Chapter 12: East Asia: Advanced Data Governance Models

Introduction

East Asia has become one of the regions that has had the greatest influence in the evolution of modern data governance and digital regulatory systems. With the growing reliance of the global economy on data-driven technologies, governments across East Asia have put in place detailed policies to govern the gathering, handling, storing, sharing, and safeguarding of personal data. The region is a special place in the international privacy landscape, with cutting edge technological innovation and a variety of political, legal and cultural approaches to govern. Data protection models from East Asia therefore provide key insights into the question of how countries can make sure to promote economic growth, technological development, national security and respect for privacy interests.

Countries like Japan, South Korea and China are among the world's most digital societies and are a leader in AI, cloud computing, fintech, telecom, robotics, e-commerce, and big data. These sectors have grown at a very fast pace, leaving unprecedented amounts of personal and commercial data that require robust governance to ensure public trust, protect individual rights, and facilitate sustainable digital transformation. Meanwhile, concerns over cybercrime, data leaks, surveillance, transborder data processing, and algorithmic decision-making have led to a push for governments to toughen up their policy-making and enforcement.

Even though all three (Japan, South Korea, and China) are geographically close and economically interdependent, their approaches to data governance are vastly different. The framework provides for individual rights and is similar in many respects to international privacy frameworks, with a particular focus on transparency, accountability, and interoperability with other international frameworks, like the General Data Protection Regulation (GDPR) of the European Union. South Korea has one of the strictest and most technologically advanced privacy regimes in the world, which features a robust framework of protections for data subjects, extensive consent regimes, and strong enforcement mechanisms. In contrast, China's method involves a mix of privacy protection and other goals, such as national security, social stability, digital sovereignty, and state control of data resources. The different approaches are a reflection of differing legal traditions, governance, economic priorities and societal values.

East Asian data governance frameworks are not just confined to the region. Multinational companies are growing more active in multiple countries, and the regulators of the region have a significant impact on international standards, strategies of compliance, and data flows. This area has seen the emergence of key challenges like data localization laws, digital identity frameworks, cross-border data transfer protocols, cybersecurity regulations, and AI governance frameworks. The experiences of East Asia have been of interest to policymakers both at the international and national levels when formulating new legislation or reforming the privacy regime.

Moreover, how data is considered as a strategic national resource in the 21st Century is demonstrated in East Asia. Data is increasingly seen by the government not as a matter of personal privacy but as a valuable resource with economic, social and geopolitical implications. This point of view has inspired the creation of regulatory frameworks that aim to maximise the benefits of data-driven innovation but also to minimise risks stemming from misuse, unauthorized disclosure, cyber security risks and digital inequality. Therefore, data governance in East Asia has a wide scope of goals, including consumer protection, economic competitiveness, technological leadership, public administration efficiency, and national security.

Digital transformation continues to be a major factor in the region, with the COVID-19 pandemic spurring a further acceleration in digitalization, which in turn has presented opportunities and challenges for large-scale data collection and processing. Governments used digital technologies extensively to monitor public health, to track contacts, to facilitate remote work, to provide online learning and to deliver services electronically. These developments further fuelled debate on the balance between public interest goals and privacy, and highlighted the need for broad and flexible governance mechanisms to address the ever-changing technological landscape.

The chapter considers the advanced data governance models created by Japan, South Korea and China, showing the legal basis, institutional frameworks, enforcement mechanisms and policy agendas of these approaches. It discusses the approaches taken by each country regarding personal data protection, cybersecurity, cross-border data transfers, digital innovation, and regulatory compliance. The chapter ends with a comparative overview of these systems and learning from them to build effective and resilient data governance frameworks in other parts of the world. In this examination, East Asia becomes a key example of the different ways in which societies have managed their data in the digital era and how they can seek a wider economic and political goal.

12.1 Japan

The Japanese data protection legislation is renowned as one of the leaders in Asia and is often looked upon as a blueprint for other Asian countries to follow in striking a balance between privacy protection, economic growth, technological advancement, and international collaboration. Japan is one of the world's most digitally advanced economies, and has a sophisticated regulatory approach that aims to balance the protection of privacy rights with the advancement of digital transformation, AI development, cloud computing, e-commerce, and data sharing across borders. The country's approach is grounded in international standards and an appreciation of the benefits of data governance for consumer protection and economic competitiveness in an ever-changing and digitally driven landscape.

The Act on the Protection of Personal Information (APPI), as its name implies, is the backbone of Japan's data protection laws, which were first established in 2003 and have since seen several major amendments in 2015, 2020 and 2022. The reforms aimed to bolster individual rights, increase the accountability of organisations that process personal information, increase transparency of data processing and make Japanese law comply with international privacy standards, particularly those established by the General Data Protection Regulation (GDPR) of the European Union. APPI continues to evolve with new technologies and society's expectations to address privacy needs in an evolving and ever-changing world (Greenleaf, 2023).

Strong Legal Framework (APPI)

The APPI is the main legal mechanism for collection, processing, storage, transmission and disclosure of personal data in Japan. The law is applicable to both the public and private sector, and lays out clear responsibilities for companies that process personal data. Organizations are required to define the objective of collection of personal information, maintain it for only the list of objectives and take suitable measures to ensure that data is not accessed, lost, altered or disclosed by the third party otherwise. The law also gives individuals essential rights about their personal data, such as access to, correction of, and the ability to have their data deleted—for example, when it may be inaccurate—suspension of data use for a certain period of time.

The transparency and accountability of APPI is one of the salient features. Organisations should have clear privacy policies, provide information to individuals about how their data will be used and have procedures in place for addressing complaints and inquiries. These obligations will help build consumer confidence in the businesses they deal with and promote responsible data management across the economy. The further requirement of the APPI is that of notification. Notification obligations are added on the data controller to strengthen the accountability of the organizations and limit the possible harm caused to the data subjects in the event of a major data breach (Kshetri, 2022).

Personal data such as data about race, religion, medical history, criminal history and social status are also covered by the law. This information usually needs to be collected or processed with greater safeguards, and in most instances, explicit consent before it is collected or processed. This is because there is an increasing international understanding that some types of personal data are more likely to be a threat to individual privacy and thus need extra protection.

Define consent requirements and individual rights.Explain consent requirements and individual rights.

Consent is one of the key guiding principles of Japan's data governance regime. Organizations are required to get consent from an individual before they can collect or transfer personal information to a third party, especially when that information is exchanged between organizations and/or countries. Consent mechanisms are designed to give people more choice over the way their personal data is used and increase trust in digital services.

Besides with consent, Japan has also enhanced data subject rights under the latest amendments to the APPI. Users have more rights to access their information, have it corrected if it is inaccurate, and demand to have it deleted or suspended when the legal bases are not fulfilled. These rights increase transparency and accountability and brings Japan in line with internationally known privacy principles in such regulations as GDPR (PPC, 2023).

