JapanAct on the Protection of Personal Information, cross-border transfer
Act No. 57 of 2003, as amended by Act No. 37 of 2021, Art. 28
In force since .
A cross border transfer rule binding public and private bodies.
- Audit expectation
- none
What it requires
- An app transferring the personal data of a person in Japan to a recipient in a foreign country must obtain the data subject's prior consent after disclosing the destination country's protection system and the recipient's own measures, unless the destination is a PPC-recognized equivalent jurisdiction or the recipient maintains APPI-equivalent measures.
These lines are LexLint's reading of the law's text. Also read by: Personal Information Protection Commission (PPC), Japan (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
The Commission’s guidelines accept a contract, a confirmation or a memorandum for an outsourced recipient abroad, and internal rules or a privacy policy applied to both sides (内規 ("internal rules")) for a transfer within a corporate group.
- As of
- Guidance link
- https://www.ppc.go.jp/personalinfo/legal/guidelines_offshore/
- Guidance body
- Personal Information Protection Commission (PPC), Japan
What it makes you log
Logging duty
Article 28 conditions the provision of personal data to a third party in a foreign country on the identifiable person's consent (after information on the foreign system and the third party's measures), unless the destination is recognized as equivalent or the third party keeps equivalent measures; Article 28(3) requires the business to ensure the third party continues those measures and to give the person information about them on request. None of that is a duty to make or keep a log or record. The Act's record duties sit in Article 29 (a record of each provision of personal data to a third party, with the date and the third party's name, kept for the period a Commission order sets) and Article 30 (confirmation and a record on receiving personal data from a third party); neither article is among the provisions this row cites, so the row does not borrow them. Article 29(1) names a provision under Article 28(1) in its proviso, so the record duty also reaches cross-border provision, but that is Article 29's own text.
- Kind
- None
- As of
What this law does
Art. 28 requires a data subject's prior consent before a business transfers personal data to a third party in a foreign country, unless the destination country is one the Personal Information Protection Commission (PPC) has recognized as having an equivalent personal-information protection system, or the recipient has established a system that continuously ensures measures equivalent to APPI's own Section 4 duties.
Before seeking consent, the business must disclose the destination country's protection system and the recipient's own measures. This is a real consent-or-adequacy restriction, moderate rather than absent; there is no general data-localization mandate in APPI itself.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .