GDPR and DPAs for Japanese Companies: Scope and Cross-Border Data Contracts

Hello! I am Noriaki Asato, Managing Partner of Legal Agent.

A Japanese company preparing to offer SaaS to an EU business is asked to sign a DPA alongside its ordinary service agreement. It already complies with Japan’s Act on the Protection of Personal Information (APPI), but is unsure which clauses to accept and which to negotiate. In international business, contract negotiations can bring GDPR compliance into focus in this way.

The starting point is to distinguish whether the GDPR directly applies to the company, what data it handles on the counterparty’s behalf, and which countries the data moves to. DPAs and SCCs address different issues. Japan’s adequacy decision does not remove every contractual or statutory obligation. This article explains the scope of application and the points Japanese companies should examine in negotiations.

GDPR scope and differences from Japanese law

Under Article 3 of the GDPR, the Regulation applies to personal data processing in the context of the activities of an EU establishment. This remains so even if the processing itself takes place outside the EU. However, having an EU subsidiary does not automatically subject every processing activity of the Japanese parent to the GDPR. Each entity’s role and the relationship between the processing and the EU establishment’s activities need to be assessed.

A company without an EU establishment may also be subject to the GDPR for processing related to offering goods or services to individuals in the EU, or monitoring their behaviour insofar as that behaviour takes place in the EU. The relevant consideration is generally the individual’s presence in the EU. Alongside nationality or a description such as “EU resident,” the relationship between the processing and the individual’s location should be examined.

For example, an online retailer advertising to the EU and offering local delivery and payment in local currencies should assess whom its service targets. Mere accessibility of a Japanese-language website from the EU is insufficient. The factors described in Recital 23, including language, currency and references to EU customers, should be considered together with how the service operates. Tracking browsing histories or profiling also requires an assessment of whether the processing monitors behaviour taking place in the EU.

The APPI and GDPR differ in their specific requirements. Under the GDPR, a company must identify a lawful basis under Article 6 and address transparency requirements and individuals’ rights. Consent is one of several lawful bases: contractual necessity and legitimate interests, for example, have their own requirements.

When translating a domestic privacy policy into English, the company should also check the information required by Articles 13 and 14. This includes the lawful basis, retention period, how to exercise rights and international transfers. I believe legal and operational staff should work together to compare a DPA received by the sales team with the actual use of the data.

Adequacy and Japan’s Supplementary Rules

The EU–Japan framework for personal data transfers took effect on January 23, 2019. The European Commission’s adequacy decision for Japan enables transfers under Article 45 of the GDPR to Japanese recipients within its scope. A qualifying transfer ordinarily does not require separate SCCs as its transfer mechanism.

To rely on adequacy, the parties must check that the recipient and the handling of the data fall within the decision’s scope. Adequacy also does not waive the Article 28 contract requirements or GDPR obligations that apply directly to a Japanese company. Japan’s adequacy status does not, by itself, mean a DPA is unnecessary.

For personal data transferred from the EU or the UK on the basis of adequacy, Japanese businesses must comply with the APPI and the Personal Information Protection Commission’s Supplementary Rules. The rules effective from April 2022 address special care-required personal information, specification and limitation of purposes of use, provision to third parties in foreign countries, and anonymously processed information.

For example, the Supplementary Rules require certain information, including sexual orientation and trade union membership, to be treated as special care-required personal information. A business receiving EU-origin data from another business in Japan must also verify the original purpose of use through the relevant records and handle it within that scope. An intervening domestic transfer does not sever the connection with the original purpose.

A customer management system containing data from overseas should therefore allow staff to trace its source, transfer basis, purpose of use and onward recipients. This also supports compliance with contractual commitments. Operational staff should be able to identify which data is subject to the Supplementary Rules.

Processing scope and outsourcing terms in a DPA

A DPA is an agreement concerning the processing of personal data. Article 28 of the GDPR requires a written contract or other qualifying legal act, including in electronic form, where a controller entrusts processing to a processor. When a counterparty provides a document called a DPA, the first step is to check whether the proposed controller–processor roles reflect reality.

