Legal Bases for Processing of Personal Data
Is an identified legal basis required in order to collect or process non-sensitive personal data?

[Last reviewed: 12 January 2023]


The following are potential legal bases for processing personal data:

☒        appropriate notice has been provided to or made available to the data subject

☒        the data subject has provided consent to the processing for the identified purposes

☐        the personal data is necessary to perform a contract with the data subject

☒        the personal data is necessary to comply with a legal obligation

☒        the personal data is necessary to protect the vital interests of a natural person

☐        the personal data is necessary for a public interest

☐        the personal data is necessary to fulfil a legitimate interest of the controller or third party (provided that the interest is not overridden by the data subject's privacy interests and the data subject has not made use of his/her right to object)

☐        other

Collection and use of non-sensitive personal information generally do not require consent. Instead, the business owner needs to provide the data subject (directly or indirectly) certain information relating to the business owner and the nature of the collection. Data subject’s consent is required if transfers of personal information within Japan or overseas are involved.