Cross-Border Data Transfers Under Japan’s APPI: Article 28 Rules

For a Japanese business to provide personal data to a third party in a foreign country, it generally needs one of the following: the individual’s consent, a system at the recipient meeting the prescribed standards, or the recipient being located in the EU or UK (Act on the Protection of Personal Information (個人情報保護法, APPI), Article 28). When obtaining consent, the business must tell the individual the destination country, that country’s system and other information. Sharing employee data with a parent company in China is also subject to these rules.

Scope of APPI Article 28: what counts as “provision to a third party in a foreign country”

Article 28 sets special rules for providing personal data to a third party in a foreign country. Its conditions are stricter than those for providing data to third parties in Japan.

Who counts as a “third party”

• A parent company or group company in mainland China, Hong Kong or elsewhere (a separate legal entity is a third party)
• Overseas contractors (call centers, system development, payroll processing and so on)
• A cloud service run by a foreign business, where that business handles the personal data

By contrast, a transfer within the same legal entity is not a provision to a “third party”. A transfer from the Japan branch of a Chinese company to its head office in China is also generally treated as a transfer within the same entity. That entity is, however, bound by the obligations of Japan’s APPI. For how the form of your Japanese presence matters, see also a Japan branch versus a Japanese subsidiary.

The foreign-transfer rules apply to outsourcing and joint use too

In Japan, data can be provided without the individual’s consent in the course of outsourcing or joint use. When the recipient is a third party in a foreign country, however, Article 28 applies even to outsourcing and joint use, and in principle one of the three methods described in the next section is required.

Exceptions apply in the cases listed in Article 27(1), such as where the provision is based on laws and regulations, or where it is necessary to protect a person’s life, body or property and it is difficult to obtain the individual’s consent.

Three ways to provide personal data abroad

(1) Individual’s consent and prior disclosure

Consent must cover provision to a third party in a foreign country. Under the amended Act in force from 1 April 2022, businesses must give the individual the following information before obtaining consent:

• The name of the destination country
• That country’s system for the protection of personal information
• The measures the recipient takes to protect personal information

If the destination country cannot be identified at the time consent is obtained, state that fact, the reason and information that may help the individual. On foreign systems, the Personal Information Protection Commission (個人情報保護委員会, PPC) publishes the results of its surveys of major countries’ systems, including that of the People’s Republic of China.

In practice, pair the explanation with consent, for example in an onboarding consent form for employees or on a web registration screen for customers. Consent obtained without adequate explanation may not be a valid basis. If you plan to newly send data already collected abroad, also check whether fresh consent is needed.

(2) System meeting the prescribed standards (contracts, internal rules, certification)

If the recipient has a system for continuously taking measures equivalent to the obligations Japanese businesses must follow, data can be provided without the individual’s consent. Typically this is secured through a contract between provider and recipient, or through group-wide rules on handling personal information. It also covers cases where the recipient holds certification under an international framework (APEC’s CBPR system).

When using this method, the following obligations continue after the provision (Article 28(3)):

• Periodically check how the recipient implements the measures, and whether there are foreign systems that may affect that implementation and what they involve
• Take necessary measures if problems arise, and stop the provision if continuation becomes difficult
• Provide information on the measures taken if the individual requests it

(3) Third parties in the EU or UK

The Personal Information Protection Commission has designated the EU and UK as foreign countries with systems equivalent to Japan’s. Between Japan and the EU, a framework for smooth mutual data transfers began in 2019. In these cases, the same rules as for domestic third-party provision (Article 27) apply. Mainland China, Hong Kong, the United States and others are not covered by this designation.

Using overseas cloud services

Storing personal data on a foreign business’s cloud does not always count as “provision”. The key question is whether the cloud provider is to handle the personal data.

• If the contract provides that the provider will not handle the personal data and access controls are properly in place, it is considered not to be a provision.
• Even if the servers are in Japan, it is a provision to a third party in a foreign country if a foreign business handles the personal data.

Even where there is no provision, you need to understand the foreign systems under which the data is handled as part of your own security control measures (understanding the external environment). As a security control measure for retained personal data, you are also required to make information such as the names of the countries where the cloud provider and servers are located available to individuals.

Sending employee and customer data to a parent company in China in practice

It is common for a Japanese subsidiary to share HR or customer information with its parent company in China. Working through the following steps helps prevent gaps.

1. Data inventory: list which personal data is sent, to whom, to which country and for what purpose.
2. Choice of legal basis: decide whether to rely on individual consent or on a system meeting the prescribed standards, such as an intra-group data transfer agreement.
3. Documentation: prepare consent forms, onboarding explanations, data transfer agreements and internal rules.
4. Privacy policy update: review the purposes of use, transfers abroad and the matters disclosed as security control measures.
5. Records of provision: the obligation to create and keep records of provision to third parties (Article 29) may apply, so check your operations.
6. Periodic review: if relying on a system meeting the prescribed standards, periodically check the recipient’s situation and China’s systems.

Information on foreign employees you hire is also covered. For the overall hiring process, see hiring foreign employees and work visas. Note that when sending data from China to Japan, Chinese laws apply separately. Where data flows in both directions, consult professionals in both countries.

The 2026 amendment and points to watch

On 17 July 2026, an act amending the APPI and other laws was promulgated (Act No. 56 of 2026, 令和8年法律第56号). It includes a new administrative surcharge system, revised consent requirements for purposes such as compiling statistics, and rules on personal information of children under 16. In principle, the effective date is “a date specified by Cabinet Order within a period not exceeding two years from the date of promulgation”, and some provisions are scheduled to take effect at different times. The Article 28 restrictions on cross-border transfers remain after the amendment, but the related Cabinet Orders and rules are still being developed. Until the amendment takes effect, check the latest position in the Personal Information Protection Commission’s published materials.

Breaches of the rules may lead to guidance, recommendations or orders from the Personal Information Protection Commission. Before rushing to send data at the request of a business partner or parent company, take a moment to confirm your legal basis.

How TIMOA can help

Providing personal data to a third party in a foreign country requires one of three bases: individual consent, a system meeting the prescribed standards, or the recipient being in the EU or UK. Group companies and contractors are not exempt, and cloud use also requires you to understand and disclose the relevant foreign systems.

Together with partner attorneys, TIMOA helps you map data flows, prepare consent forms, privacy policies and intra-group data transfer agreements, and build internal compliance structures. For protecting your brand, see also how to register a trademark in Japan. For more, see our IP, Risk & Compliance page.