What Is a Personal Information Handling Clause? Points to Check in Outsourcing and SaaS Agreements
Hello, I'm Noriaki Asato, Representative Attorney at LegalAgent.
"Party B shall comply with the Act on the Protection of Personal Information." I sometimes see contracts in which the personal information clause ends with just this one sentence. Complying with the law is a matter of course even if the contract does not say so. A personal information handling clause specifies what each party will do in that particular transaction. It identifies, in line with the realities of the transaction, who handles which personal information, for what purpose and to what extent, and how the parties will act in the event of subcontracting or an incident.
In today's corporate activities, such as introducing SaaS, outsourcing work and running marketing campaigns, the handling of personal information and personal data occurs every day. Even the use of SaaS can constitute entrustment under the law, depending on how the data is handled. Rather than jumping to conclusions from the service name or the title of the contract, check the actual use.
Understanding the Realities of the Transaction and the Data Flow
A personal information handling clause is a clause that, where personal information or personal data is handled in connection with a contract, sets out how it is handled, the obligation to take security control measures, the response in the event of a leak and so on. In business-to-business transactions, it appears in a wide range of situations, such as recruitment support and staffing placement, outsourcing payroll calculation and labor management, registering customer information in SaaS, entering data into AI services, and sharing materials in M&A and legal due diligence.
As a premise for refining the wording of the clause, it is essential to understand the actual flow of data. If the facts of which data is handled, by whom, in which system, and where and for how long it is stored remain vague, a gap with reality will remain even if only the wording of the clause is revised. Putting the data flow into a diagram or table makes it easier to identify storage locations and sharing destinations that need to be checked. Based on the facts confirmed, determine whether the handling constitutes entrustment within the scope necessary to achieve the purpose of use (the exception to consent for domestic third-party provision under Article 27(5)(i) of the Act on the Protection of Personal Information), third-party provision requiring consent, joint use, or something else. Third-party provision also has statutory exceptions where consent is not required, so check the conditions of application.
Checking the types of data handled and your own company's position is another essential perspective. Personal information is not limited to names and email addresses; its content varies greatly by service, including purchase histories, job applicant information and health information. Where special care-required personal information is included, also check additional statutory requirements that apply, such as consent at the time of acquisition. At the same time, determine whether your company is the entrusting party or the entrusted party, a joint user, or the recipient of third-party provision. Where the emphasis lies in checking the purpose of use and the acquisition route changes depending on this position. Rather than confining yourself to superficial revisions of wording, if you work out which types of data are handled under which structure before considering the clause, you can avoid a formal exchange of templates that do not fit reality.
Designing Supervision Obligations and Subcontracting in Outsourcing Agreements
Where the handling of personal data is entrusted, the entrusting party is legally required to exercise necessary and appropriate supervision over the entrusted party (Article 25 of the same Act). The contract specifies concretely the measures necessary for supervision and what the entrusted party will carry out.
The clause sets out the scope of the entrusted work and the security control measures, as well as the conditions for accepting audits and the method of return or deletion after termination of the contract. The entrusting party checks how far it should impose obligations on the entrusted party in order to fulfill its own supervisory responsibility, and the entrusted party determines whether those obligations can realistically be met with its own management system. If an entrusted party formally accepts obligations it cannot perform, it may be unable to comply from the moment the obligations begin. Also check the start date and the preparations required.
Subcontracting is an issue on which practical coordination tends to be particularly difficult. In SaaS use and BPO work, cloud providers, external tools and overseas locations are commonly involved. Whether to prohibit subcontracting outright, adopt a prior consent system, or limit it to a notification system is chosen according to the realities of the business. Prescribing an outright prohibition for work in which the use of cloud services is unavoidable cannot be complied with in reality and becomes a dead letter as a standard for supervision. Even where a consent system is adopted, decide whether subcontractors are approved individually or by blanket approval using categories or a list, and how notice will be given when the list is updated. For services involving many providers, a combination of blanket approval and notice of list updates is often a realistic compromise.
Scope of Use in SaaS and AI Services and Consistency with the Terms
When using SaaS or AI services, personal information handling provisions are typically spread across the terms of use, the privacy policy, the data processing agreement (DPA) and other documents. What users want to determine carefully is how far the provider may make secondary use of input data and usage logs.
