Data Residency Choices for AI Workloads in HK, SG, JP, KR, TW

TL;DR

• Three of the five markets covered here have hard data residency requirements for at least some AI workload categories. Two are softer.
• Cloud provider region availability now meets practical needs in all five markets, with Korea and Taiwan being the tightest on local capacity.
• The reference architecture for multi-Asia AI deployment is regional data planes with a controlled cross-region orchestration plane.

Why now

Data residency was a niche concern for AI deployments in 2022. By 2026 it is the gating constraint for most cross-Asia rollouts. The OECD's AI Policy Observatory documents data localisation provisions in 22 of 38 AI-relevant policy instruments across Asia.[^1] Cloud providers have responded with new regions and assurance programmes. The reference architectures have settled.

This article walks through the residency landscape for the five markets where most mid-market AI deployments sit: Hong Kong, Singapore, Japan, Korea, Taiwan.

Hong Kong

The Personal Data (Privacy) Ordinance (PDPO) does not contain hard data residency requirements as of mid-2026. The PCPD's guidance encourages local processing for sensitive personal data but does not mandate it.

Practical implications for AI workloads:

• Most AI workloads can run in Asian regions outside Hong Kong (typically Singapore, Tokyo, or Seoul) without breaching the PDPO
• Sector-specific regulators (HKMA for banks, IA for insurers) impose stricter requirements that often amount to local processing
• Cross-border transfer to mainland China requires careful structuring: PIPL applies on the receiving side and may impose obligations the Hong Kong sender did not anticipate

Cloud availability: AWS, Azure, GCP, Tencent, and Alibaba all offer Hong Kong regions. Frontier model availability varies; check whether your model provider serves the Hong Kong region directly.

Singapore

The PDPA does not impose hard residency for personal data. Cross-border transfer is allowed where the recipient offers protection comparable to the PDPA. AI Verify and the Model AI Governance Framework do not change this.

Practical implications:

• Singapore is the most permissive of the five markets for AI workload location
• The MAS Technology Risk Management guidelines impose stricter requirements on financial services workloads
• For most enterprise AI use cases, Singapore-hosted is straightforward; Tokyo or Seoul-hosted requires standard cross-border safeguards

Cloud availability: dense. AWS, Azure, GCP, Oracle, IBM all have multiple availability zones in Singapore. Frontier model availability is the best in the region; Anthropic, OpenAI, Google, and Mistral all serve Singapore directly through their cloud partners.

Singapore's combination of permissive residency rules, dense cloud availability, and strong frontier model presence makes it the default hub for multi-Asia AI workloads. Most mid-market multi-Asia deployments place orchestration, observability, and lower-sensitivity data planes in Singapore.

Japan

The APPI does not mandate residency for personal information. Cross-border transfer requires either consent, contract incorporating APPI-equivalent protections, or transfer to a jurisdiction the PPC has recognised as offering adequate protection.

Practical implications:

• Most AI workloads can run in Tokyo or Osaka regions of major cloud providers without residency issues
• Cross-border transfer to a non-adequate jurisdiction (which includes most of Asia) requires safeguards
• Sector regulators (FSA for finance, MHLW for health) impose stricter requirements
• Cultural expectation: many Japanese enterprise customers expect Japan-hosted by default, even where not legally required. Plan accordingly.

Cloud availability: AWS, Azure, GCP all have major Tokyo regions. Osaka is well covered. Frontier model availability through cloud partners is good.

Korea

This is where residency becomes hard. PIPA imposes localisation on certain categories of personal information; the AI Basic Act adds high-impact AI registration requirements; sector regulators (FSC for finance, KISA for security) layer further requirements.

Practical implications:

• Personal information of Korean residents in regulated sectors (finance, telecom, health) typically must be processed in Korea
• The Network Act and the Telecommunications Business Act impose additional residency expectations on platform services
• Cross-border transfer requires explicit consent or PIPC adequacy recognition; few non-EU jurisdictions are recognised
• For high-impact AI deployments, registration with the responsible ministry is required

Cloud availability: AWS, Azure, GCP all serve Seoul. Naver Cloud and Kakao Cloud are competitive local options often preferred by regulated customers. Frontier model availability is improving but lags Singapore and Japan.

