

Currently, there are no specific criminal penalties for data breaches, although civil liabilities may arise from breaches of contract, confidentiality, and negligence.

The newly enacted Protection of Critical Infrastructures (Computer Systems) Ordinance, expecting to take effect on 1 January 2026, will require the operators of crucial infrastructures in Hong Kong in eight industries — energy, information technology, banking and financial services, air transportation, land transportation, maritime transport, healthcare services, and telecommunications and broadcasting services — to implement security plans and protocols, and report on security incidents. Failure to comply will result in fines ranging from HK$500,000 to HK$5 million.

India

India’s forthcoming Digital Personal Data Protection Act (DPDPA) requires data breaches to be reported promptly to both the Data Protection Board of India and the data principal. If data fiduciaries fail to provide such notice, they could face severe penalties of up to approximately USD 24 million.

Japan

In the event of serious data security breaches in Japan, business operators are required to notify both the Personal Information Protection Commission (JPIPC) and data subjects. The Act on the Protection of Personal Information (APPI) imposes criminal penalties for various improper handling of personal data as well as failure to comply with the JPIPC rectification requests and orders.

South Korea

For any leak of sensitive personal data in South Korea, business operators must notify the Korean Personal Information Protection Commission and the affected data subjects within 72 hours of discovering the leak. Criminal penalties apply to intentional or severe negligence (such as illegal data sales or leaks), along with administrative fines, corrective orders, potential suspension of processing, and public disclosure.

Taiwan

In Taiwan, the Personal Data Protection Act (PDPA) currently requires organisations to notify affected individuals of data breaches only after the relevant facts have been verified. Criminal penalties are imposed for intentional misconduct, with a tiered system of administrative fines for other violations. Notably, proposed amendments to the PDPA announced in March 2025 include increased reporting requirements, and business operators should closely monitor these upcoming changes.

--

This article is part of a series by our Globalaw APAC Data Privacy & Protection Taskforce members.

Globalaw’s APAC Data Privacy & Protection Taskforce comprises 15 law firms in the Asia-Pacific region with specialized expertise in advising international companies on how to implement and manage a multijurisdictional data protection program. Taskforce member firms combine a strategic, business-minded approach with cross-border collaboration to help clients build and maintain sophisticated and resilient data practices, effectively mitigate and respond to incidents, and provide sophisticated representation to resolve disputes or regulatory investigations.

Explore the Globalaw APAC Data Privacy & Protection Taskforce brochure for more information and regional contacts.

Disclaimer: The information provided in this article is for general informational purposes only and does not constitute legal advice. Information, including laws and statutes, cited are subject to change and is accurate as of 30 June 2025, but readers should verify such current status. We and our member firms shall not be held liable for any loss and/or damage incurred by any person acting as a result of the information contained in this article. Reliance on this content is at the reader’s own risk, and no attorney-client relationship is formed by reading or acting upon this article. Always seek professional legal counsel to ensure compliance with applicable laws and regulations.

With the proliferation of data created each day across internet browsers, social media, digital transactions, streaming, logins, and other channels, many data subjects are uncertain about their data privacy rights: can they be forgotten?

While many countries in the Asia Pacific region follow jurisdictional directives that personal data shouldn’t be kept for longer than necessary for the fulfilment of the purpose for which the data is used, there are some variations in how each jurisdiction handles the “right to be forgotten.” There are also precedent cases and judicial pronouncements that address the “right to erasure” of personal data.

This article provides an overview of the “right to be forgotten” in countries within Globalaw’s Asia Pacific region, including Hong Kong, India, Japan, South Korea, and Taiwan.

Hong Kong

Although there is no explicit “right to be forgotten” in Hong Kong, under the Personal Data (Privacy) Ordinance, data users must ensure personal data is retained only as long as necessary and generally must take reasonable steps to delete the personal data they hold when it is no longer needed, unless statutory exemptions apply.

India

There is no clear statutory provision; the Indian courts have recognized the “right to be forgotten” in some judicial pronouncements.

The Indian judiciary has also attempted to clarify the distinction between “right to be forgotten” and the “right to erasure” in its court decisions.

Further, the forthcoming Digital Personal Data Protection Act (DPDPA) will provide for a statutory “right to erasure” (unless the statutory restrictions apply).

Japan

While Japan does not have an explicit “right to be forgotten," the Act on the Protection of Personal Information (APPI) recognises the right of data subjects to correct, add, or delete their personal data when it is inaccurate.

South Korea

Data subjects in South Korea have the right to access, correct, delete, and suspend the processing of their data, as well as the right to withdraw their consent. Although there is no explicit “right to be forgotten,” it is increasingly recognised in practice as a separate right from the general deletion right.

In common practice, business operators in South Korea often establish a defined retention period and periodically re-request consent.