Data Security Obligations

Data security is a key concern for Japan, particularly when it comes to protecting privacy. Organizations must take reasonable measures to safeguard information with technical, administrative and physical controls against unauthorized access to the information, cyberattacks, data breaches, and loss of information. Companies need to evaluate and identify the risks related to data processing activities and implement security measures that are appropriate to the sensitivity of the information handled.

Japanese regulators have raised the bar on cybersecurity governance as cyber threats have become more common. Comprehensive security management systems, regular audits, employee training and incident response procedures are encouraged for organizations. These are measures that enable the protection of individuals against breaches of privacy, and are also contributing to the general national cyber security goals. Incorporating privacy and cybersecurity standards is a growing practice across diverse data governance systems globally (OECD, 2023).

Cross-Border Data Transfer Controls

Japan is a very globalized economy and it is aware of the critical importance of allowing international data flows, while at the same time ensuring sufficient privacy safeguards. The APPI sets standards of transfer of information outside of Japan and imposes obligations on organizations to make sure that countries or entities of which the information is transferred to provide equivalent degrees of protection. In many cases, someone will need to be advised of the overseas transfer and the privacy protections that will be in place to protect their information.

The Japanese method aims to eliminate needless obstacles to foreign trade while at the same time providing proper protection for personal data transferred overseas. This balance is especially critical for multinational corporations, financial institutions, technology companies, and digital service providers who engage in significant cross-border data processing operations. The framework illustrates a possible way to balance privacy protection with global economic integration in a comprehensive regulatory framework (UNCTAD, 2024).

Independent Oversight and Regulatory Enforcement

One of the key features of the Japanese data governance model is the existence of an independent data governance regulatory body called the Personal Information Protection Commission (PPC). The PPC was set up in 2016 to manage adherence to the APPI, to provide guidance to organisations, to investigate any instances of non-compliance, and to ensure that the legal requirements are complied with. The commission acts as the main body in charge of the enforcement of the privacy laws in the various sectors.

The PPC has wide regulatory powers, such as investigating, recommending remedies, mandating corrective measures and penalties where necessary for non-compliance. The commission also has a significant role in raising awareness among organizations and the public on privacy rights and responsibilities. The PPC fosters awareness of responsible data governance in Japanese society by sharing guidelines, best practices, and compliance frameworks.

The independence of the PPC increases public trust in the system and helps to guarantee the objectivity and transparency of the enforcement process. One of the reasons that Japan has consistently been able to achieve high standards of privacy protection while fostering innovation and economic growth is due to effective regulatory oversight (PPC, 2023).

International Alignment and GDPR Adequacy

Aligning with international privacy standards has been one of the most notable accomplishments in data governance in Japan. Japan was the first Asian country to be granted an adequacy decision by the European Union in 2019. In doing so, the decision established that Japan's data protection framework offers the level of protection essentially required under GDPR, thus allowing the free flow of personal data between Japan and EU member states without requiring any further legal safeguards.

The adequacy arrangement was a first-of-its-kind milestone in global privacy law as it showed that other jurisdictions would be able to meet GDPR requirements and develop a privacy framework in a way that was compatible with GDPR requirements, yet kept their own legal traditions and governance system. The agreement has bolstered the economic relationship between Japan and Europe, promoted cross-border business activities, and promoted Japan's image as a reliable data processing and digital investment hub (European Commission, 2023).

Japan is committed to engaging in international dialogues on digital governance, cybersecurity, artificial intelligence regulation and cross-border data flows beyond Europe. The government is a strong proponent of “Data Free Flow with Trust” (DFFT) principles, which aim to encourage trust and secure international data transfers while upholding privacy and security concerns. The idea has been featured prominently in international forums such as the G20 and OECD, as governments look for answers to the difficulties of digital integration in the world.

Business-Friendly Regulation and Digital Innovation

Japan has taken a more balanced approach compared to some regulatory frameworks where the emphasis is on data usage control, aiming to balance safeguarding privacy and fostering innovation. Policymakers have come to understand that data is an important asset for economic development, scientific research, technological progress, and provision of public services. The Japanese regulatory regime is therefore aimed at promoting "good use" of data, while ensuring adequate protection for data subjects.

This business-oriented attitude has helped Japan in areas like artificial intelligence, robotics, healthcare technology, fintech and smart city development. Compliance uncertainty is minimized and investment is encouraged, as the clear legal requirements and regulatory predictability and good international interoperability combine to reduce uncertainty. Meanwhile, consumers are also provided with important safeguards on the use and disclosure of their personal information.

One of the models that is often referenced in relation to effective digital governance is that of Japan.The Japanese model for balancing innovation and privacy is often referred to as a successful example of digital governance. The promotion of economic development and privacy protection are not mutually exclusive goals, but can be complementary elements of a sustainable digital economy, according to Japanese policymakers (World Bank, 2023).

Japan as a Bridge between East and West.

Japan's Data Governance is in a unique place in the world of privacy. The country's legal system reflects a number of principles found in the West, such as transparency, accountability, individual rights and independent oversight. Concurrently, it is vulnerable to the economic agendas, cultural values and technological development targets that are specific to East Asia.

This makes Japan sometimes likened as a link between the Western privacy systems and Asian digital governance systems. Its experience shows that robust privacy safeguards are compatible with economic competitiveness, technological innovation and international cooperation. The Japanese model is relevant to the countries that are looking to use a data governance system which is compatible with the global environment and relevant to the local context.

12.2 South Korea

South Korea is considered one of the world leaders in data protection and privacy regulation with one of the most comprehensive and strict laws to protect personal information. South Korea is a very digitalized society, and has one of the highest internet penetration rates around the world, and has been aware of the need to create strong governance frameworks to safeguard the privacy of personal information while facilitating technological advancement and economic growth. As the experience of the country illustrates, privacy can be robust and effective in the face of advanced digital transformation and South Korea is a positive example of how well privacy can be managed in the Asia region and globally.

Rapid economic growth and technological advances have equipped South Korea with cutting-edge industries, including information and communication technologies (ICT), artificial Intelligence (AI), telecommunications, e-commerce, fintech, and smart city solutions. This has created enormous amounts of data, both personal and commercial, that has led to both the benefits of using data for innovation, as well as the dangers of privacy breaches, cybercrime and unauthorized use of data. This has led policymakers to create a framework of policies that emphasizes the safeguarding of the rights of individuals while also allowing organizations to continue using data to make an impact on the economy and technological progress.

The Personal Information Protection Act (PIPA) is considered to be one of the most comprehensive privacy laws in Asia that is comparable to the EU's General Data Protection Regulation (GDPR) and is at the heart of South Korea's privacy legislation. The PIPA was adopted in 2011 and strengthened by several amendments; it contains complete regulations on the collection, processing, use, storage, disclosure and transfer of personal information. It is applicable to both the public and private sectors, providing a standardized approach to privacy protection nationwide (Kim & Park, 2022).

