8 November

If a business in Japan hands your personal data to a third party abroad, the Act on the Protection of Personal Information (Act No. 57 of 2003, checked on e-Gov on 7 November 2026) generally requires your prior consent to the transfer abroad. The consent requirement does not apply when the Personal Information Protection Commission (PPC) has designated the country in its rules as having protection equivalent to Japan's, or when the recipient has a system that meets the PPC's standards, though in that second case the business must take the measures needed to ensure the recipient keeps up equivalent measures. On 8 November 2001, the Council of Europe (a separate organisation from the European Union) opened for signature an Additional Protocol to the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, requiring each Party to set up supervisory authorities that act in complete independence and hear claims from any person about the processing of personal data. The Protocol also allows transfers to a recipient in a state or organisation that is not a Party to the Convention only if it ensures an adequate level of protection, with two exceptions: domestic law permits the transfer for specific interests of the data subject or legitimate prevailing interests, especially important public interests, or the controller sending the data provides safeguards, such as contractual clauses, that the competent authorities find adequate. Article 133 of the Act provides that the PPC's chairperson and members exercise their authority independently, and when a business in Japan asks for your consent to a transfer abroad, the Act requires it to tell you first about that country's personal data protection system, the measures the recipient takes and other relevant information.