The strict regulatory posture means Korea-resident customers often require Korea-hosted AI workloads, even where not strictly mandated. Plan for a Korean data plane in any multi-Asia deployment touching regulated sectors.

Taiwan

The Personal Data Protection Act (PDPA, Taiwan) does not mandate residency in general. Sector-specific regulators impose stricter requirements on financial services and healthcare. Cross-border transfer can be restricted by industry regulators on national security grounds.

Practical implications:

• For most AI workloads, Taiwan-hosted is preferred but not required
• Financial services workloads typically must be Taiwan-hosted
• Cross-strait transfer to mainland China is heavily restricted by the FSC and other regulators
• Taiwanese enterprise customers in semiconductor and electronics manufacturing often require Taiwan-hosted for IP protection reasons even where regulators do not require it

Cloud availability: improving. AWS opened a Taipei region in 2025. Azure has Taiwan capacity. GCP serves through Taiwan and Singapore regions. Local providers (Chunghwa Telecom, Far EasTone) are common in regulated sectors.

The cross-Asia reference architecture

The pattern that has emerged for multi-Asia mid-market deployments has three planes.

Regional data planes. Per-market storage of personal data subject to residency. Korea, China (where applicable), Taiwan (regulated sectors), Japan (cultural default), and the rest in a regional Singapore plane.

Orchestration plane. Workflow orchestration, model serving infrastructure, observability. Typically Singapore-hosted with regional failover.

Model inference plane. Often co-located with the data plane to avoid cross-border transfer of sensitive content. Frontier model providers' regional endpoints are increasingly available.

The orchestration plane crosses borders by design. The data plane does not. The inference plane follows the data plane.

This architecture is more complex than a single-region deployment but it is what the regulatory landscape now demands. McKinsey's Cloud Native AI in Asia 2025 found that 73% of mid-market AI deployments operating in three or more Asian markets had adopted some form of regional data plane architecture by mid-2025.[^2]

Implementation playbook

How to design data residency for a new multi-Asia AI deployment.

1. Map your customer and user data per market. What personal data you process, where the subjects are resident.
2. Map sector-specific regulators relevant to your use case. Financial, healthcare, telecom each add layers.
3. Identify hard residency requirements. Korea (regulated sectors), China, Taiwan (regulated sectors). Hard requirements drive plane decisions.
4. Identify customer-driven residency expectations. Japan defaults to local, even where not required. Korean enterprise customers often require local even outside regulated sectors.
5. Choose your orchestration hub. Singapore is the default for most multi-Asia deployments. Tokyo is an alternative for Japan-heavy deployments.
6. Choose your model inference strategy. Frontier model regional endpoints, self-hosted open-weights models, or sector-specific local providers.
7. Document the architecture decision in a residency map. Per market, per data category, per processing activity. Update at least quarterly.

Counter-arguments

"This complexity is over-engineering for a 500-person company." It looks like over-engineering until your largest Korean customer demands a residency attestation in their procurement process. Mid-market enterprises that win regulated-sector customers are the ones who can answer the residency question without rebuilding.

"We will use the cloud provider's compliance certifications." Necessary but not sufficient. The certifications cover the infrastructure layer. Your application-layer residency design is your responsibility.

"Frontier models are not available in our preferred region." Increasingly they are. If they are not, the alternatives are: route through an adjacent region with a clear cross-border pathway, self-host an open-weights model, or use a regional provider's model. None of these is free; all are workable.

Bottom line

Data residency is a first-class architectural concern for AI workloads in Asia. Three markets (Korea, China, Taiwan in regulated sectors) impose hard requirements; two (Hong Kong, Singapore) are softer. The reference architecture is regional data planes with a Singapore orchestration plane. Mid-market enterprises that build this correctly compete for regulated-sector customers across the region. Enterprises that defer the decision rebuild later.

Next read

• AI Governance for Asian Enterprises: Mapping HK, SG, JP, KR, CN
• Building an Internal AI Platform: Reference Architecture for 200-1,000 Person Companies

By Sara Itoh, Senior Advisor, AI Operations.

[^1]: OECD, AI Policy Observatory, accessed March 2026. [^2]: McKinsey & Company, Cloud Native AI in Asia 2025, July 2025, p. 28.