This is the Comprehensive Privacy Law (PIPA).

South Korea's data governance system is based on the Personal Information Protection Act. Whereas in other jurisdictions privacy laws are spread out among various laws and industries, PIPA is overseen by one unified set of laws, applicable to government agencies, corporations, educational institutions, health care providers, etc.

The law sets out clear rules for the lawful processing of personal data, and it puts the emphasis on key privacy principles, like transparency, accountability, fairness and individual control. The organizations should make an explicit statement about the reason for collecting data, secure the consent of the person where necessary, and restrict the use of data to specific and legitimate purposes. Any processing operations that go beyond the purpose of the original processing will likely need further legal basis or reconsent from the data subject.

A key characteristic of PIPA is that it is very focused on protecting individuals across the entire data life cycle. The law applies to collecting, using, sharing, retaining and ultimately destroying information. Organizations should have robust systems in place for the secure handling and elimination of personal information when it is no longer needed for the purpose for which it was gathered. This lifecycle approach is in line with the efforts of South Korea to reduce privacy risks and foster responsible data management practices (PIPC, 2024).

Consent Requirements

Consent is a key component of South Korea's privacy regime. PIPA calls for informed and voluntary consent as a general principle to the collection and processing of personal information. The individual should be informed of the types of information that will be gathered, why it is being gathered, the intended use of the information, and whether it will be shared with third parties.

The consent process seeks to give individuals control over their personal information by having meaningful control over it. Consent should be specific, informed, and freely given, making it harder for organizations to use broad or general consent as justification.Specific and informed consent, and consent that is freely given, reduces the possibility that organizations will rely on general or vague consent. Further safeguards are in place for the protection of data involving minors and other sensitive personal data, due to increased concerns about sensitive groups and high-risk category data sets.

The strict consent rules in South Korea have helped to build trust in digital services and foster more transparent and accountable data practices.

Data minimisation and purpose limitation.

Data minimization" is one of the main tenets of the South Korean data governance model. All organizations must gather information that is only needed for clearly established and legitimate purposes. Practices of data over-collection are not encouraged as it raises the risk of intrusion on privacy and misuse or unauthorized disclosure of the data.

The principle of purpose limitation is closely related to data minimization. Personal information can only be used for the initially communicated purpose of collection. Additional consent or legal authorization is generally needed if an organization wants to utilize data for new or different purposes. These principles ensure that personal information is used in responsible ways and minimise the risks of the phenomenon of ‘function creep' – the gradual use of information meant for one purpose for other unrelated activities without the consent and awareness of the individual concerned (OECD, 2023).

Data retention and destruction requirements.

The importance of protecting personal information is a major concern in South Korea. Organizations are not permitted to keep personal data forever and should have guidelines to securely delete information after it is no longer needed. Retention must be based on legally, regulatory and/or operationally required needs and there should be mechanisms in place to ensure appropriate disposal of unnecessary data in a timely manner.

They are designed to minimize the dangers of data storage, such as cyber attacks, accidental disclosure, and unauthorized access. South Korean's regulatory framework helps to protect privacy while at the same time facilitating effective information governance, by providing guidance for organizations to keep only the information they need.

Strong Enforcement Mechanisms

South Korea is regarded as having a very effective data governance framework, largely because the framework has robust enforcement mechanisms. The primary mechanism for regulatory oversight is through the Personal Information Protection Commission (PIPC), an independent body that monitors compliance, investigates misuses, provides guidance and penalties.

The PIPC has broad investigative authority, the capacity to demand information and correct orders when it identifies privacy violations, and has the power to audit. For more severe cases, the commission can levy heavy administrative fines and sanctions. Severe fines, damage to the reputation, and legal liability could result for organizations that commit serious offenses.

Good governance is reinforced in South Korea by the efficacy of the enforcement mechanisms and can help to make privacy and cybersecurity a key focus of corporate governance. This proactive approach to regulation has helped ensure greater compliance, than many other jurisdictions (Greenleaf, 2023).

Data Breach Notification Requirements

South Korea is one of the most strict countries in Asia for the notification of data breaches. If an organisation suffers a data breach where personal data is involved, they must notify the affected individuals and the relevant organisations in a timely manner. All notifications should provide information about the type of breach, the information involved, any potential risk involved, and any remedies that are being instituted to minimize harm.

There are several key reasons why rapid notification of a breach is important. First, it allows individuals to take action to protect themselves, that is, changing passwords, watching financial accounts, or take other steps to protect themselves. Secondly, it increases the transparency and accountability and provide a way for organizations to not hide security incidents from anyone. Third, it spurs businesses to build more robust cybersecurity measures to prevent legal and reputational risk from disclosure of any breaches.

As cyberattacks have become more frequent and sophisticated around the world, South Korea's focus on breach reporting is also becoming an important part of its overall data governance approach (UNCTAD, 2024).

General public has a high level of awareness about privacy rights.

One of the other unique features of South Korea's privacy landscape is the high degree of public awareness of privacy concerns. South Koreans are highly involved in digital technologies, such as online banking, mobile payment, social media, e-services, and government digital services. This broad digital interaction has raised general awareness of the privacy risks and raised awareness of the need for responsible treatment of data.

Public awareness campaigns are regularly organised by government agencies, educational institutions and civil society organizations to educate citizens on their privacy rights, cyber security threats and responsible online behaviour. This has led citizens to be much more educated on issues like consent, data breaches, identity theft, and information security compared to many other countries.

The awareness can also provide further motivation for organizations to abide by privacy laws as consumers become more aware of how they collect and handle data when choosing products and services. Thus, public engagement serves as an important complement to formal regulatory enforcement.

Advanced Digital Ecosystem and Innovation

The cutting-edge digital infrastructure in South Korea has played a crucial role in the country's economic development and technological advancements. The country has always been among the leaders in the area of broadband connectivity, mobile network deployment, digital government and technology utilization. The data collection and analysis are essential for emerging technologies like autonomous vehicles, smart manufacturing, blockchain, cloud computing, and artificial intelligence.

Data is used across the economy, which presents opportunities and challenges. Data-driven innovation drives economic competitiveness and public services, on the one hand.On the other hand, data-driven innovation drives economic competitiveness and public services. Conversely, more data processing means that privacy, surveillance, discrimination and cybersecurity issues are concerns. South Korea's regulatory policy works to solve these problems by providing a structured environment to ensure the protection of personal rights, and promote public trust for innovative creation.

In recent years, regulatory reform has been going on to ensure data use in a responsible way for research, innovation and AI development without compromising the existing strong data privacy protection measures. These are actions that are occurring in the context of an emerging understanding that effective data governance must go beyond protecting data, yet also embodying innovation (World Bank, 2023).