Taiwan

In Taiwan, although there is no explicit “right to be forgotten,” similar protections are provided under the Personal Data Protection Act (PDPA) through various data subject rights, including rights to access, correct, delete data, and demand the cessation of data processing and use.

In practice, certain Taiwan courts have interpreted constitutional principles of informational self-determination and privacy to support this right, balancing individual rights against public interest when assessing removal requests, thus adapting to emerging digital privacy challenges.

--

This article is part of a series by our Globalaw APAC Data Privacy & Protection Taskforce members.

Globalaw’s APAC Data Privacy & Protection Taskforce comprises 15 law firms in the Asia-Pacific region with specialized expertise in advising international companies on how to implement and manage a multijurisdictional data protection program.

Taskforce member firms combine a strategic, business-minded approach with cross-border collaboration to help clients build and maintain sophisticated and resilient data practices, effectively mitigate and respond to incidents, and provide sophisticated representation to resolve disputes or regulatory investigations.

Explore the Globalaw APAC Data Privacy & Protection Taskforce brochure for more information and regional contacts.

Disclaimer: The information provided in this article is for general informational purposes only and does not constitute legal advice. Information, including laws and statutes, cited are subject to change and is accurate as of 30 June 2025, but readers should verify such current status. We and our member firms shall not be held liable for any loss and/or damage incurred by any person acting as a result of the information contained in this article. Reliance on this content is at the reader’s own risk, and no attorney-client relationship is formed by reading or acting upon this article. Always seek professional legal counsel to ensure compliance with applicable laws and regulations.

While obtaining informed and voluntary consent from data subjects, organisations should clearly state the reasons for collecting the data, how it will be handled, and how it will be used.

Being transparent with subjects about data collection and use is especially important as data creation has proliferated across social media, streaming, digital transactions, smart devices, logins and other identifying information on search browsers, and the rise of AI and metadata in files.

In practice, the manner in which informed and voluntary data subject consent is conducted may vary from jurisdiction to jurisdiction.

This article explores guidelines and best practices for informing data subjects and obtaining voluntary consent in countries within Globalaw’s APAC region, including Hong Kong, India, Japan, South Korea, and Taiwan.

Hong Kong

In Hong Kong, where the governing body is the Office of the Privacy Commissioner for Personal Data (PCPD), a data user must expressly inform the data subject of the purpose for which the data is to be used on or before collection of the data.

Provision of personal data pursuant to such information by the data subject shall be deemed sufficient consent, which is implied.

However, new consent from the data subject is required if such personal data shall be used for a new purpose. For example, changing policies to begin sharing data with a third-party partner for direct marketing.

For cross-border transfers, the Personal Data (Privacy) Ordinance stipulates, among other requirements, that the data subject must also provide written consent specifically; however, this requirement has not yet come into effect.

India

In India, where the governing body is the country’s Ministry of Electronics and Information Technology (MeitY), principal data subject consent should be free, specific, informed, unconditional and unambiguous.

Also, while seeking consent from data principals, a notice must be displayed informing them about: (i) the personal data and the purpose for which the same has been processed; (ii) the manner in which they may exercise their rights; and (iii) the manner in which the data principal may make a complaint to the board. These basic requirements also apply to consent for cross-border transfer of personal information.

Japan

In Japan, where the governing body is the country’s Personal Information Protection Commission, business operators must clearly outline the purpose of data collection and obtain specific consent for the cross-border transfer of personal information, with certain exceptions.

South Korea

In South Korea, where the governing body is the country’s Personal Information Protection Commission, informed and voluntary consent is essential for collecting and using personal data, unless a legal exception applies.

Additionally, consent for collection, third-party provision, and cross-border transfers must be obtained separately and clearly distinguished.

Since March 2023, amendments have expanded the grounds for data collection to include cases necessary for fulfilling contracts or implementing measures requested by data subjects during the contract formation process. The practical application of these changes continues to develop and adapt.

Taiwan

In Taiwan, where the Taiwanese government is in the process of forming the Personal Data Protection Commission, organisations must expressly inform data subjects when collecting personal data.

Organisations must detail the purposes of collection, types of data, usage scope (including duration, geography, territory, and methods), data subject rights, and consequences of non-disclosure, unless exempt by law. When collection involves planning for cross-border transfers, intended overseas jurisdictions should also be specified.

--

This article is part of a series by our Globalaw APAC Data Privacy & Protection Taskforce members.

Globalaw’s APAC Data Privacy & Protection Taskforce comprises 15 law firms in the Asia-Pacific region with specialized expertise in advising international companies on how to implement and manage a multijurisdictional data protection program.

Taskforce member firms combine a strategic, business-minded approach with cross-border collaboration to help clients build and maintain sophisticated and resilient data practices, effectively mitigate and respond to incidents, and provide sophisticated representation to resolve disputes or regulatory investigations.

Explore the Globalaw APAC Data Privacy & Protection Taskforce brochure for more information and regional contacts.

