While the European Union's General Data Protection Regulation (GDPR) has been in effect for a little over a year now, results from a new survey conducted by law firm McDermott Will & Emery and the Ponemon Institute show that businesses in China and Japan are still lagging behind in their data privacy compliance efforts.

However, it may not stay that way for long. Mark Schreiber, a partner at McDermott Will & Emery, thinks entities in China and Japan may have been holding back to see how other global players like the EU or the U.S. have responded to the GDPR.

Now, some greater movement towards GDPR compliance may be on the horizon. Japan already entered into a data transfer partnership agreement with the EU earlier this year, and Schreiber noted that China has proven capable of propelling change very quickly.

"It may be that China and/or Japan will advance after seeing [responses to the GDPR] in ways that even in the U.S. we haven't done," Schreiber said.

As for right now, both countries still appear to be biding their time. The survey, which included responses from 1,263 companies across the U.S., Europe, China and Japan, found that only 29% of Chinese respondents and 32% of Japanese respondents indicated that they were fully compliant with the GDPR. That was more than 10% lower than their Western counterparts.

Awareness didn't fare much better, with 49% of Chinese respondents and 36% of Japanese respondents stating that they were not familiar with the regulation.

According to Schreiber, China and Japan don't want to be leading the pack when it comes to GDPR compliance. But why?

Dan Greene, a certified information privacy professional at Beckage, pointed to the costs and resources a company would have to direct towards compliance. Some might be more inclined to sit back and monitor the number and scope of the fines that have resulted globally from GDPR infractions before deciding the kind of investment it merits.

There's also existing privacy and cybersecurity regimes in both Japan and China to consider. Japan's Act on the Protection of Personal Information has been on the books since 2003, while China's Cybersecurity Law (CSL) was enacted in 2017.

Businesses looking to comply with both the GDPR and CSL, for example, may find themselves juggling two competing directives. The GDPR tends to focus on individual rights and protections, while the CSL is geared more toward national security, with data required to undergo a review by the Chinese government before transfer if it meets certain criteria.

Companies found in violation of China's cybersecurity law can be fined or even forfeit their internet presence. The specter of those outcomes may also be factored into a business's approach to the GDPR.

Greene thinks that there needs to be "an added layer of analysis" for agreements that may trigger concerns related to both the GDPR and Chinese privacy or cybersecurity rules.  "So look at sort of what the risks are in your own backyard versus those that are thousands of miles away."

Still, market forces are market forces, and the opportunity to do business with EU companies and consumers may be too much for businesses in Japan and China to pass up.

Of course, a steadily expanding roster of headline-making fines against companies like Google is also a good incentive to play by the rules.

"[China and Japan] are beginning to realize that even if there isn't a lot of enforcement activity right away, it could catch up to the them and that would be bad for them with respect to reputation. And those companies from China and Japan are often concerned with reputation," Schreiber said.