What foreign founders must know about Japan’s data privacy rules

1. Introduction: Why Japan's Data Privacy Rules Matter Now

In recent years, foreign entrepreneurs have increasingly turned their attention to the Japanese market. A variety of factors make Japan attractive to international founders: it is one of the world's largest consumer markets, it offers opportunities to compete or partner with major corporations, and it has a stable legal and social system. These advantages have driven a growing number of overseas startups to expand into Japan.

At the same time, some aspects of Japan's regulatory framework differ from those in other jurisdictions, which may create barriers when conducting business locally. For example, the Act on the Protection of Personal Information (“APPI”) contains unique requirements compared with other data protection and privacy frameworks, and companies often need Japan-specific measures when processing personal data in Japan.

Given these circumstances, foreign startups aiming to enter Japan must understand Japan's legal requirements before offering products or services in the Japanese market. This article focuses on APPI, an area of particular relevance to overseas startups such as SaaS providers, and highlights key differences between APPI and the EU General Data Protection Regulation (“GDPR”).

2. Basics of Japan's APPI

An explanation of the basics of Japan's APPI, including its core concepts and requirements, is set out below:

Core Concepts

Covered Entities:‍

Personal Information Handling Business Operators (“PIHBOs”): Entities that use personal information databases for business purposes. Most private-sector companies fall under this category. (Note: Public-sector entities are regulated separately and are excluded here.)

Covered Data:

Personal Information: Information relating to a living individual that includes descriptions capable of identifying a specific person, or that contains personal identifiers. This includes information that can identify a person on its own, as well as information that can identify a person when combined with other data.

Personal Data: Personal information stored in a structured database.

Retained Personal Data: Personal data over which a PIHBO has the authority to respond to data-subject requests. Data processed solely in the capacity of a processor is generally excluded.

‍

Basic Requirements

Collection:

Prohibition on improper acquisition: Personal information must not be collected through unlawful or improper means.

Collection of sensitive personal information: Obtaining sensitive personal information requires the data subject's prior consent.

Use:

Notification or publication of the purpose of use: When collecting personal information, a PIHBO must notify the individual of the purpose of use or make it publicly available.

Limitation to the specified purpose: Personal information must not be processed beyond what is necessary to achieve the specified purpose.

Management:

Security measures: A PIHBO must properly safeguard personal data to prevent leakage, loss, or damage.

Supervision of employees: Employees processing personal data must be supervised to prevent unauthorized leakage, loss, or damage.

Supervision of processors: Processors entrusted with personal data must be appropriately supervised.

Provision:

Sharing personal data with third parties: Consent must be obtained before providing personal data to third parties (exceptions include entrustment, business succession, and joint use).

Transferring personal data to third parties outside Japan: Transferring personal data to a foreign third party requires obtaining consent after explaining the destination country, a summary of the foreign personal information protection laws, and the recipient's personal information protection measures (exceptions apply where the recipient maintains APPI-equivalent safeguards).

Data Subject Rights:

Responding to data subject's requests concerning retained personal data: A PIHBO must respond to a data subject's requests regarding retained personal data, including:
• Notification of the purpose of use
• Disclosure
• Correction, addition, or deletion
• Suspension of use or erasure
• Cessation of third-party provision

Incident Response:

Notifying the regulator and affected data subjects of data breaches: A PIHBO must notify both the Personal Information Protection Commission and affected data subjects in the event of the following statutory data breaches:
• Cases involving sensitive personal information
• Cases involving data that may cause financial harm
• Cases suspected of malicious intent
• Cases affecting more than 1,000 data subjects

3. Common Misunderstandings Among Foreign Entrepreneurs

This section compares the APPI with the GDPR in areas where foreign founders often misunderstand the rules:

Cross-border data transfers:

APPI: Transfers typically rely on: (i) informed consent, (ii) adequacy decisions, or (iii) contractual arrangements imposing APPI-equivalent obligations.

GDPR: Transfers typically rely on: (i) EU Commission adequacy decisions, (ii) contractual arrangements imposing appropriate safeguards (SCCs or BCRs), or (iii) derogations such as explicit consent, in very limited circumstances.

Direct email marketing:

APPI: Prior consent is required; relying on a short clause buried in the Terms of Service is discouraged. An exception may apply where an existing business relationship exists.

GDPR: The EU ePrivacy Directive applies, but implementation varies by Member State. The most common position is that B2C marketing requires opt-in consent unless a soft opt-in with an opt-out option applies. B2B rules are mixed. Requirements should be checked country by country.

Notice and consent at data collection:

APPI: Notice of the purpose of use is required. Consent is required for collecting sensitive personal information, but not for personal information in general.

GDPR: Notice obligations include the purpose and lawful basis of processing. The processing of sensitive personal data is prohibited unless specific conditions are met, which may include explicit consent for certain processing activities.

Security measures:

APPI: Required measures include: (i) a basic policy, (ii) internal rules, (iii) organizational, personnel, physical, and technical safeguards, and (iv) a review of external environments.

GDPR: Controllers must implement appropriate technical and organizational measures (TOMs) to protect data from unauthorized or unlawful processing. TOMs may include: (i) access controls, (ii) physical security safeguards, (iii) data encryption, (iv) pseudonymization, (v) backups and business continuity measures, and (vi) incident detection and response.

Use of overseas servers:

APPI: Transfers to a different corporate entity require cross-border transfer compliance. Transfers within the same corporate entity are exempt, but external environment review is still required as part of the security measures.

GDPR: A transfer requires there to be an exporter and a separate third-party importer, meaning communication or disclosure within the same corporate entity is not necessarily treated as a data transfer. However, intragroup transfers are covered and require appropriate safeguards.

Cloud services:

APPI: If the “cloud exception” applies - i.e., the provider contractually does not handle personal data and implements appropriate access controls - cross-border transfer and processor-supervision obligations do not apply.

GDPR: There is no equivalent cloud services exception under the GDPR. Engaging a cloud service provider, like any other processor, requires controllers to have an Article 28-compliant processing agreement in place.

4. Case Study: Overseas SaaS Startup Entering Japan

Consider the case of a foreign SaaS company providing services to Japanese enterprise users and thereby processing their personal data. Key obligations include:

Cross-border data transfers: The user company must rely on one of the following: (i) informed consent; (ii) transfer to an adequacy-recognized country; or (iii) contractual arrangements imposing APPI obligations. SaaS providers are encouraged to prepare Terms of Service that support option (iii).

Supervision of processors: The user company must supervise the SaaS provider's processing. This includes: (i) selecting an appropriate processor; (ii) entering into proper agreements; and (iii) monitoring the processing status. SaaS providers should prepare Terms of Service that address obligation (ii).

Please note that if the cloud exception applies, both the cross-border transfer requirements and the processor-supervision obligations may be exempt.

5. Building Trust in Japan

Japan has a distinctly high level of compliance awareness among both companies and consumers, and expectations in the data protection and privacy fields have risen sharply in recent years. The reputational exposure associated with these areas is considerable, and regulatory action can trigger reputational fallout that directly affects a company's ability to operate in Japan. For foreign founders, establishing trust requires more than simply transplanting overseas privacy standards; it requires building an APPI-compliant framework tailored to Japan's regulatory environment.