![](\"https:\/\/www.lpalaw.com\/wp-content\/uploads\/2025\/10\/LPA-Asia_-Newsletter_-banniere_New-2025-VN-1.jpg\")
<\/p>\n19 December 2025<\/p>\n
<\/p>\n
Through this newsletter, we offer you a regular selection of legislative and judicial decision insights prepared by LPA lawyers from our six Asian offices as well as some recent news from our teams.<\/p>\n
LEGAL INSIGHTS IN ASIA<\/a><\/p>\n Vietnam<\/a><\/strong><\/p>\n Welcome to the AI & data matrix \u2013 Vietnam reloaded<\/a><\/p>\n Hong Kong<\/a><\/strong><\/p>\n Hong Kong FSIE Regime: IRD issues further clarifications (July 2025)<\/a><\/p>\n China<\/a><\/strong><\/p>\n PRC Supreme Court strengthens employees\u2019 right to reinstatement in labor disputes<\/a><\/p>\n China tightens cross-border data transfers: certification becomes unavoidable<\/a><\/p>\n Singapore<\/a><\/strong><\/p>\n VCCs in Singapore: the new standards shaping fund platforms and M&A<\/a><\/p>\n Singapore Employment Law: December 2025 updates<\/a><\/p>\n Japan<\/a><\/strong><\/p>\n Key amendments to Japan\u2019s Subcontract Act Effective January 2026<\/a><\/p>\n NEWS FROM LPA<\/a><\/p>\n <\/a> <\/a>Welcome to the AI & data matrix \u2013 Vietnam reloaded<\/strong><\/span><\/p>\n Artificial intelligence (AI) and data governance have rapidly become central issues worldwide, with governments introducing new frameworks to balance innovation, security, sovereignty and individual rights.<\/p>\n In Asia, several countries, including Singapore, China, and Japan, have established comprehensive strategies to regulate AI and strengthen data protection, setting benchmarks for this digital transformation. Against this backdrop, Vietnam is introducing rules to regulate both AI and the use of personal data.<\/p>\n Vietnam\u2019s Digital Governance Architecture: Three Pillars<\/u><\/strong><\/p>\n Vietnam\u2019s National Assembly has established a three\u2011pillar legal architecture to regulate data, personal information, and artificial intelligence. Each law builds upon the other, creating a layered framework that balances innovation with accountability.<\/p>\n Foundational Layer \u2013 Law on Data (Law No. 60\/2024\/QH15)<\/span><\/p>\n Effective from July 2025, the Law on Data provides the broadest framework for digital governance. It regulates the collection, storage, transfer, and management of both personal and non\u2011personal data. Companies and private organizations must ensure lawful processing, contribute accurate information to the National General Database, and avoid creating barriers to data portability. The law also embeds obligations around environmental responsibility and ethical use of data, positioning data governance as a cornerstone of Vietnam\u2019s digital economy.<\/p>\n This law provides the foundational layer of Vietnam\u2019s governance system, setting the stage for more specialized regulations on personal data and AI.<\/p>\n Specialized Layer \u2013 Personal Data Protection Law (PDPL \u2013 Law No. 91\/2025\/QH15)<\/span><\/p>\n Adopted in June 2025 and effective from January 2026, the PDPL replaces Decree No. 13\/2023\/ND\u2011CP and introduces a comprehensive framework for safeguarding personal data.<\/p>\n The PDPL narrows the focus to personal data rights and protections. It requires explicit, informed consent for data processing, imposes strict safeguards for sensitive categories (biometrics, health, financial records), and mandates Data Protection Impact Assessments (DPIAs) for all personal data processing activities. Organizations must designate compliance officers, maintain transparency, and adhere to sector\u2011specific rules in finance, healthcare, and telecommunications.<\/p>\n The PDPL also extends extraterritorial reach, requiring foreign companies handling Vietnamese citizens\u2019 data to comply.<\/p>\n Advanced Layer \u2013 Law on Digital Technology Industry (DTI Law \u2013 Law No. 71\/2025\/QH15)<\/span><\/p>\n Also effective from January 2026, the DTI Law represents Vietnam\u2019s first AI\u2011specific regulatory framework.<\/p>\n It adopts a broad definition of AI systems (Art. 3(9)), covering any machine\u2011based system that generates predictions, content, recommendations, or decisions. Companies deploying AI must comply with cybersecurity and data protection laws (Art. 10), ensure transparency in AI\u2011driven processes, and avoid prohibited acts such as misuse of AI to infringe on national security, human rights, or social ethics. The law also introduces obligations around controlled testing, environmental sustainability, and contributions to national digital technology databases.