A controller determines the purposes and means of processing. A processor processes personal data on the controller’s behalf. These roles do not always map directly onto the Japanese labels for an outsourcing customer and contractor. For example, a recipient using data for its own independent purposes must consider whether it can properly be treated as a processor acting on the other party’s instructions for that processing.

An Article 28 contract identifies the subject matter and duration of processing, its nature and purpose, the types of personal data, categories of data subjects, and the controller’s rights and obligations. It also addresses documented instructions, confidentiality for authorised personnel, security measures, assistance with individuals’ rights, support for breach-related and other compliance duties, and information needed for audits. A general promise to “comply with the GDPR” does not establish that the necessary terms are covered.

Subprocessors require the controller’s prior specific or general written authorisation. Where general authorisation is used, the processor must notify intended additions or replacements and give the controller an opportunity to object. General authorisation can therefore provide a way to manage changes to a cloud provider’s subprocessors. The contract and operations should align on the notification method, notice period and response to objections.

At the end of the services, the contract must generally provide for deletion or return of the data at the controller’s choice, and deletion of existing copies. There is an exception where EU or Member State law requires storage. Backup deletion schedules, restrictions on use during retention and methods of confirming deletion should be specified consistently with what the service can deliver.

A Japanese company outside the GDPR’s direct scope may nevertheless assume DPA obligations to support its customer’s compliance. Distinguishing direct statutory obligations from contractual commitments helps identify the issues to negotiate concerning audit scope, incident notification deadlines, costs and liability caps.

SCCs and transfers to third countries

SCCs are standard contractual clauses adopted by the European Commission. The 2021 SCCs for international transfers are one means of providing appropriate safeguards under Article 46 of the GDPR, including for transfers to countries without an adequacy decision. Binding corporate rules may be relevant to transfers within a corporate group, and Article 49 derogations may apply in certain circumstances. The parties should identify which mechanism’s requirements their transfer meets.

A DPA primarily addresses processing terms between a controller and a processor, while international-transfer SCCs address protection at the destination. Although some provisions overlap, signing one does not necessarily remove the need to consider the other.

The 2021 SCCs have four modules: controller to controller, controller to processor, processor to processor, and processor to controller. The parties must identify the exporter’s and importer’s roles and the GDPR’s scope for the processing before selecting usable clauses. Whether the recipient’s processing is itself subject to the GDPR is also relevant to using the existing SCCs.

Using SCCs requires comparing the contractual commitments with conditions at the destination. The parties assess the destination country’s laws and practices and the circumstances of the transfer, and consider supplementary measures where needed. Responses to public authority disclosure requests, encryption, access permissions and data locations are among the practical matters affecting whether the promised protection can be provided.

Further attention is required when data transferred from the EU to Japan is subsequently provided to a cloud provider in another country. The parties must examine the APPI and Supplementary Rules governing provision to foreign third parties and, where the processing is subject to the GDPR, its international-transfer requirements as well. Reliance on adequacy for the original EU–Japan transfer does not establish that the conditions for an onward transfer are satisfied.

Build the response around actual data flows

The first practical step is to map the data flows for the relevant service. Identify the information collected, individuals’ locations, sources, purposes, storage locations, offices with access, contractors and subprocessors, and deletion timing. This should cover access by support personnel in other countries as well as the cloud storage region.

Next, determine the controller and processor roles for each processing activity and map the GDPR’s application, lawful basis, notices, contracts and transfer conditions to it. For a service incorporating generative AI, verify whether inputs are used only to provide the service or also for model training or other analysis. Actual secondary uses must be consistent with a DPA promise to process data only on instructions.

When reviewing contracts, compare commitments to customers with the terms available from cloud and other suppliers. A promise to notify a customer of an incident within 24 hours may be difficult to honour if the supplier takes longer to provide the information. Negotiate workable terms covering when the period begins, an initial report based on known facts, and subsequent updates.

The company should then consider, where relevant, whether it needs an EU representative, a data protection officer or records of processing activities. The businesses covered differ by obligation, so each requirement and exception should be assessed separately. Expansion into a new country, a change of subprocessor or the addition of an AI feature should prompt an update to the data map and contractual terms.

GDPR compliance cannot end with signing a contract sent by an overseas customer. I believe a sustainable approach starts with identifying what data the company handles, for whom and where, and aligning notices, contracts and security measures with those facts.