Asia-Pacific's automated-hiring clock: three deadlines in seven months

US and EU rules dominate the conversation about AI in hiring. For multinationals with Asia-Pacific operations, the nearer deadlines are in the region itself:

• Australia, December 10, 2026: privacy policies must disclose automated decisions that significantly affect people.
• South Korea, from about January 2027: the AI Basic Act's grace period on fines, which began when the law took effect on January 22, 2026 and runs for at least a year, starts to run out. Hiring AI is classed as "high-impact."
• India, May 13, 2027: the Digital Personal Data Protection Act's substantive duties apply, including to candidate data.

And China's Personal Information Protection Law already gives people the right to an explanation of automated decisions with a major effect on them, and to refuse decisions made solely by automation.

Australia: disclose the decisions, not just the data

From December 10, new Australian Privacy Principles 1.7 to 1.9 require a privacy policy to describe the kinds of personal information used in computer programs that make decisions which could significantly affect someone, the kinds of decisions made solely by a program, and the kinds where a program does something "substantially and directly related" to the decision. The regulator, the OAIC, published guidance on September 30, 2026. The disclosure is by category, not per candidate, and it applies to decisions made after commencement even if the data was collected earlier.

One question isn't settled: how the employee-records exemption interacts with job applicants. Candidates aren't employees, so the safer reading is that automated screening and assessment scoring are in scope.

South Korea: "high-impact" means hiring

The AI Basic Act puts AI that significantly affects people's rights, including in hiring, into a high-impact category with duties to explain outcomes and the main criteria behind them, keep human oversight, notify users in advance, and maintain risk-management and user-protection plans. Fines run to KRW 30 million, deferred during a grace period of at least one year.

Most duties fall on "AI business operators." Whether an employer that uses a vendor's screening tool only for its own hiring counts as one is still unresolved, so get a Korean counsel view. Either way, your vendor almost certainly is one, and its compliance becomes your due-diligence question.

India: candidate data needs a notice and a reason

India notified its DPDP Rules on November 13, 2025, with consent-manager provisions from November 13, 2026 and the substantive obligations from May 13, 2027: itemized plain-language notices, consent where consent is the basis, security safeguards, breach reporting within 72 hours, data-subject rights, and erasure once the purpose is served (while keeping logs for at least a year). The Act lets employers process data for employment purposes without consent, but it is not clear that covers candidates. Plan for candidate notices and consent flows.

China: explanation and refusal rights already apply

Under the PIPL, automated decisions must be transparent and fair. People can ask for an explanation and refuse decisions made solely by automation when the effect is major, and a personal-information impact assessment is required before automated decision-making. Separately, since September 1, 2025, AI-generated content distributed online, such as AI-written job ads or avatar recruiter videos, must be labeled.

Around these, the region is tightening in the same direction. Vietnam's data protection law (in force January 1, 2026) requires impact-assessment filings within 60 days of starting processing. Singapore's Workplace Fairness Act is expected to commence at the end of 2027, and its tripartite guidance already says AI should inform hiring decisions, not make them.

Five countries, one pattern: tell people, explain the outcome, keep a human who can change it.

One regional standard

1. Run one Asia-Pacific inventory of every tool that screens, scores, ranks, interviews or chats with candidates, by country.
2. Update the Australian privacy policy before December 10 with the kinds of information and the kinds of decisions involved.
3. Ask vendors for their Korean high-impact self-assessment, explanation capability and override design, and put them in the contract.
4. Build one explanation-plus-human-review step that satisfies China's right to refuse and Korea's explanation duty, and offer it everywhere.
5. Rewrite candidate notices for India and agree a 72-hour breach workflow with every HR vendor before May 2027.
6. Label AI-generated recruiting content in China, and keep a record of what was generated.

Asia-Pacific won't hand you one law to comply with. It will hand you a calendar, and the first date is December 10, 2026.

See every upcoming date in the regional calendar →