<\/p>\n This layered approach ensures that Vietnam\u2019s digital transformation is governed at every level\u2014from general data management, to personal data protection, to advanced AI oversight. It positions Vietnam as a regional leader in building a trusted, secure, and innovation\u2011friendly digital economy.<\/p>\n In addition to the three pillars outlined above, Vietnam has established a complementary legal framework to safeguard its digital environment. Law No. 24\/2018\/QH14 on Cybersecurity sets out a comprehensive \u201csecurity frame\u201d designed to protect critical information systems, user data, and the integrity of Vietnam\u2019s cyberspace. It empowers the State to regulate online content, ensuring national security and mitigating risks of cyber\u2011attacks. Meanwhile, Law No. 86\/2015\/QH13 on Cyber information Security provides the technical standards and specifications necessary to implement robust cyber information safeguards. Recognizing the overlap between these two regimes, the legislature has announced that they will be consolidated into a single, unified law, thereby streamlining Vietnam\u2019s approach to cybersecurity and information protection.<\/p>\n AI and Data Processing Definitions under Vietnam\u2019s PDPL and DTI Law<\/u><\/strong><\/p>\n Broad Definition of AI<\/span><\/p>\n The DTI Law adopts a deliberately expansive definition of artificial intelligence. Its Article 3(9) covers any machine\u2011based system that generates predictions, content, recommendations, or decisions. This formulation is not limited to advanced machine learning or neural networks; it also captures:<\/p>\n The breadth of this definition means that any automated system deployed in Vietnam, from HR recruitment algorithms to financial risk scoring tools, falls within the regulatory perimeter. This ensures that oversight is not confined to \u201ccutting\u2011edge AI\u201d but extends to the full spectrum of automated technologies influencing human or organizational decisions.<\/p>\n Wide Scope of Personal Data Processing <\/span><\/p>\n The PDPL complements this by adopting an equally wide formulation of \u201cpersonal data processing.\u201d Article 2(6) defines processing as any activity impacting personal data, explicitly listing:<\/p>\n This definition is intentionally comprehensive, covering the entire lifecycle of data\u2014from initial acquisition to final disposal. It also extends to both manual and automated operations, meaning that even routine administrative handling of personal data is subject to PDPL obligations.<\/p>\n Special Safeguards for Emerging Technologies <\/span><\/p>\n Article 30 of the PDPL introduces a technology\u2011specific safeguard, recognizing that environments such as big data, AI, block chain, virtual space, and cloud computing pose heightened risks. It requires that personal data in these contexts be:<\/p>\n This provision effectively creates a principle of proportionality: organizations must demonstrate that their use of advanced technologies does not exceed what is necessary, and that individuals\u2019 rights remain protected even in complex, decentralized, or opaque systems.<\/p>\n Obligations for companies and organisations<\/u><\/strong><\/p>\n Under the Law on Data<\/span><\/p>\n The Law on Data establishes a comprehensive framework for the management, protection, and use of digital data in Vietnam. It applies broadly to state agencies, private enterprises, and foreign\u2011invested organizations engaged in data activities.<\/p>\n Anticipating the PDPL, organizations must ensure that data collection and processing activities are lawful, transparent, and limited to the scope of necessity. They are required to respect the rights of data subjects, including the right to be informed, the right to access, and the right to request correction or deletion of inaccurate data.<\/p>\n Companies must adopt technical and organizational measures to safeguard data against unauthorized access, loss, or misuse. This includes secure storage systems, encryption, and regular audits to ensure compliance with cybersecurity standards.