Designs in which data is used for purposes such as service improvement, AI model training and support are not unusual. However, if the purposes of use are excessively broad, it becomes difficult for the user to accept. Confirm the purposes for which input data is used and whether it may be used for model training, and also check how logs and metadata are handled. After understanding the retention period and storage location and the involvement of foreign servers and subprocessors, check the procedures for deletion and export after cancellation. Note that even if the terms state "statistical processing" or "anonymization," this does not necessarily mean the data qualifies as anonymously processed information under the law. Confirming how much processing is applied and whether the possibility of re-identification is excluded, and, where necessary, keeping a record of the questions put to the vendor, will help with internal explanations and responses to data subjects later.
Also, not every use of SaaS or AI services constitutes "entrustment" under the law. Where the contract provides that the provider does not handle the data and appropriate access controls are in place, there can be structures that do not constitute third-party provision or entrustment subject to supervision under Article 25. Note, however, that even in that case, the security control measures your company must take (Article 23) are not waived. As for the use of foreign servers, rather than judging only by the physical location of the server, check individually the requirements of Article 28 for provision or entrustment to a third party in a foreign country (the data subject's consent, a system meeting the standards and continuing measures, whether the country has been designated as having an equivalent level, whether a statutory exception applies, and so on).
In AI services, personal data may be included in prompts and attached files. For each specific situation, such as contract review, customer support and recruitment, check whether personal data may be mixed in, whether training use and external provision are restricted, and whether there is any inconsistency with the explanation given to data subjects in your company's privacy policy. Be aware that not only names and contact details but also consultation records, career histories and inquiry histories can be information about individuals, and compare this with internal operations.
Initial Response Procedures in the Event of a Leak and Operating an Internal Register
An abstract provision such as "in the event of a leak or other incident, the party shall promptly report it" alone makes it difficult to act quickly in an emergency. If it has not been decided in advance who reports what by when, the scope of cooperation in investigating the cause, and the division of responsibility for notifying data subjects and reporting to the Personal Information Protection Commission and other authorities, precious time right after discovery will be spent coordinating roles.
The clause defines leaks and similar incidents and sets the deadline and content of the initial report. In addition to cooperation in investigating the cause and measures to prevent the damage from spreading, it also specifies who will notify data subjects and report to the authorities. Confirm the allocation of costs and the cap on damages, and set out the procedure through to reporting on measures to prevent recurrence. Reports to the authorities and notices to data subjects under Article 26 are required in situations prescribed by law and where there is a risk of such situations occurring, among others. The contractual notice obligation can be set to cover a broader range than what is subject to statutory reporting. On the other hand, legal obligations cannot be unilaterally waived or transferred to the other party by contract, so legal compliance and the contractual division of roles should be considered separately. Also check, in line with the statutory conditions, matters such as the exception to the statutory reporting obligation where the entrusted party has given the prescribed notice to the entrusting party. From the entrusted party's position, one option is to set the reporting deadline as a realistic time from becoming aware of the event and to limit the scope so that even minor incidents are not subject to unlimited immediate reporting. However, the scope should not be set in a way that prevents necessary initial contact or statutory responses.
At the same time, check consistency with the DPA and the privacy policy. Where there is an English-language DPA, do not overlook the order of precedence in the event of a conflict with the main body of the contract, the security standards, the audit procedures and so on. Also check that there is no discrepancy between the purposes of use published to data subjects in your company's privacy policy and what is permitted under the outsourcing agreement. The law does not require that every entrusted party be individually published or that consent be obtained for each, but the basic approach is to ensure there is no gap between what is explained to data subjects and the contract and actual operations.
After the contract is concluded, the work moves on to ongoing operational management using an internal register. As the number of entrusted parties grows, keeping track of the actual situation tends to become a formality, so list and manage the following items in a register.
- Name of the entrusted party and the content of the work
- Types of personal data handled
- Whether there is a contract and a DPA
- Status of subcontractors
- Where the data is stored
- Method of deletion or return upon termination of the contract
- Contact point in the event of a leak
- Status of periodic checks
Also record AI tools in the register. Recording for each service the input data and whether it is used for training, and making the retention period and legal characterization available for confirmation, allows the register to be referred to at contract renewal and in emergencies. By deciding in advance on the triggers for review, such as when a new contract is concluded, when a contract is renewed, when specifications change and when the organization changes, you can check whether outdated information remains.
Support Services for Personal Data Clauses
For reviews of personal information handling clauses and checks of DPAs, please see the following pages for details of our services.
Services connected to this topic