Data Privacy and Cybersecurity: Are You Prepared for the Challenges?

In an era when data is considered an asset and is processed through a growing number of rapidly developing digital technologies, data privacy and cybersecurity have emerged as a significant area of law and focus of compliance regimes.

While data privacy and cybersecurity may not be the first thing that comes to mind in relation to ESG, they are inherently relevant to ESG and are already playing a crucial role in the ESG framework.

• The “Governance” component of privacy is most obvious. It means maintaining a corporate governance structure that keeps data secure and is processed lawfully, in accordance with a fast evolving and complex regulatory regime. This is underpinned by the accountability principle (i.e., a business is responsible for demonstrating its compliance with the law) and effectuated through data protection by design and by default requirements. In a sense, responsible data is sustainable data.

• It is also apparent that businesses have a “Social” responsibility to protect the personal data that they collect and use. Use of personal data requires respecting the right of the individuals to control their personal data, which itself constitutes a human right. While businesses may have legitimate interests in using personal data collected through its operations, they are required to ensure that such interests do not override the fundamental rights and freedoms of individuals, and organizations must uphold individuals’ rights in their data.

• The “Environmental” element in ESG involves saving resources and reducing waste. Within the data context, this is achieved through, on one side, the data minimization principle that requires that data collected be limited to what is truly necessary for the intended purpose, and be stored for the shortest period of time needed to achieve such purpose. On the other side, it means optimizing the use of resources and exploring energy-saving ways to implement privacy practices, through physical digital infrastructure that minimizes environmental impact.

It should be clear that data privacy and cybersecurity are both about complying with relevant laws and regulations and also mitigating many of the risks associated with any misuse of data.

Most Asian jurisdictions, including Mainland China, Hong Kong, Singapore, and Japan, have fast-evolving legislative and regulatory regimes related to data protection and cybersecurity. Asia-based private equity funds should conduct thorough privacy due diligence on any target business before an investment is made. After investing, funds should require portfolio companies to adopt the fund’s own policies on privacy, data responsibility, and cybersecurity to the portfolio company’s ESG program, and review compliance with that policy regularly. In this regard, it is important to note that a one-size-fits-all approach might not work in practice; instead, bespoke and customized solutions taking into account different region-specific, sector-specific requirements may need to be made for the relevant portfolio business. Funds  should also require portfolio companies to purchase cyber liability insurance to protect portfolio companies from monetary losses resulting from potential data breaches or other cyberattacks.

Read more in the Asia Funds ESG + Sustainability Survey 2025 Report.