<\/p>\n Under the DTI Law<\/span><\/p>\n Under the DTI Law, private organizations face a series of structured obligations designed to ensure accountability, transparency, and trust in Vietnam\u2019s digital economy.<\/p>\n First, companies must comply with the state\u2019s management regulations governing the digital technology industry. This includes adherence to technical standards, regulatory requirements, and quality norms for all digital technology products and services. Beyond compliance with standards, firms are also required to guarantee cyber safety and security in their operations, aligning their practices with Vietnam\u2019s broader laws on cybersecurity, data protection, and personal data management.<\/p>\n The law also provides a framework for controlled testing of digital technology products and services. Organizations may conduct such testing to innovate and validate new solutions, but only within the boundaries of the DTI Law and related legislation on science, technology, and innovation. While liability exemptions are granted during controlled testing, these protections are conditional\u2014fraudulent use of the mechanism or attempts to exploit exemptions unlawfully are strictly prohibited.<\/p>\n In addition, the DTI Law imposes significant data obligations on enterprises. Companies must not create commercial or technical barriers that prevent clients from storing or transferring their digital data. They are encouraged to self\u2011assess and publicly announce the quality of their digital data before releasing products to the market, thereby promoting transparency and consumer confidence. Furthermore, organizations are required to provide, collect, and update information into the national digital technology industry database accurately and promptly, ensuring that regulators and stakeholders have reliable data to support oversight and policy development.<\/p>\n Under the PDPL<\/span><\/p>\n Under the PDPL, organizations face a comprehensive set of obligations designed to safeguard individual rights and ensure responsible data governance.<\/p>\n At the heart of these requirements lies the principle of user consent. Companies must obtain clear, informed, and explicit consent before collecting or processing personal data. Consent must be tied to a specific purpose, properly documented, and revocable at any time. When dealing with sensitive categories of information\u2014such as biometric identifiers, health records, or financial data\u2014the law imposes an even higher threshold, requiring enhanced disclosure and stronger safeguards to protect individuals.<\/p>\n Beyond consent, the PDPL establishes strict rules for data protection. Firms are required to implement both technical and organizational measures to secure personal information. This includes encryption, secure servers, access controls, and audit trails. Special emphasis is placed on sensitive data, with mandatory risk assessments and confidentiality protocols for systems that rely on artificial intelligence. These measures are intended to prevent unauthorized access, misuse, or breaches that could undermine public trust.<\/p>\n To ensure accountability, organizations must also fulfil specific responsibilities. They are required to designate responsible DPOs tasked with overseeing adherence to the law.<\/p>\n Companies must maintain compliance records, conduct regular internal audits, and ensure transparency in how data is collected, processed, and shared. Public disclosure of data handling practices, through privacy notices and reporting, is a key element of this accountability framework.<\/p>\n The PDPL further recognizes that certain industries handle data of heightened sensitivity and therefore imposes sector\u2011specific rules. In finance, stricter requirements apply to customer profiling, credit scoring, and cross\u2011border transfers. In healthcare, enhanced safeguards are mandated for medical records, genetic data, and patient confidentiality. In telecommunications, obligations extend to metadata, geolocation, and surveillance risks. These tailored rules reflect the government\u2019s recognition that misuse in these areas could have systemic or life\u2011critical consequences.<\/p>\n Companies that fail to meet PDPL requirements may face administrative fines, suspension of operations, or even revocation of business licenses. Beyond legal penalties, reputational damage is a serious risk, particularly in industries where consumer trust is paramount. While the PDPL narrows the extraterritorial scope compared to earlier rules, foreign companies processing the personal data of Vietnamese citizens must still comply. This includes cloud providers, multinational corporations, and offshore service centres handling HR or customer data.