Cross-border Transfer of Personal Data

by：Kensho Onoda、Poom Kerdsang

Introduction

When foreign startups expand into Japan, their Japanese operations frequently need to transfer data back to the home country. Typical examples include centrally managing Japanese customer data on a headquarters server or having the home country’s engineering team analyze Japanese user data.

This article explains key points to be aware of under the APPI when conducting cross-border transfers of personal data. It highlights Japan’s unique regulatory framework and differences from the EU’s GDPR.

Overview

Under the APPI, providing personal data to a “third party located abroad” is subject to special regulations compared to ordinary third-party transfers (Article 28 of the Act; commonly referred to as “cross-border transfer”).

The term “provision” here is not limited to physically handing over data. Making data accessible to a foreign company via a network also constitutes “provision”. Under the APPI, any transfer of personal data to a separate entity, including a group company, business partner, or service provider, constitutes a “third-party provision” and generally requires the individual’s prior consent, unless a statutory exception applies. The cross-border transfer rules described in this article impose additional requirements on top of this basic consent obligation.

Therefore, if data held by a Japanese corporation is accessible to its parent company in the home country, this alone could constitute a “provision to a third party located abroad”. This regulation applies even if the data is merely made “viewable,” reflecting the broad scope of this rule.

Three Methods for Cross-Border Transfer of Personal Data

To transfer personal data abroad, one of the following conditions must generally be met. Note that obtaining consent for the third-party provision itself is a prerequisite. This section explains the additional requirements when the provision constitutes a cross-border transfer, beyond the basic consent requirement.

1. Obtaining the individual’s consent
2. The recipient is located in a country with an “equivalent level of protection” to Japan (currently, only EEA member states (EU member states plus Norway, Iceland, and Liechtenstein) and the UK)
3. The recipient has established a “system conforming to the standards” (in practice, this generally involves executing a data transfer agreement that requires the recipient to handle personal data in accordance with APPI standards, or obtaining certification under a recognized international framework)
   For example, where the recipient has obtained certification under the APEC CBPR System, this falls within this category.

For many foreign startups, the relevant options are either (1) or (3). Regarding (2), the eligible countries are limited; currently, only EEA member states and the UK qualify.

While the GDPR widely employs mechanisms like “adequacy decisions” and “Standard Contractual Clauses (SCCs),” Japanese law uses the unique concept of a “system conforming to the standards”. This requires more than just signing a contract; it imposes an ongoing obligation to verify compliance.

Cross-border Transfer Based on the Individual’s Consent and Information Provision Obligations

When transferring data cross-border based on the individual’s consent, a general statement such as “We will transfer data overseas” does not satisfy the APPI’s requirements.

Business operators handling personal information must provide the following information to the individual in advance (APPI, Article 28, Paragraph 2; Enforcement Rules, Article 17, Paragraph 2). This information can be provided in writing, electronically, or by posting it on a website.

1. Name of the foreign country to which the data will be transferred
2. Information regarding the personal data protection system in that foreign country
3. Information on the personal data protection measures implemented by the recipient

For example, if a Japanese corporation transfers data to its headquarters in Country A, simply stating the country name is not enough. The corporation must also provide information, obtained by reasonable means, about Country A’s personal data protection framework and the possibility of government access to the data.

This is similar to the GDPR’s transparency obligation. However, the APPI goes further by requiring the provision of specific information as a condition precedent to consent. Consent obtained without this information does not satisfy the statutory requirement.

Transfers Based on Compliance Frameworks and Ongoing Verification Obligations

If the recipient has established a “system conforming to the standards,” consent from the individual is not required for cross-border transfers. However, the business operator assumes significant obligations in return (as noted above, consent for the underlying third-party provision is still required).

Specifically, the business operator must regularly verify the implementation status of equivalent measures at the recipient, take corrective action if problems arise, and suspend the provision if continuation becomes difficult.

Furthermore, upon the individual’s request, the business operator must explain what these measures involve.

This resembles the “Transfer Impact Assessment” under the EU’s Standard Contractual Clauses (SCCs). However, a key difference is that the APPI explicitly requires periodic verification by statute.

