Japan: Implemented data transfer provisions of 2020 amendment to the Act on the Protection of Personal Information

On 1 April 2022, the data transfer provisions of the amended Act on the Protection of Personal Information become fully effective. On 24 March 2021, the Japanese government issued the effective date for specific provisions in the amended Act on the Protection of Personal Information. The increased penalties came into effect on 12 December 2020 while the rest of the provisions are implemented on 1 April 2022. The Amendment contains rules on both cross-border data transfers and domestic data protection. Regarding data transfers, the Amendment introduced information procedures for individuals' consent to the provision of personal data to foreign third parties. Businesses must inform data subjects on the destination of the data and the level of foreign data protection for their consent to be valid. In addition, contractual safeguards are sufficient only if transferors take action to ensure implementation and inform data subjects on said action upon request.