The role of South Korea in global data governance. International role of South Korea in data governance.

The Republic of Korea is playing a more prominent role in international discussions on privacy regulation, cybersecurity cooperation, AI governance, and cross-border data flows. It has an extensive body of law, robust enforcement powers and a technologically sophisticated economy to inspire other policy makers to create robust privacy rules for the digital era.

State policy illustrates that privacy protections do not have to impede innovation. Rather, robust governance structures have the potential to build trust among the public, foster sustainable innovative processes and boost economic competitiveness. As a result, the Republic of Korea is often used as a case study in how countries can effectively incorporate privacy into the overall digital transformation agenda.

In general, the South Korean approach to data governance is characterized by robust measures to safeguarding personal information and enabling a thriving and creative digital economy. The country has put in place extensive legislation, effective regulation and enforcement mechanisms, and high public awareness to create one of the most robust privacy regimes in the world, and is a major player in the future of global data governance.

12.3 China

China has built one of the most comprehensive, complex and government-centric data governance systems to date. With the second largest economy in the world and its high ranking in digital innovation, artificial intelligence, e-commerce, telecommunications, and fintech, China has identified data as a key strategic resource for economic development, technological advancement, national security and social governance. Unlike the western privacy frameworks that are mainly based on the principles of individual rights and personal autonomy, the Chinese concept of data governance combines data privacy with other goals such as state security, digital sovereignty, economic competitiveness, and social stability. This unique model has brought China into a major role in influencing the global discussion about the future of data governance and digital regulation.

As China undertakes a digital transformation, a vast amount of data has been created on the numerous online platforms and mobile payment systems, social media networks, smart cities, cloud computing services and artificial intelligence applications. It is home to some of the world's biggest digital platforms and technology firms that are used by hundreds of millions of people, and process terabytes of personal and commercial data every day. With the prevalence of digital technologies in economic growth and national development strategies, Chinese policymakers understood the importance of establishing strong data governance and control mechanisms to ensure the safe collection, processing, storage, sharing and transfer of data, as well as social stability and the protection of national interests.

In the last 10 years, China's government has enacted a number of important laws that all together constitute the backbone of its current data governance framework. The Cybersecurity Law (CSL) (1901/2017), the Data Security Law (DSL) (1901/2021), and the Personal Information Protection Law (PIPL) (1901/2021) are among these laws. These laws create a comprehensive cybersecurity, personal information protection, data categorization, cross-border data transfers and national security regulation system. These laws are integrated, embodying China's holistic data governance framework, where the protection of privacy, security, and state interests are seen as interdependent policy goals (Creemers, 2022).

Legal framework of China's data governance system

The data governance system in China is built around three key laws governing the development of digital economy.

The Cybersecurity Law (CSL) lays the groundwork for the cybersecurity governance regime and creates obligations for cybersecurity and critical information infrastructure security for network operators and data protection for data owners. Compliance with the law involves organizations’ technical measures to protect the security of their information, their awareness of cybersecurity risks, and their interaction with government agencies regarding national security and law enforcement issues.

The Data Security Law (DSL) broadens the scope of regulations from personal data to commercial, industrial, scientific and government related data. The DSL has adopted a risk-based classification framework that classifies data based on its criticality for national security, economic development and public interests. Compliance requirements and regulatory oversight are looking for organisations with important and sensitive data.

The Personal Information Protection Law (PIPL) is similar to the GDPR, which will provide similar protections for personal information and give consumers rights over the collection and use of their data. PIPL is also part of a wider governance framework in the context of China, where the interests of the state and national security concerns are emphasized over many privacy laws in the west (Zhang & Daum, 2023).

Combined, these laws form one of the most comprehensive regulatory frameworks that controls data in today's world, impacting domestic institutions, foreign firms and companies operating in China, and international businesses using Chinese data.

Data Sovereignty as a Strategic Principle

Data sovereignty is a key element of China's data governance strategy. In this sense, data created in China is considered its own national resource, therefore subject to Chinese laws, regulations and government supervision. Data has become a crucial tool for economic growth, technological advancement, and national security, making it an asset of increasing importance to Chinese policymakers, akin to natural resources, infrastructure, or financial capital.

Data sovereignty is a reflection of China's overall goal of exerting control over key digital assets and diminishing reliance on foreign technological systems. Security concerns, economic threats and foreign influence are all cited by policymakers as reasons for restricting the free flow of data across international borders. To this end, regulatory measures have been put in place to make sure that key information is available to the local authorities and is not subjected to external threats.

Its focus on data sovereignty has had a broad impact on various aspects of Chinese digital policy, such as the regulation of cloud computing, cybersecurity laws, AI advancement, and cross-border data transfer policies. This is very different from many Western legal systems, which typically give priority to the free and unhindered circulation of information across borders, but have implemented privacy protection measures to shield individuals from interference with their privacy rights (UNCTAD, 2024).

Harsh Data Localization Laws

Data localization is a key component of China's data governance framework. According to Cybersecurity Law and regulations, there are some types of information, such as important information, sensitive information and information related to critical infrastructure, that can only be stored within the Chinese territory while exceptions are granted for international transfers only in specific situations.

The rationale for data localisation provisions is to reinforce national security, increase regulation and ensure access to data in case it is needed for law enforcement and/or public policy purposes. Certain businesses, like telecommunications, financial, healthcare, transportation and energy companies can have specific localization requirements.

Compliance with China's localization requirements can be a costly endeavor for multinational corporations, requiring substantial investments in local data storage systems, cloud-based services, and compliance management tools. While these demands can cause difficulties for businesses used to processes and data flows that are global, they are a core part of China's digital governance strategy.

Supporters say that localization will make cybersecurity more resilient and give countries greater control over strategic information resources; critics believe that it could raise compliance costs and pose challenges to global digital trade. However, data localization is still a key pillar of China's regulations (Kshetri, 2022).

Government Oversight and National Security

One of the key characteristics of China's data governance is the high level of government involvement. The authorities have wide access to, inspection and control over data in the event of a national security, public safety, social stability or law enforcement issue.

Organizations must normally cooperate with government investigations and give access to information upon request of the government. Regulatory bodies can audit and inspect compliance, investigate non-compliant behaviours and take corrective action. The extent of state involvement indicates China's perspective to data governance not only for economic and privacy goals, but also for national interests.

As digital technologies become more strategic, the role of national security has grown in importance for data governance. Advanced technologies such as artificial intelligence, cloud computing, telecommunications networks and massive data analysis are considered essential for national competitiveness and security. Thus, in many cases, Chinese laws tend to favour the systems and structures it has established to give the government a means of having visibility of key data-related activities.

This is very unlike most democratic privacy models where regulation is generally concerned with individuals' rights against over-ambitious government surveillance and personal data being used for purposes other than those intended (Creemers, 2022).

