Legal Bases for Processing of Personal Data
Jump to
Legal Bases for Processing of Personal Data Start Comparison
Is an identified legal basis required in order to collect or process non-sensitive personal data?

Last review date: 17 January 2025

Yes.

The following are potential legal bases for processing personal data:

         appropriate notice has been provided to or made available to the data subject

         the data subject has provided consent to the processing for the identified purposes

         the personal data is necessary to comply with a legal obligation

         the personal data is necessary to protect the vital interests of a natural person

The collection and use of non-sensitive personal information generally do not require consent. Instead, the business owner needs to provide the data subject (directly or indirectly) certain information relating to the business owner and the nature of the collection. The data subject's consent is required if transfers of personal information within Japan or overseas are involved.

Is an identified legal basis required in order to collect or process sensitive personal data?

Last review date: 17 January 2025

Yes

The following are potential legal bases for processing special categories of personal data:

         the data subject has given consent to the processing, where consent is measured to the same standard as non-sensitive personal data

         processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law

         processing is necessary to protect the vital interests of the data subject or of another natural person where the data subject is physically or legally incapable of giving consent

         processing relates to personal data which are manifestly made public by the data subject

         processing is necessary for reasons of public interest in the area of public health

Data subject consent is required for the collection and transfer of sensitive personal information. In addition, information regarding the collection and transfers must also be notified or made available to the data subject.

Are there special requirements that apply to the collection or processing of personal data from minors?

Last review date: 17 January 2025

Yes.

A minor is a person below the age of 18.

In what circumstances do these special requirements apply?

Last review date: 17 January 2025

☒         generally

While the APPI does not have a definition for "minor," the Japanese Civil Code considers an individual below the age of 18 as a minor. The APPI does not provide rules specifically relating to minors. However, a Q&A report on the APPI issued by the PPC states that business owners need to obtain consent from a person who has parental responsibility if the business owner needs to process personal information of minors between the ages of 12 and 15 or below. The guidelines on the APPI issued by the PPC also state that minors below 18 need to obtain consent from a person with parental responsibility if the minor is to give consent.

What are the special requirements that apply to collecting or processing personal data from minors?

Last review date: 17 January 2025

☒         consent must be given or authorized by the parent/ guardian of the minor