Last review date: 17 January 2025
Yes.
Third country means a country or region located outside the territory of Japan.
Transfers of personal data to third countries are only permissible if there is a legal basis for the processing/transfer and one of the following applies:
☒ approved adequate/whitelisted jurisdictions
☒ to holders of specific certifications or followers of specific code of conduct programs each approved by the relevant data protection and cybersecurity authority (e.g., EU-US Data Privacy Framework)
☒ derogations, such as consent, contract performance, necessity to establish, exercise or defend legal claims
☒ other solutions
Please see separate question for information on data localization provisions that are not restricted to personal data.
Taking adequate precautionary measures for the protection of personal data, as specified by the PPC, is one of the legal bases for cross-border data transfers. This includes executing a data transfer agreement or an internal rule that provides obligations equivalent to those provided under the APPI. In addition, under the amended APPI that has become effective on 1 April 2022, information concerning the data protection regime of the country where the data recipient is located must be disclosed to the data subjects when the cross-border transfer is made based on consent. If the cross-border transfer is made based on executing a data transfer agreement, information concerning the data transfer agreement must be disclosed upon request by the data subject.