Personal information protection and individual rights

China is often described as "state-centred," but the Personal Information Protection Law has added significant individual privacy protection provisions. PIPL sets out fundamental rights for data subjects - namely the rights to be informed about their personal data, to request rectification, to be informed about the processing activities, and, under certain conditions, to request deletion of personal data.

Organisations should obtain informed consent before collecting or processing personal information, clearly communicating the purposes of the information being used, and ensuring that security measures are in place to prevent the information being accessed or disclosed by unauthorised parties. Further protection is provided for sensitive personal data, such as biometric data, financial data, medical data and location data.

PIPL also introduces the duties of transparency, accountability and responsible data handling. Violations of privacy can incur serious consequences for the organization, such as for large populations of individual users or in respect to special classes of information. Such measures reflect China's growing awareness of the significance of privacy issues in digital governance, alongside a context where state interests and security concerns are paramount (Wang & Sun, 2023).

Regulation of Large Technology Companies

The Chinese government has imposed a wide range of regulations on the big-tech firms and digital platform operators. Compliance requirements are rigorous for large companies like Alibaba Group and Tencent, as well as other digital companies, on data management, competition policy, cybersecurity and personal information protection.

Over the past few years, regulators have rattled the Chinese platform companies' cages regarding market concentration, consumer protection, algorithmic governance and data security. Large-scale businesses that have a large volume of personal data may also need to perform security assessments, create an extensive compliance program, and submit regulatory audits for certain business activities.

The supervision of tech companies is part of China's larger strategy of controlling the innovation of private companies. The use of digital platforms is also a key enabler of economic development and technological innovation, but regulators want to prevent an excessive concentration of data and market power that could threaten the public interest or national security objectives (Zhang & Daum, 2023).

Any restrictions on cross-border transfers of personal data. Restrictions on cross-border transfers of personal data.

China has put some of the strictest restrictions in place on data transfers across borders. Entities wishing to send certain types of data abroad may need to submit to government security assessments, or receive regulatory approval or contractual or compliance requirements imposed by government authorities.

These restrictions are intended to provide security of strategic data and to prevent risks to national security or public interests associated with transferring overseas. Some of the considerations that may be made in assessing security include the sensitivity of the data, the receiving organization, the destination jurisdiction, and the consequences of any unauthorized disclosure.

These demands place a heavy burden on multinational firms as it may be necessary to conduct in-depth risk assessments, documentation, and interactions with regulatory bodies prior to data transfers. However, these restrictions align with China's overall principle of data sovereignty and regulatory control (OECD, 2023).

China's involvement in global data governance. China’s role in shaping global data governance.

The data governance model of China has generated widespread global interest due to its scope, complexity and influence. China's regulatory actions have repercussions for other countries, global digital commerce and international standards for technology. China's strategy is something that a number of developing countries are looking into with regard to data governance.

China's example marks another approach to digital governance—the one that emphasizes how the government should prioritize security, national safety, and strategic control of data resources. This is much more than a rights-based model of privacy that is common in Europe and North America, but it shows how governments can combine privacy regulation, cybersecurity governance, and economic policy into a single regulatory framework.

China's experience will continue to be a key consideration in discussions about future global data governance systems, as technology and institutions evolve in the face of ongoing debates on the nature of artificial intelligence, digital sovereignty, cybersecurity, and international data flows. In its framework, the realisation of the value of data as a strategic resource, not just a commercial asset, with implications for economic development, political authority and national security, is increasing.

12.4 Comparative Analysis

A review of Japan, South Korea and China indicates some of the most advanced and influential data governance systems on earth. While all three countries view the need to safeguard personal data, foster digital innovation, and regulate the burgeoning digital economy, the countries' regulatory philosophies, institutional structure, enforcement methods, and policy priorities vary widely. There are also differences in political systems, legal traditions, economic development strategies, cultural values and national security concerns that are reflected in these differences. Therefore, East Asia is not a monolith of data governance but a variety of approaches that highlight multiple routes for data governance in the digital era.

The data governance landscape in Japan, South Korea and China has been developing in parallel to other technological developments – such as the rise of artificial intelligence, cloud computing, big data, digital platforms, cyber threats and cross-border data transfers. But every country has come up with its own solutions to meet the states' particular governance goals. While the Japanese focus on interoperability and economic competitiveness, the South Korean approach prioritizes robust privacy measures and individual rights, and China's approach places privacy at the heart of more comprehensive discussions of national security, digital sovereignty and state control. The two contrasting approaches offer insightful perspectives on balancing competing interests and interests in increasingly data-driven societies (Kshetri, 2022).

The protection of private rights and orientation.

One of the most important distinctions between the three countries is that individual privacy is not part of the regulatory scheme in any of the two European countries. The most important distinction between the three countries is that the individual privacy is not part of the regulatory scheme in either of the two European countries. Overall, South Korea is considered to have the most rights-oriented privacy law in East Asia. This Personal Information Protection Act (PIPA) has a strong emphasis on protection of individual rights, informed consent, limitation of collection, purpose specification and individuals' right to extensive control over their personal information. The South Korean privacy regime is based on the principle that personal data is the property of the person and can only be used under strict legal conditions. This strong rights-based approach is similar to privacy approaches in Europe and has helped South Korea establish its image as a privacy protection leader in the world (Kim & Park, 2022).

Unlike the United States, Japan takes a more balanced approach to privacy that aims to foster innovation, international trade and technological advancement while safeguarding privacy. The Act on the Protection of Personal Information (APPI) has adopted many of the internationally recognised principles of privacy such as transparency, accountability and rights of the data subjects. However, Japanese policymakers as a whole focus on balancing protection of rights with economic growth. This makes Japan's system somewhat flexible and pragmatic for organizations to use data responsibly, and ensures trust and regulatory compliance.

China's strategy is quite different from that of Japan and South Korea. The Personal Information Protection Law (PIPL) offers substantial protection to any individual, but privacy rights are embedded in a wider governance framework that emphasizes national security, social stability and state interests. Protection of privacy in China is not only a matter of securing individual rights, but also a part of an overall data resource protection system to ensure secure and orderly data resource management. As a result, state authorities have a broad range of monitoring capabilities, and privacy concerns are frequently weighed against state interests, such as security and public administration (Creemers, 2022).

These conflicting notions of privacy provide an example of the influence of political and social values on the development of regulatory systems. In South Korea, privacy is about personal autonomy, for Japan, it is about balance and flexibility, and for China, it is embedded in a more state-centric governance model.

Certain remedies are provided by the regulations and enforcement mechanisms.

The strength and structure of regulatory enforcement is another factor of importance to compare. Legislation alone cannot be effective in ensuring privacy, but it requires the capacity of regulatory bodies to enforce it and enforce real penalties for non-compliance.

