Are there obligations for controllers to establish controls with respect to data processors?
Last review date: 17 January 2025
Yes.
The obligations are as follows:
☒ other
In Japan, there is no legal concept of controllers and processors. However, a business operator has to exercise necessary and appropriate supervision over a business that processes personal information on behalf of the business owner. There are no specific obligations on how to supervise the service provider.
Are there any direct regulatory or statutory requirements on processors?
Last review date: 17 January 2025
No.
There are no requirements specifically for processors. The APPI does not distinguish between controllers and processors, and all aspects of the APPI apply to any kind of business owner and any business that processes personal information on behalf of the business owner.