Disclaimer: The information provided in this article is for general informational purposes only and does not constitute legal advice. Information, including laws and statutes, cited are subject to change and is accurate as of 30 June 2025, but readers should verify such current status. We and our member firms shall not be held liable for any loss and/or damage incurred by any person acting as a result of the information contained in this article. Reliance on this content is at the reader’s own risk, and no attorney-client relationship is formed by reading or acting upon this article. Always seek professional legal counsel to ensure compliance with applicable laws and regulations.

A Data Protection Officer (DPO) ensures that an organisation’s data collection, processing and use complies with applicable data protection rules and regulations. DPOs are generally data protection experts with specialized knowledge and experience. They provide advice and guidance on best practices, compliance, policies and procedures, education and training, risk management and data breach response protocols.

The rapid pace of data creation, accelerated by content generated by AI, social media, streaming, digital transactions and smart technology, has increased government intervention in data governance and protection.

As such, certain jurisdictions require that companies appoint a DPO, while others strongly recommend it. This article explores the DPO requirements, qualifications and responsibilities in countries within Globalaw’s Asia Pacific region, including Hong Kong, India, Japan, South Korea, and Taiwan.

DPO Requirements by Jurisdiction

Appointing a DPO is a recommended practice rather than a requirement in both Hong Kong and Japan. By contrast, South Korea requires most companies to appoint a DPO, except those with fewer than 10 permanent employees.

In India, DPOs are required for significant data fiduciaries. While Taiwan does not require DPOs, certain industries mandate the designation of data protection personnel.

• Hong Kong: Recommended
• India: Required for significant data fiduciaries (to be notified by the government)
• Japan: Recommended
• South Korea: Required for companies with more than 0 permanent employees
• Taiwan: Required by certain industries to designate responsible personnel

Qualifications of a DPO

For Hong Kong, Japan, Taiwan, and South Korea, there are no mandatory certifications, licenses, or qualifications required before someone can be appointed as a company’s DPO.

While there are also no legal or technical qualification mandates for India, a DPO shall be (a) based in India, and (b) be an individual responsible to the Board of Directors or similar governing body of the significant data fiduciary.

Responsibilities of a DPO

The responsibilities of a DPO vary by jurisdiction and, in some cases, by industry and are authorized by the governing authority of that jurisdiction.

Hong Kong

Governing Body: The Office of the Privacy Commissioner for Personal Data (PCPD).

The PCPD provides the following recommendations:

• Establish and implement the Privacy Management Programme (PMP), such as maintaining a record of the organisation's data inventory, conducting periodic risk assessments, and providing training and education.
• Review the effectiveness of the PMP, including preparing an oversight and review plan.
• Report regularly to top management on the organization's compliance issues, problems encountered, and complaints received related to personnel.

India

Governing Body: Government of India, Ministry of Electronics and Information Technology (MeitY)

Under the Digital Personal Data Protection Act (DPDP), the DPO shall represent the significant data fiduciary under the provisions of the legislation and be the point of contact for the grievance redressal mechanism.

Japan

Governing Body: Personal Information Protection Commission

A DPO is not subject to any legally mandated responsibilities.

South Korea

Governing Body: The Personal Information Protection Commission

Under the Personal Information Protection Act (PIPA), the DPO handles personal information for business purposes to comply with the regulations. These responsibilities include:

• Overseeing the handling and protection of personal data,
• Establishing internal policies and safeguards,
• Responding to data subject requests (e.g., correction, deletion),
• Managing incident response for data breaches,
• Serving as the liaison with the Personal Information Protection Commission (PIPC),
• Conducting regular audits and training

Taiwan

Governing Body: The Taiwanese government is in the process of forming the Personal Data Protection Commission.

Only specific industries are required to designate responsible personnel, and sector-specific regulations govern their responsibilities.

--

This article is part of a series by our Globalaw APAC Data Privacy & Protection Taskforce members.

Globalaw’s APAC Data Privacy & Protection Taskforce comprises 15 law firms in the Asia-Pacific region with specialized expertise in advising international companies on how to implement and manage a multijurisdictional data protection program.

Taskforce member firms combine a strategic, business-minded approach with cross-border collaboration to help clients build and maintain sophisticated and resilient data practices, effectively mitigate and respond to incidents, and provide sophisticated representation to resolve disputes or regulatory investigations.

Explore the Globalaw APAC Data Privacy & Protection Taskforce brochure for more information and regional contacts.

Disclaimer: The information provided in this article is for general informational purposes only and does not constitute legal advice. Information, including laws and statutes, cited are subject to change and is accurate as of 30 June 2025, but readers should verify such current status. We and our member firms shall not be held liable for any loss and/or damage incurred by any person acting as a result of the information contained in this article. Reliance on this content is at the reader’s own risk, and no attorney-client relationship is formed by reading or acting upon this article. Always seek professional legal counsel to ensure compliance with applicable laws and regulations.