<\/p>\n Recommended Best Practices for Companies<\/u><\/strong><\/p>\n Toward a Fourth Pillar: the draft law on AI<\/u><\/strong><\/p>\n While Vietnam\u2019s digital governance architecture is currently anchored in the Law on Data, the PDPL, and the DTI Law, a forthcoming Artificial Intelligence Bill is beginning to take shape. Still in draft form, this proposed legislation reflects Vietnam\u2019s intent to align with global trends in regulating high-risk AI systems.<\/p>\n The draft AI Bill introduces a principle of compliance, requiring all AI systems to adhere to existing data protection laws. It also identifies unacceptable risk categories, notably:<\/p>\n Although detailed provisions are still pending, the draft highlights several regulatory gaps that future decrees and technical guidelines are expected to address, including:<\/p>\n This emerging legislation signals Vietnam\u2019s ambition to move beyond foundational data and AI governance toward a risk-based, principle-driven AI regulatory framework, echoing developments in the EU, Singapore, and other jurisdictions.<\/p>\n Together, these four components, Data Law, PDPL, DTI Law, and the Law on AI in development will form a progressively layered and responsive legal ecosystem, positioning Vietnam as a proactive regulator in the age of digital transformation.<\/p>\n Etienne Laumonier<\/a><\/p>\n <\/p>\n <\/a> <\/a>Hong Kong FSIE Regime: IRD issues further clarifications (July 2025)<\/strong><\/span><\/p>\n The Hong Kong Inland Revenue Department (IRD) continues to refine the administration of the Foreign-Sourced Income Exemption (FSIE) regime. On 24 July 2025, the IRD published additional FAQs that provide welcome clarification on the treatment of dividends, disposal gains, bond transactions and in-kind distributions. These developments are particularly relevant for multinational enterprise (MNE) groups with offshore investment and treasury structures.<\/p>\n Below is a practical summary of the latest guidance, read together with earlier IRD positions.<\/p>\n Hong Kong\u2019s FSIE regime, introduced in 2023 and expanded from 1 January 2024, represents a significant shift from its traditional territorial tax system. Foreign-sourced passive income received in Hong Kong is now taxable unless specific exemption conditions (economic substance or participation exemption) are met.<\/p>\n Originally limited to interest, dividends, equity disposal gains and IP income, the regime was extended in 2024 to cover non-equity disposal gains<\/strong>, increasing both scope and compliance complexity.<\/p>\n (a) Share of profits from overseas associates \u2013 not a dividend<\/strong><\/p>\n The IRD confirms that a Hong Kong taxpayer\u2019s share of profits from an overseas associate recognised under the equity method (HKAS 28) does not<\/strong> constitute a dividend for FSIE purposes. Such accounting entries merely reflect changes in the value of the investment and do not represent an actual distribution of profits.<\/p>\n Only when profits are formally declared and distributed<\/strong> by the overseas associate will the income be treated as a dividend under the FSIE regime.<\/p>\n Practical implications<\/span><\/p>\n (b) Deductibility of expenses relating to disposal gains<\/strong><\/p>\n Where foreign-sourced disposal gains are deemed taxable under the FSIE regime, the IRD confirms that such gains are computed by reference to disposal proceeds less acquisition cost and direct expenses<\/strong> incurred on acquisition and disposal (e.g. legal fees, brokerage fees and stamp duty).<\/p>\n Other expenses incurred in producing the disposal gain may also be deductible, provided they satisfy the normal deduction rules<\/strong> under the Inland Revenue Ordinance. Capital expenditure remains non-deductible, and certain expenses (such as interest) are subject to specific statutory conditions.<\/p>\n Practical implications<\/span><\/p>\n (c) In-kind dividends \u2013 shares in overseas entities<\/strong><\/p>\n The IRD clarifies that an in-kind dividend in the form of shares in an overseas entity will generally not<\/strong> be regarded as \u201creceived in Hong Kong\u201d where the investee entity is incorporated and managed outside Hong Kong and has no Hong Kong operations or personnel.