South Korea is known to have some of the toughest enforcement systems in the region. The Personal Information Protection Commission (PIPC) has a wide range of investigative powers and has the ability to administer significant fines and corrective actions on those organizations that fail to comply with privacy laws. Breaches of data, unauthorized disclosure, failure to abide by consent requirements can lead to severe penalties. This has led to the emergence of a strong enforcement culture, making privacy management and cyber security an essential part of corporate governance. South Korea's system is, therefore, considered to be one of the most successful systems of privacy enforcement in the world (Greenleaf, 2023).

Japan has a more cooperative, but still effective, approach to enforcement via the Personal Information Protection Commission (PPC). The PPC retains strong enforcement capabilities, including the ability to recommend sanctions, enforce remedial measures, and monitor compliance, although the level of sanctions is typically not as severe as in South Korea. In addition to formal enforcement, Japanese regulators frequently emphasize guidance, education and cooperation. This is in line with Japan's general principle of "regulatory ratioing," in which regulation and facilitation of businesses are coupled with support for innovation.

The model adopted by China is an enforcement model, which is highly centralized and of governmental authority. Regulatory authorities have wide jurisdiction to investigate organisations, perform security evaluations, call for remedial action and take appropriate penalties. Enforcement actions are not just about privacy protection, but also cybersecurity, national security, competition policy and other aspects of digital governance. As a result of the centralization of the Chinese regulatory system, it is possible to enact policies quickly, but it also indicates that the Chinese government is central to the regulation of digital activities and data management practices ( Zhang & Daum, 2023).

International cooperation and integration at global level.

Another key difference lies in how integrated each country is into the global data governance systems and international regulatory frameworks.

Japan is the most globalised of the three countries. It has been carefully crafted to meet global data governance standards, notably the EU's General Data Protection Regulation (GDPR). The adequacy decision granted by the European Union to Japan marks a major step in the international exchange of privacy data, allowing for the safe and seamless transfer of data across borders and enabling greater economic cooperation between the EU and Japan. Japan is actively engaged in international efforts related to digital governance, cyber security cooperation, AI regulation and trusted cross-border data transfers. The country's support for the notion of "Data Free Flow with Trust" (DFFT) also underscores its international cooperation and interoperability (OECD, 2023).

South Korea has also been becoming more deeply involved in international privacy governance systems. The country regularly engages in international regulatory dialogues, and has adopted privacy laws with many parallels to European and other progressive privacy laws. South Korea's robust privacy regulations make the country a desirable location for foreign companies to conduct business and online investments. While the nation is not as internationally connected as Japan yet, Korea is still making efforts to deepen its involvement in international privacy and cyber security initiatives.

China's integration with the rest of the world is more selective. Chinese authorities are actively involved in international talks on digital governance and technology regulation, but more focused on maintaining autonomy of regulation and national sovereignty. The cross-border cooperation is frequently subject of security, economic and state factors. This means that the integration of China into international privacy regimes is less extensive than in Japan and South Korea, with China's commitment to data sovereignty and self-governance in privacy.

Data Flow Policies and Cross-Border Transfers

One of the most critical and controversial areas of data governance today is cross-border data transfers. With the expansion and growth of organizations operating across national borders, governments are faced with the challenge of enabling international data flows while safeguarding privacy, security and national interests.

Japan has one of the most liberal policies in East Asia for allowing the transfer of data across national borders. The APPI permits cross-border transfers with the appropriate protection and safeguards. Japan's adequacy agreement with the European Union is a good example of how it has pledged to ensure a variety of international exchanges of data with a high level of privacy. This transparency is conducive to international trade, e-services, cooperation for research and innovation.

South Korea also allows international data transfers, with strict regulatory frameworks that ensure sufficient protection of personal data. Data must be transferred with consent and security measures must be put in place to protect the data. The framework will impose compliance obligations, but be relatively supportive of international business operations and international digital trade. South Korea is thus described as a "controlled but open" approach because it considers economic integration to be paramount and respects privacy protection (PIPC, 2024).

China has the strictest stance of the three countries. The transfer of data across borders that includes personal, important, or sensitive data can involve security assessments, regulatory reviews, and compliance with a multitude of legal obligations. Data localization laws restrict the transfer of some types of data to overseas locations. These limitations are closely tied to China's principles of data sovereignty, national security and regulatory control. International data transfer is allowed under certain conditions, but is much more closely monitored in Korea than it is in Japan (Wang & Sun, 2023).

Ensuring innovation, security and privacy.

While there are some differences, all three nations have common issues to balance technological innovation, economic development, cybersecurity and privacy protection. The recent developments of AI/Machine learning, IoT (Internet of Things), cloud computing and digital platforms have not only given greater opportunities for growth but also brought great challenges for governance.

In general, Japan has adopted a prudent approach to achieving a balance between innovation and privacy rights and ensuring international compatibility. While emphasizing individual rights, South Korea also advocates for proper use of data and good regulations for technology advancement. China emphasizes on security, sovereignty, and state supervision and fosters technological development as a national strategic goal.

The different approaches reflect the absence of a “one-size-fits-all” model for data governance. Rather, countries mold regulatory regimes to their specific political institutions, economic priorities, cultural norms and strategic interests. The variations found in East Asia reflect the complexity in managing data in the dynamic technological landscapes and the need for context-specific policy solutions (World Bank, 2023).

Lessons learned from East Asian Data Governance Diversity

Comparative study of Japan, South Korea and China shows there are multiple data governance forms that are effective. Every country has established a framework in line with its overall philosophy of governance and national goals. Japan is a prime example of how international alignment and regulatory balance is beneficial. As South Korea shows, effective privacy protection and enforcement can be achieved. China offers a model of embedding data governance into national security, economic and digital sovereignty agendas.

These models together provide some important policy lessons for global policy makers. They demonstrate that privacy laws are not enough to achieve good governance of data: it also relies on good institutions and the ability to enforce them, public trust, cybersecurity protections, and readiness for technological change. The experiences of the East Asian countries will continue to be key reference points in the global development of data governance frameworks, in the light of the growing relevance of data in economic and social life.

12.5 Lessons Learned

The stories of Japan, South Korea, and China offer a glimpse into how data governance is changing in the 21st century. Each country has taken a different pathway of regulation based on their political context, economic priorities, legal culture and cultural values, but all three have shown their countries' increasing reliance on comprehensive data governance frameworks to support digital transformation, defend the nation's interests and build public trust. The East Asian experience has shown that good data management is not just a legal or technical matter but a strategic policy challenge that impacts on economic development, national security, technological innovation, and international cooperation.

The rising digital ecosystem in East Asia provides important policy lessons for governments, regulators, businesses and international organisations around the world embroiled in the process of trying to regulate the new digital world. The lessons learnt underscore the need for flexibility, institutional capacity, international cooperation and constant adaptation to technological change. They equally illustrate that any governance framework that is effective must address a conflict of objectives and not focus on a single policy objective. The variety of models in East Asia illustrates how multifaceted data governance is and how several paths can be followed to achieve effective data governance, depending on the specific context of the country and society in question (Kshetri, 2022).

