Japan’s APPI requires control over purpose, recipients and the evidence connecting them.

An organization must specify the purpose of using personal information as explicitly as reasonably possible. Using it beyond the reasonably related scope of that purpose generally requires consent unless an exception applies.

The purpose of use generally must be communicated to the individual or publicly announced. When information is obtained directly from a written document, including an electronic form, the purpose generally must be stated beforehand unless an exception applies.

Personal information must not be acquired through deception or other improper means. Acquiring special care-required personal information generally requires advance consent unless a statutory exception applies.

Organizations must implement necessary and appropriate security safeguards and supervise employees and entrusted service providers handling personal data. Entrustment, business succession and qualifying joint use are not treated identically to ordinary third-party provision.

Providing personal data to an independent third party generally requires advance consent unless an exception or valid opt-out arrangement applies. Organizations may also need to create, verify and retain records of personal-data provisions and receipts.

Providing personal data to a third party in a foreign country may rely on informed consent, an equivalent-country designation, or a recipient maintaining qualifying equivalent safeguards. Each path carries different information, documentation and monitoring requirements.

Cookie identifiers, browsing histories, location data and similar information may constitute personal related information when they do not identify an individual for the provider. Additional confirmation and recordkeeping can apply when a recipient is expected to acquire that information as personal data.

Not every incident is reportable. Qualifying events include those involving special care-required personal information, risk of financial or property damage, a potentially wrongful purpose, or personal data concerning more than 1,000 individuals. Report promptly to the PPC, generally within approximately three to five days after discovery, with a final report generally within 30 days — or 60 days where a wrongful purpose may be involved. Individuals also receive rights involving disclosure, correction, addition, deletion, cessation of use, erasure and cessation of third-party provision.

Under the currently effective law, corporate fines of up to ¥100 million may apply to specified offenses, including certain violations of PPC orders and improper provision or misappropriation of personal-information databases. The PPC may also investigate, request reports, conduct inspections, provide guidance, issue recommendations and issue orders. This is not an automatic fine for every compliance mistake.

A transfer may rely on advance consent covering provision to a foreign third party. Before obtaining consent, the organization generally must provide information about the foreign country’s personal-information protection system and the recipient’s protective measures, to the extent required by PPC rules.

A transfer may occur to a third party in a country designated by the PPC as having a personal-information protection system equivalent to Japan’s. The EU and United Kingdom are currently recognized, subject to applicable details and supplementary requirements.

A transfer may rely on the recipient maintaining a qualifying system of safeguards equivalent to APPI requirements, including through an appropriate contractual or organizational arrangement or applicable international certification framework. The transferring organization must periodically confirm the safeguards continue, generally at approximately annual intervals or more frequently, review foreign legal developments affecting them, address problems, and stop transfers if continued safeguards cannot be ensured. Statutory exceptions may also apply; transfer classification should be reviewed with qualified Japanese counsel.