For startups, a data transfer agreement with the parent company alone is not sufficient. A system for conducting regular compliance reviews must also be established.

Cloud Services and Cross-border Compliance

The use of foreign cloud services also raises important compliance considerations regarding personal data.

If the cloud provider’s contract specifies that it “does not handle personal data,” the arrangement may not constitute a third-party provision. This exception applies where the provider merely stores data without accessing or using its contents. However, even in such cases, it is necessary to assess the legal framework of the country where the servers are located and implement security measures as part of the “assessment of the external environment” described below.

Furthermore, if the server location cannot be identified, the business operator must disclose this fact along with the reasons.

Unlike the GDPR, which restricts cross-border transfers but does not require disclosure of the specific storage location, the APPI treats “disclosing the country where data is stored” as part of the obligation itself.

Assessing the External Environment and Implementing Security Measures

When personal data is handled in a foreign country, the business operator must “assess the external environment” as part of its security obligations. Specifically, the operator must review the legal framework of the relevant foreign country and implement measures proportionate to the identified risks.

While the Personal Information Protection Commission publishes overviews of each country’s legal frameworks, business operators bear ultimate responsibility for their own assessments.

When foreign startups enter the Japanese market, even if data processing is conducted through a Japanese subsidiary, they must thoroughly assess the relationship with their home country’s legal framework.

Key Differences Between APPI and GDPR in Cross-Border Transfers

The following table summarizes the principal differences between the APPI and the GDPR regarding cross-border transfers of personal data.

Point	APPI (Japan)	GDPR (EU)
Consent requirements	The business operator must provide specific information (destination country name, the country’s data protection framework, and the recipient’s protection measures) before obtaining consent	Consent is one of several legal bases for transfer; there is no obligation to disclose the destination country’s legal framework as a condition of consent
Transfer safeguards	“System conforming to the standards,” typically implemented through a data transfer agreement or international certification	Standard Contractual Clauses (SCCs), Binding Corporate Rules (BCRs), or adequacy decisions
Ongoing monitoring	Statutory obligation to periodically verify the recipient’s compliance; annual verification at minimum	Verification is expected under SCCs, but the frequency is not prescribed by statute
Cloud services	Even where the cloud provider does not “handle” personal data, the business operator must disclose the server location and the relevant country’s legal framework to individuals	Data processing agreements are required, but there is no separate obligation to disclose the storage location to individuals
Whitelisted jurisdictions	EEA member states and the UK	Countries subject to adequacy decisions (including Japan, the UK, South Korea, and others)

As the table shows, the APPI’s approach places a heavier emphasis on transparency and ongoing monitoring compared to the GDPR, particularly in its requirements around disclosing the destination country’s legal framework and verifying compliance on an ongoing basis.

Summary

The APPI imposes multi-layered cross-border transfer regulations that extend beyond consent to include obligations such as information provision, ongoing verification, and assessment of the external environment.

Particularly for foreign startups transferring data from their Japanese operations to their home country, several Japan-specific considerations must be made. For example, granting data access to the parent company may itself constitute “provision”. Additionally, the foreign startups must specify the destination country and relevant legal framework information. An information provision obligation also applies even when using cloud services.

While the Japanese market is attractive, delaying compliance with data regulations can lead to significant risks during business expansion. Building a legal framework for cross-border transfers and establishing governance structures early in market entry will help avoid costly compliance gaps later on.

The following checklist provides a starting point for foreign startups preparing cross-border transfer compliance:

1. Identify the applicable transfer method: consent, equivalent country, or system conforming to the standards.
   • If relying on consent, prepare the required information package, including the destination country name, an overview of the country’s data protection framework, and the recipient’s data protection measures.
   • If relying on a compliance framework, execute a data transfer agreement with the recipient and establish a process for periodic verification (at least annually).
2. Assess the legal framework of each country where personal data will be stored or accessed, including countries where cloud servers are located.
3. Where a server location cannot be identified, prepare a disclosure explaining the reason and any alternative information available.

GVA Global Law Office can provide advice tailored to your company’s specific circumstances, including drafting a Privacy Policy. When considering entering the Japanese market, please consult with GVA Global Law Office.