One Size Does Not Fit All

The key takeaway from East Asia is that there is no single data governance model that is applicable everywhere. China, South Korea and Japan each have implemented effective regimes of regulation, in spite of taking very different stances to privacy, security, state intervention and cooperation between nations. They have seen that good governance systems have to be built to local legal traditions, institutional capabilities, economic and political realities.

Japan has adopted a model that strikes a balance between privacy protection and innovation and trade, which is oriented towards global aspects. In South Korea, a rights-based approach has been established with robust privacy protection and robust enforcement. China has a state-centric approach to privacy that dovetails with other national security, data sovereignty and economic goals. Both approaches are based on different priorities of governance and expectations of the role of data in society.

The effectiveness of the different models has demonstrated the need for policy-makers to be careful not to replicate foreign regulatory frameworks unreflectively without taking local factors into account. International best practices are useful but need to be tailored to the national context to be effective in the context of data governance. When designing regulatory structures, countries interested in developing or reforming privacy legislation need to consider their legal systems, technology, economic goals, and cultural values (Greenleaf, 2023).

In addition, the East Asian experience shows that there is no conflict between regulatory diversity and global digital integration. While they may differ in some facets of their legal and institutional structures, the same goals can be served by different governance approaches, including the conservation of personal information, the strengthening of cybersecurity, and the promotion of digital innovation.

Tackling security, privacy and economic development.

The second big lesson is that several policy aims must be taken into account. Modern data governance can't happen without privacy protection, national security, economic competitiveness, technological innovation, and public trust. When these goals seem to be conflicting, it is often a difficult decision for policymakers.

The Japanese law provides a good example of how privacy rights and economic development can coexist by setting out clear regulations that allow data to be shared internationally while respecting the privacy of individuals. South Korea shows that robust privacy protections and robust economic development hand-in-hand can be achieved and even strengthened by boosting consumer confidence in digital services. Some governments attach great significance to national security and sovereignty issues in managing data resources, as China does.

The East Asian experience shows that no country views privacy, security and economic development as an either-or proposition, but rather aims to establish a coherent regulatory policy that incorporates them. A focus on security could stifle innovation and hinder international collaboration, and a lack of security measures could create vulnerabilities in societies and erode public confidence. Likewise, lax privacy laws can deter electronic engagement, while overly stringent laws can stifle technological innovation and economic development.

Thus, an effective governance system needs policy makers to constantly analyse trade-offs and fine-tune the regulations according to the changing technological, economic and geopolitical conditions. One of the key issues facing data governance today is finding the right balance (OECD, 2023).

Importance of Enforcement Capacity

The other major lesson from the East Asia region is that effective laws are subordinate to effective enforcement institutions. Governments must have the capacity to monitor compliance, investigate compliance violations, impose compliance sanctions and advise the regulated entities if regulatory goals are to be met.

This is perhaps best illustrated in South Korea. The country's Personal Information Protection Commission (PIPC) is actively enforcing the privacy laws, and has significant enforcement powers, including the ability to investigate organisations and fine them for infringements. The culture of strong enforcement has led organizations to make privacy and cyber security a key part of their corporate governance.

The Japanese example of the Personal Information Protection Commission (PPC) is another example of the benefits of independent regulatory oversight. The collaborative nature of Japan's approach to enforcement measures, though, is still more effective than South Korea's, and the presence of a dedicated and capable regulatory body adds much to the effectiveness of the framework.

China's experience also highlights the role of institutional capacity, albeit in a different governance setting. Regulatory bodies have broad powers to monitor data processing operations, investigate and take action to ensure compliance with cyber security, privacy and national security laws and regulations. The centralized approach to governance makes it easier to implement priorities for regulation and to oversee digital activities.

The effectiveness of data governance will rely not only on the legislation, but also on the resources, expertise, authority and independence of enforcement institutions, as illustrated by the examples. Whereas, countries aiming to further strengthen the protection of privacy should do more than just enact laws to strengthen privacy protections; they should invest in building regulatory capacity, expertize, enforcement mechanisms, and institutional development (World Bank, 2023).

Global Interoperability is Essential

Data is often transferred across international boundaries in an increasingly connected digital economy. The cross-border transfer of data is essential for international trade, cloud computing, financial services, scientific research, the development of artificial intelligence and digital communications. Hence, an important takeaway from East Asia is the need to create governance frameworks that enable cross-border data transfers while safeguarding privacy and security standards.

A good example of regulatory interoperability is Japan which has aligned itself with international privacy standards, and has an adequacy agreement with the European Union. Japan's compatibility also strengthens the appeal of locating international business operations and investment in Japan, as well as complying with international standards like the General Guidelines on Data Protection for International Activities (GDPPIA).

Similarly, South Korea has sought to advance its engagement with the international community by deepening privacy protections and engaging more in global privacy dialogues on data governance, cyber and digital governance. The work it does exemplifies what can be achieved with robust domestic privacy safeguards in the context of international economic integration and digital trade.

China is taking a less liberal stance on cross-border data transfers, but also has an eye on the need for international digital engagement. Its regulatory regime embodies a different notion of openness and sovereignty, but also recognizes the importance of regulating the international flow of data in an organized governance setting.

These countries' experiences show it is important to consider both domestic and international aspects in future data governance frameworks. There should be a way for policymakers to encourage interoperability, international cooperation and minimize policy fragmentation while maintaining national policy goals. Effective interaction between different governance systems will become even more critical as digital ecosystems become more globalized (UNCTAD, 2024).

Technology is pushing regulatory evolution. Technology is pushing the evolution of the rules.

A fifth lesson from East Asia is that technological innovation always runs ahead of regulation, and governments need to have an adaptive and flexible governance model. New technologies like AI and machine learning, blockchain, quantum computing, biometric identification systems, autonomous vehicles and Internet of Things (IoT) continue to present new challenges and opportunities for data protection.

In Japan, South Korea and China, all of which are affected by technological change, data governance frameworks have been changed. This occurs because governments will constantly try to refine the nature of their regulation in response to new risks and new opportunities, as seen in Japan's APPI, updates to South Korea's PIPA and the introduction of China's PIPL and DSL.

One example is the fast advancement of artificial intelligence. The need for vast amounts of data for training and running AI systems introduces significant challenges and issues related to privacy, consent, transparency, accountability, and algorithmic bias. There is growing interest among regulators across East Asia in potential modifications of existing law to meet the challenges, while promoting innovation.

