Using foreign SaaS: cross-border transfers under Japan's APPI
1. "It is a processor, so no consent is needed" is not the end of the analysis
Where the handling of personal data is entrusted to an external party, and the entrustment stays within its scope, the recipient is not a "third party" under Article 27(5)(i) of the Act on the Protection of Personal Information (APPI), and consent to third-party provision is not required. But SaaS and cloud use is not always characterised as entrustment: whether the provider handles the data, and for what purposes it uses it, has to be checked against the contract and the actual arrangement.
And where the recipient is a party located outside Japan, there is a further layer. Article 28 of the APPI regulates provision of personal data to a third party in a foreign country separately from the general third-party provision rules. "Third party" here includes an entrusted party, so being a processor is not a reason to skip Article 28.
This is the step most often missed when a foreign tool is adopted without reading the contract terms or mapping the data flow. What follows is the order in which the analysis is usually done.
2. Which of the three routes applies
| Route | Content | Practical burden |
|---|---|---|
| ① Consent of the data subject | Obtain consent in advance to provision to a third party in a foreign country | Information must be provided when consent is obtained; consents must be collected and managed |
| ② Countries with an equivalent level of protection | Provision to countries and regions designated by the Personal Information Protection Commission (the EU member states so designated, and the UK) | No additional Article 28 consent in principle; Article 27 and other rules still apply |
| ③ Recipient with a conforming framework | The recipient has established the framework necessary to take, on a continuing basis, measures equivalent to those required of a personal information handling business operator | Must be secured by contract and confirmed on a continuing basis |
SaaS arrangements often rely on route ③: the contract with the provider secures continuing implementation of the equivalent measures, and implementation is confirmed on an ongoing basis. In practice this means reading the provider's data processing agreement (DPA) or standard contractual clauses and asking whether it meets the requirements of route ③.
3. Information to provide where consent is the basis
Where consent is the basis, the following must be provided to the data subject in advance, at the time consent is sought.
- The name of the foreign country
- Information on that country's personal information protection regime, obtained by appropriate and reasonable means
- Information on the measures the recipient takes for the protection of personal information
An abstract statement such as "data may be stored on overseas servers" is therefore not sufficient where consent is the basis. The country name, the information on its regime and the information on the recipient's measures must in principle be provided when consent is sought. Where the destination country cannot be identified at that point, the rules require a different, specified set of information instead.
4. Continuing obligations where a conforming framework is the basis
Route ③ is not complete on signature. The exporting party must:
- take the measures necessary to secure continuing implementation of the equivalent measures, and
- provide information about those measures at the request of the data subject
The first includes periodic confirmation of how the recipient is implementing the measures, and of the existence and content of any regime in that country that may affect implementation. "Periodic" is understood as about once a year or more often, so an annual review should be built into the operating routine.
5. Where you are only using a cloud service
A recurring question is cloud use. Where the provider does not handle the personal data, there is an argument that no provision of personal data occurs at all, in which case Article 28 does not need to be considered.
That characterisation holds only where the contract provides that the provider will not handle the personal data and appropriate access controls are in place. It is not available where the provider uses the data for its own purposes — for example, using input content to improve the service or to train models.
So the points to check are:
- Whether the terms or DPA allow the provider to use the data for its own purposes
- Whether the opt-out settings for training on input data are configured as intended
- Whether the design allows provider-side access to the data, for example through support workflows
- Whether the list of sub-processors is published, with their locations
Point 2 is the one that bites when generative AI tools are introduced. Free and paid plans frequently differ in how input is used.
6. How to work through it
Step 1: inventory the tools in use
List, by department, the tools that hold personal data: CRM, email delivery, support ticketing, accounting, recruiting, time and attendance, chat, storage, analytics, generative AI. Free tools adopted directly by a team are the ones that go missing.
Step 2: check three things for each
- The location of the recipient and any sub-processors, and where the data is stored and processed (server location alone does not determine whether Article 28 applies)
- The characterisation of the arrangement (does provision occur, or is the provider contracted not to handle the data)
- Where provision occurs, the basis relied on (① consent / ② designated country / ③ conforming framework)
Step 3: reconcile with the privacy policy
Compare the inventory with the privacy policy you actually publish. A policy has to match the real data flows. If the stated purposes of use are narrower than reality you have a purpose-limitation problem; if they are drafted too broadly, the specification requirement may not be satisfied.
Step 4: keep a record of the confirmations
The continuing confirmation required under route ③ cannot be evidenced without a record. Add columns for the date of confirmation and the person who made it to the inventory.
7. When a breach occurs
One more thing to settle in advance. Where a leak or similar incident occurs, reporting to the Personal Information Protection Commission and notifying data subjects is mandatory in defined cases: where sensitive personal information is involved, where there is a risk of financial loss, where the incident may have been committed for improper purposes, or where more than 1,000 data subjects are affected.
Reporting to the Commission has two stages: a preliminary report promptly after discovery (a guide of three to five days), and a final report within 30 days in principle, or 60 days where improper purposes may be involved.
Where the incident occurs at an entrusted party, the entrusting party can carry the reporting obligation. With a foreign provider involved, establishing the facts alone costs you the time difference and the language gap. Decide in advance who establishes the facts, who decides whether reporting and notification are required, and who executes.
Note that an amendment to the APPI was promulgated on 17 July 2026 and will take effect, apart from certain provisions, on a date to be fixed by Cabinet Order within two years of promulgation. Implementing orders, rules and guidelines are still being developed, so this article will need to be revisited on entry into force. This article is general information, not legal advice on any specific matter. Please check the current guidelines and Q&A of the Personal Information Protection Commission before acting. For help with a data inventory or a privacy policy for Japan, please use the contact form.