<\/p>\n This position is consistent with the IRD\u2019s earlier advance ruling practice and reinforces a substance-based approach to determining the location of receipt.<\/p>\n Practical implications<\/span><\/p>\n (d) Clarification of \u201creceived in Hong Kong\u201d<\/strong><\/p>\n Beyond in-kind dividends, the IRD reiterates that foreign-sourced income is regarded as received in Hong Kong only if it is:<\/p>\n Mere recording of income in Hong Kong-based accounting records or financial statements is insufficient to constitute receipt.<\/p>\n Practical implications<\/span><\/p>\n While the July 2025 FAQs provide helpful clarity, FSIE remains an evolving regime. Further guidance from the IRD is expected as new fact patterns emerge. Taxpayers with complex offshore, investment or treasury structures should consider advance rulings where uncertainty exists.<\/p>\n Marie-Gabrielle du Bourblanc<\/a><\/p>\n <\/p>\n <\/a> <\/a>PRC Supreme Court strengthens employees\u2019 right to reinstatement in labor disputes<\/strong><\/span><\/p>\n The PRC Supreme People\u2019s Court („SPC“) released the Interpretation on Several Issues Concerning the Application of Law in the Trial of Labor Disputes (II) (the \u201cInterpretation II<\/strong>\u201d), effective as of September 1, 2025.<\/p>\n Comprising 21 articles<\/strong>, Interpretation II addresses long-standing inconsistencies in labor dispute adjudication across different regions in China. One of its most significant developments concerns employees\u2019 claims for reinstatement of the labor relationship<\/strong> following termination.<\/p>\n A Shift from Discretion to Protection<\/strong><\/span><\/p>\n Historically, the claims of employees for reinstatement of labor relationship were not commonly supported. Employers could easily refuse to reinstate labor relationship with employees by citing reasons such as the original position already being occupied or the loss of mutual trust between the parties.<\/p>\n Interpretation II marks a clear departure from this approach<\/strong>. It significantly strengthens employee protection by restricting the circumstances under which employers may refuse reinstatement<\/strong>. Under the new framework, employers may only deny reinstatement where specific, objective conditions expressly set out in Interpretation II are met<\/strong>. Outside of these limited exceptions, courts are expected to support reinstatement whenever requested by the employee<\/strong>.<\/p>\n Financial consequences for employers<\/strong><\/span><\/p>\n Reinstatement is not the only consequence. Where reinstatement is ordered, the original employer must also retroactively pay the employee\u2019s remuneration<\/strong> for the entire period from the date of dismissal until the actual date of reinstatement. This can result in substantial financial exposure<\/strong>, particularly in disputes with lengthy proceedings.<\/p>\n Practical implications<\/strong><\/span><\/p>\n It is foreseeable that courts will increasingly uphold reinstatement claims<\/strong> under this new judicial guidance. As a result, employers should reassess their termination strategies<\/strong> and carefully evaluate the legal and financial consequences before implementing any unilateral termination.<\/p>\n Prudent documentation, strict procedural compliance, and early legal risk assessment will become even more critical in managing employment disputes in China under this evolving judicial landscape.<\/p>\n Fanny Nguyen<\/a> | H\u00e9l\u00e8ne Liu<\/a><\/p>\n <\/p>\n <\/a>China tightens cross-border data transfers: certification becomes unavoidable<\/strong><\/span><\/p>\n Starting 1 January 2026<\/strong>, China takes a decisive step in data governance. The Measures for Cross-border Transfer Certification of Personal Information<\/strong> (the Measures<\/em>) officially enter into force, removing long-standing uncertainty around whether and how personal data transfers from mainland China must be certified<\/strong>\u00a0under the Personal Information Protection Law (PIPL)<\/strong>.<\/p>\n Who is covered?<\/strong><\/span><\/p>\n *The cross-border transfer of important data and CIIOs\u2019 personal information remains subject to the data cross-border security assessment process.<\/em><\/p>\n Mandatory preconditions<\/strong><\/span><\/p>\n Before applying for certification, data processors must:<\/p>\n Certification process<\/strong><\/span><\/p>\n Why it matters<\/strong><\/span><\/p>\n With the Measures, China now has a fully articulated compliance framework<\/strong> for cross-border personal data transfers under the PIPL. As of 1 January 2026, non-compliance is no longer defensible.<\/strong><\/p>\n Fanny Nguyen<\/a> | Estelle Chen<\/a><\/p>\n <\/p>\n <\/a> <\/a>VCCs in Singapore: the new standards shaping fund platforms and M&A<\/strong><\/span><\/p>\n Singapore\u2019s Variable Capital Company (VCC) regime has rapidly become one of the most flexible fund-structuring options in Asia. The ability to establish an umbrella vehicle with multiple ring-fenced sub-funds allows managers to segregate strategies, assets and investor groups within a single entity. This structure is increasingly relevant in transactions involving portfolio consolidation, co-investment arrangements or the acquisition of multi-strategy platforms.<\/p>\n The VCC\u2019s attractiveness is reinforced by its access to Singapore\u2019s tax exemption schemes for funds, including the 13O and 13U regimes, provided substance and investment-management conditions are satisfied. This combination of structural flexibility and tax efficiency makes the VCC especially appealing to private equity sponsors and investment groups seeking to base their regional platforms in Singapore.<\/p>\n Recent regulatory developments highlight MAS\u2019s heightened expectations following its thematic review. The regulator has emphasised the need for genuine economic substance, active portfolio management and robust governance, underlining that VCCs must not operate as passive asset-holding vehicles. Custody arrangements must be appropriate for the assets held, directors involved in regulated activities must be properly licensed and AML\/CFT responsibilities remain with the VCC even when functions are outsourced. MAS has also drawn attention to dormant vehicles with no assets or investors and encouraged timely rationalisation.<\/p>\n In the M&A context, while this structure is not always the most suitable, the VCC can nonetheless offer valuable opportunities for deal planning and execution. Acquirers can use VCC sub-funds to isolate newly acquired assets or business lines, enabling cleaner ring-fencing of risk, investors and performance. Where buyers are acquiring several targets across different jurisdictions, the VCC can serve as a central platform for consolidating asset ownership, harmonising governance and generating tax-efficient returns under a single Singapore-based framework. The structure also allows sponsors to create dedicated sub-funds for co-investors joining specific acquisitions, without disturbing the broader investment strategy of the umbrella vehicle. For transactions involving carve-outs, the VCC\u2019s flexibility supports the rapid creation of sub-funds tailored to the acquired portfolio, allowing sponsors to integrate assets while maintaining clear separation of liabilities and exit timelines.<\/p>\n As a result, the VCC has evolved from a fund-structuring innovation into a practical transaction tool, offering buyers a sophisticated and efficient framework for acquiring, organising and managing regional assets from Singapore.<\/p>\n B\u00e9reng\u00e8re Roig<\/a><\/p>\n <\/p>\n <\/a>Singapore Employment Law: December 2025 updates<\/strong><\/span><\/p>\n 1. Adoption of the Workplace Fairness (Dispute Resolution) Bill<\/u><\/strong>[[1]<\/a>]<\/strong><\/p>\n As mentioned in our last newsletter \u201cSingapore Employment Law: September 2025 updates\u201d dated 3
\n<\/a>LEGAL INSIGHTS IN ASIA<\/h2>\n
![](\"https:\/\/www.lpalaw.com\/wp-content\/uploads\/2025\/05\/Banniere-Vietnam-300x120.jpg\")
<\/p>\n\n
\n
\n
\n
\n
\n
\n
\n
\n
\n
\n
![](\"https:\/\/www.lpalaw.com\/wp-content\/uploads\/2023\/04\/page07-300x120.jpg\")
<\/p>\n\n
\n
\n
\n
\n
\n
\n
\n
![](\"https:\/\/www.lpalaw.com\/wp-content\/uploads\/2023\/04\/page01-300x120.jpg\")
<\/p>\n\n
\n
\nseparate consent<\/strong>;<\/li>\n
\ncovering:<\/p>\n\n
\n
\nrepresentatives<\/strong>;<\/li>\n
\nFor foreign-invested enterprises in China<\/strong>, data sharing with overseas parent companies is no longer a grey area.<\/p>\n![](\"https:\/\/www.lpalaw.com\/wp-content\/uploads\/2025\/05\/Banniere-Singapore-NEW-2025-300x120.jpg\")
<\/p>\n