Japan: Personal Information Protection Commission adopted revisions to guidelines on provision to foreign third parties integrating Global CBPR System

On 8 October 2025, the Personal Information Protection Commission (PPC) will promulgate and implement revisions to the guidelines on the Act on the Protection of Personal Information concerning the Provision of Personal Data to a Foreign Third Party. The amendments incorporate explicit references to both the APEC Cross-Border Privacy Rules (CBPR) System and the newly established Global CBPR System as recognised frameworks ensuring adequate safeguards for cross-border data transfers. The revised guideline updates definitions and examples of international certification mechanisms, clarifying that entities certified under the Global CBPR System satisfy the requirement of “equivalent protection” under the Act on the Protection of Personal Information (APPI). It also confirms Japan’s participation in both the APEC and Global CBPR Systems.