Law note · Japan
Act on the Protection of Personal Information, cross-border transfer
cite Act No. 57 of 2003, as amended by Act No. 37 of 2021, Art. 28
stage IN FORCE in force since 2022-04-01
kind Cross border transfer
binds public and private bodies
reviewed 2026-08-29
What it requires
- An app transferring the personal data of a person in Japan to a recipient in a foreign country must obtain the data subject's prior consent after disclosing the destination country's protection system and the recipient's own measures, unless the destination is a PPC-recognized equivalent jurisdiction or the recipient maintains APPI-equivalent measures.
When LexLint raises it
crawls_webtrains_modelsprocesses_biometricsprocesses_voice
What we found
Art. 28 requires a data subject's prior consent before a business transfers personal data to a third party in a foreign country, unless the destination country is one the Personal Information Protection Commission (PPC) has recognized as having an equivalent personal-information protection system, or the recipient has established a system that continuously ensures measures equivalent to APPI's own Section 4 duties.
Before seeking consent, the business must disclose the destination country's protection system and the recipient's own measures. This is a real consent-or-adequacy restriction, correcting the derivation seed's earlier no-restriction record to moderate; there is no general data-localization mandate in APPI itself.