Act on the Protection of Personal Information, cross-border transfer

Act No. 57 of 2003, as amended by Act No. 37 of 2021, Art. 28

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 1 April 2022.

A cross border transfer rule binding public and private bodies.

As of 29 August 2026.

What it requires

An app transferring the personal data of a person in Japan to a recipient in a foreign country must obtain the data subject's prior consent after disclosing the destination country's protection system and the recipient's own measures, unless the destination is a PPC-recognized equivalent jurisdiction or the recipient maintains APPI-equivalent measures.

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Art. 28 requires a data subject's prior consent before a business transfers personal data to a third party in a foreign country, unless the destination country is one the Personal Information Protection Commission (PPC) has recognized as having an equivalent personal-information protection system, or the recipient has established a system that continuously ensures measures equivalent to APPI's own Section 4 duties.

Before seeking consent, the business must disclose the destination country's protection system and the recipient's own measures. This is a real consent-or-adequacy restriction, moderate rather than absent; there is no general data-localization mandate in APPI itself.

When LexLint raises it

crawls_web
trains_models
processes_biometrics
processes_voice

Read the law

official statute text, Japanese Law Translation portal

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app