JapanAct on the Protection of Personal Information, records of provision to and receipt from third parties
Act No. 57 of 2003, as amended by Act No. 37 of 2021, Arts. 29, 30
In force since .
A comprehensive regime rule binding private bodies.
- Audit expectation
- none
As of .
What it requires
- An app that provides the personal data of a person in Japan to a third party must prepare a record of the date of provision, the third party's name and the other matters the Personal Information Protection Commission's rules require, and keep it for the period those rules set (one to three years).
- An app that receives the personal data of a person in Japan from a third party must first confirm the third party's name and address and how it acquired the data, then prepare a record of the date of receipt and the matters confirmed and keep it for the period the Commission's rules set (one to three years).
These lines are LexLint's reading of the law's text, as of .
What it makes you log
What the log must hold
Event time, Affected person reference, Consent or opt-out state, Data lineage
Log retention
Enforcement Rules Article 21 sets the period for the record of provision and Article 25 the period for the record of receipt, each in three cases. Where a contract or other document that holds the items stands in as the record, the record is kept until one year has passed since the last provision (or receipt); where one record covers continuing or repeated provision (or receipt), it is kept until three years have passed since the last provision (or receipt); in any other case it is kept for three years. One year is the shortest of the three periods.
- Unit
- Years
- As of
- Basis
- Fixed
- Minimum value
- 1
Logging duty
Article 29 requires a business that has provided personal data to a third party to prepare a record of the date of provision, the third party's name and other matters the Commission's rules set, and Article 30 requires a business that receives personal data from a third party to confirm the third party's name and address and how it acquired the data, then prepare a record of the date of receipt and the matters confirmed. Each record is kept for a period the Commission's rules set. Neither duty applies where the provision falls under an item of Article 27, paragraph (1) (provision allowed without the person's consent) or paragraph (5) (recipients not treated as third parties). The Enforcement Rules name the items of each record (Articles 20 and 24) and the periods (Articles 21 and 25). Article 33, paragraph (5) extends the person's right to disclosure to these records, but it is not a section this row cites, so no access route is set from it. The row names no scope clause, so no territorial hook is set.
- Kind
- Explicit
- As of
- Provision
- Act Articles 29 and 30; Enforcement Rules Articles 19 to 25
- Trigger
- personal_data_processing
What this law does
A business handling personal information that provides personal data to a third party must prepare a record of the date of provision, the third party's name and the other matters the Personal Information Protection Commission's rules set, and keep it for the period those rules set.
A business that receives personal data from a third party must first confirm the third party's name and address and how the third party acquired the data, then prepare and keep a record of the date of receipt and the matters confirmed. Under the Commission's Enforcement Rules the record is kept for three years in the usual case, and for one year after the last provision or receipt where a contract or other document that already holds the required items stands in as the record.
The record duties do not apply to a provision or receipt that falls under an item of Article 27, paragraph (1) or (5). They bind a business handling personal information, a term that excludes national government organs, local governments and incorporated administrative agencies.
When LexLint raises it
When your app profile says your app crawls the web, trains models, deploys a chatbot or sends automated outreach.