On 20 September 2026, ASEAN economic ministers and Korea's trade minister met in Pasay City for the 23rd AEM-ROK Consultation. They welcomed the start of negotiations to upgrade the ASEAN-Korea Free Trade Agreement (AKFTA) and listed the digital economy among the new areas under consideration, alongside supply chain connectivity, energy cooperation and the green economy (ASEAN joint media statement; SunStar). Officials were urged to reach a substantial conclusion by 2027.
The reporting I could verify says nothing specific about cross-border data flows. What follows is analysis of where the talks could go, not a description of what has been agreed.
The timing problem
ASEAN's own Digital Economy Framework Agreement (DEFA) concluded negotiations in May 2026, and signing is targeted for November 2026 (Rajah & Tann). Its coverage reportedly includes e-commerce, cybersecurity, digital payments, AI and data governance. The AKFTA upgrade will therefore be negotiated after the region's digital rulebook is settled. Korea can either align its data commitments with that rulebook or write a separate set of terms for one partner.
This matters because the AKFTA has no digital trade content today. Joint studies behind the upgrade found as much, according to Korean and regional reports. Whatever the upgrade adds will be the first binding digital trade text between the two sides.
The case for Korean caution
The strongest argument for caution deserves a fair statement. Korea's Personal Information Protection Act (PIPA) treats overseas transfers seriously, and the regulator has shown it will enforce the rules. In January 2025 the Personal Information Protection Commission sanctioned Kakao Pay, Apple and Alipay over transfers of user data to Alipay, imposing a KRW 5.97 billion penalty on Kakao Pay (PIPC press release). The case involved data on tens of millions of users, according to press reports. A regulator that has just fined a domestic champion for loose transfer practices has good reason not to sign away its discretion in a trade agreement.
PIPA also sets out defined legal bases for sending data abroad. These include separate consent, treaty or statutory provisions, contract necessity, PIPC-designated certification, and a recognition that the destination offers equivalent protection (PIPC guidance, in Korean). Trade negotiators need to respect that architecture.
Why interoperability beats a bespoke regime
Caution about personal data does not require fragmentation. The two goals separate cleanly.
First, Korea has already accepted a binding data-flow commitment elsewhere. It acceded to the Digital Economy Partnership Agreement (DEPA), with talks announced as substantially concluded on 8 June 2023 (New Zealand MFAT joint press release). DEPA's rules cover cross-border transfer of information by electronic means and the location of computing facilities, according to commentary on the 2023 protocol. Seoul has shown it can accept such terms while keeping its privacy law.
Second, ten ASEAN members now have a template of their own. If the AKFTA upgrade copies DEFA's data provisions, or at least recognises them as equivalent, a Korean firm gets one compliance map for the region. If it writes a different standard, companies face two sets of rules for the same data flows. Large firms can absorb that cost. Startups and mid-sized suppliers cannot, and they are the businesses the upgrade is supposed to help.
Third, the stakes are large. ASEAN's secretary-general has projected that the region's digital economy could reach US$2 trillion by 2030, a figure drawn from a BCG study (Ghana News Agency). Korean cloud, payments, gaming and e-commerce companies want a large share of that growth, and they depend on moving data.
What a proportionate outcome looks like
- Default to free flow, with a narrow exceptions clause. A legitimate public-policy exception is better than blanket carve-outs for whole sectors.
- Recognise equivalence mechanisms instead of harmonising laws. Korea's PIPC-designated certification and adequacy routes could be matched with ASEAN's model contractual clauses, so no one has to rewrite domestic statutes.
- Ban forced data localisation for commercial data, with privacy and security safeguards kept in domestic law.
- Create a standing dialogue between regulators. The PIPC's enforcement experience is useful to ASEAN, and ASEAN's implementation work is useful to Korea.
There is a caveat. DEFA still needs legal review, signing and ratification by each member, and Timor-Leste may not join at the outset (Allen & Gledhill). The AKFTA talks should therefore avoid hard-wiring text that depends on DEFA before it is final. A forward-looking cross-reference clause could handle that: it would commit the parties to align once DEFA is in force.
The bottom line
The September consultation set a timetable and a list of topics, not a data policy. The coming months will decide whether the upgrade becomes an extension of the regional digital rulebook or a separate parallel track. A Korea that enforces privacy seriously and also commits to free, interoperable data flows would be a credible partner. Treating the two as a trade-off is the mistake to avoid.