Likewise, cyber risks are becoming more serious and large-scale and governments have to build up their security levels and incident response capabilities. The East Asian experience shows that data governance needs to be seen as a continuous process and not a legislative success. In dynamic technological environments, effective governance is an on-going process that requires continuous monitoring, policy evaluation, stakeholders engagement, and regulatory reform ( Zhang & Daum, 2023).

Government plays a central role in Asian data governance. Government centrality to Asian data governance.

One of the most unique things that can be gleaned from the lessons of East Asia is the high visibility and active involvement of government in digital ecosystems. Western privacy approaches focus on reducing government intervention and protecting citizens from overbearing government; the East Asian approaches generally have a more active role for government in shaping a digital future, regulating the tech markets and managing the data resources.

The Japanese government is proactively pursuing digital transformation, innovation policies and international data governance. The South Korean government has been actively involved in the development of digital infrastructure, technological innovation, and privacy protection. China's government's data governance is even more comprehensive, with data governance being seen as a key part of the country's development, security and technological modernization.

This proactive government is part of the overall governance culture in the region and has been a factor in the region's rapid growth of sophisticated digital economies. The government often plays a dual role as both regulator and enabler of innovation, as well as coordinator of national digital strategies and investor in technological infrastructure.

Good practices in East Asia indicate that a mix of long-term strategic planning, institutional capacity, and regulatory clarity with government involvement can be a key enabler of successful digital ecosystems. It also brings the need to establish a balance between government control and government accountability, transparency, and protection of individual rights (Creemers, 2022).

The Japanese, South Korean and Chinese cases illustrate that good data governance needs to be underpinned by robust law, effective institutions, global cooperation, innovative technology, and a visionary policy approach. These countries have embraced varying regulatory approaches, but they all agree that data has become a key asset and strategic asset in the digital age.

The lessons learned from East Asia focus on the need for context-specific policy formulation, a balance of goals in governance, effectiveness of institutions, interoperability of systems across the globe, flexibility of regulation, and involvement of the government. Countries in the region are developing their own data governance systems and the good practices and problems encountered in East Asia offer useful insights into tackling complex policy challenges on privacy, security, innovation and digital transformation.

One of the most dynamic and influential areas of the world for data governance framework development is East Asia. The comparative study of Japan, South Korea and China reveals that the countries, despite their close geographical location and economic ties, have evolved into very different regulatory frameworks due to their distinct political institutions, legal frameworks, expectations and national priorities. Together, these models draw attention to the growing complexity of data governance amidst the backdrop of rapid technological innovations, growing digital economies, and heightened global interdependence (Kshetri, 2022).

The data governance model of Japan is a balanced approach that strives to achieve a balance between privacy protection, economic competitiveness, and global interoperability. Japan has introduced the Act on the Protection of Personal Information (APPI) to ensure its data protection framework is consistent with top international standards like the GDPR in the European Union, facilitating smoother cross-border data transfers and contributing to enhanced global digital collaboration. This model illustrates how a country can have robust privacy safeguards while simultaneously encouraging innovation, foreign investment, and technological progress. Japan's approach of regulatory flexibility and international compatibility makes it a bridge between the privacy regimes of the West and the digital governance systems of the East (OECD, 2023).

Whereas South Korea has one of the world's most rights-centric data protection laws. The Personal Information Protection Act (PIPA) focuses on the individual's autonomy, informed consent, limitation of purpose and compliance responsibilities for public and private sector bodies. Strict regulation is in place, with a robust regulatory body, the Personal Information Protection Commission (PIPC), which means high levels of compliance. The environment of regulations has helped enhance public confidence in digital services and helped build a high-tech digital economy in the country. The example of South Korea shows how technology and good privacy safeguards can go hand-in-hand, provided that it is backed up by solid institutions and a clear legal framework (Kim & Park, 2022).

China's model of government is fundamentally different, focused on governance by the state, national security and data sovereignty. China has established a comprehensive framework of laws that combine privacy protection with other governance goals, including the Cybersecurity Law (CSL), the Data Security Law (DSL), and the Personal Information Protection Law (PIPL). Data is considered a national asset that is closely monitored by government and data transfers across borders are tightly regulated with localization requirements and security assessments. It is a model that is in line with China's overall approach to digital sovereignty, to control critical data infrastructure and to advance local technological innovation (Creemers, 2022).

None of them is a universal best practice for data governance, but they all offer some idea of the direction of travel. Rather, there is a diversity of governance structures that have developed in reaction to national contexts, institutional capacities, economic growth, and political priorities. It is this diversity that underscores the need to contextualize policy-making by adapting regulatory systems to a local context rather than imposing them unaltered from some other place. It also highlights the fact that even though they may take different approaches to regulation philosophies and enforcement strategies, multiple models can work towards achieving privacy protection, innovation and economic development. (World Bank, 2023).

One of the major takeaways from East Asia is that data governance has to keep adapting to technology evolution. The swift pace at which the AI, cloud computing, big data analytics and digital platforms are evolving necessitates continuous legal changes and institutional adaptations. The governments in the region have shown the value of being flexible and responsive to new risks, including those in the field of cybersecurity, algorithmic bias and misuse of data. This flexibility will help make governance frameworks relevant in the context of a rapidly evolving digital world, where technological innovation is always outpacing legal development ( Zhang & Daum, 2023).

An equally important takeaway is that the role played by the state in the development of digital ecosystems in East Asia is very prominent. While most Western models focus on reducing government interference, the governance models in East Asia tend to have more active involvement from the state in the regulation, guidance and support of the digital transformation. Governments have a critical role in not just regulating, but also in strategic planning, building infrastructure and facilitating innovation. It has been a factor conducive to the swift development of digital economies across the region, and is also raising several significant concerns about privacy, surveillance, and individual rights (UNCTAD, 2024).

The influence of East Asia in the field of data governance is still growing at the international level. The Japanese model emphasizes alignment with international privacy frameworks, the South Korean model emphasizes strong enforcement, and the Chinese model emphasizes sovereignty.The Japanese model places a focus on aligning with international privacy frameworks, the South Korean model places a focus on strong enforcement, and the Chinese model places a focus on sovereignty. The various approaches have influenced discussions around global cross-border data flows, AI governance, cyber security standards, and digital trade rules. This makes East Asia not only a key regional leader but also a significant player in the development of international norms of data governance (OECD, 2023).

The East Asian experience shows that there is no single “right” approach to data governance, and it varies based on different national priorities and philosophies of governance. It is valuable to learn from Japan, South Korea and China, all of which have different institutional settings, in which they have managed to balance privacy, innovation, security and economic development. The region will remain a key player in the evolution of future regulations and in international policy debates around data protection, privacy rights, and digital sovereignty as digital transformation continues to gain momentum worldwide.

The next chapter will explore future developments in data governance on the global stage, focusing on new technologies like AI, the implications of evolving international data privacy regulations, and the increasing role of global regulatory collaboration in handling cross-border data transfer and digital ecosystems.