Skip to content

Data PrivacyFrom privacy policies and cross-border transfers to the initial response to a data breach, our attorneys sort out each issue along the flow of your data.

Free consultation Why LegalAgent
Response time
1 business day*
First consultation
30 min free
Scope
Policies · Cookies · Entrustment · Cross-border transfer

* As a rule, for contract reviews and routine legal questions. For complex or urgent matters we propose a schedule that fits the matter.

Client companies served*

150+

Selected clients shown, in no particular order. * Clients and partners. Not limited to Data Privacy matters.

KADOKAWA FRONTEO YAMAP ACROVE LAPRAS AVA Intelligence OPTIEUM Biotechnologies ReDelta Concrew LINEA Innovations TECHSUITE YStory

Getting personal information handling right in both documents and operations

Rather than only revising the wording of your privacy policy, we check collection screens, storage locations, entrusted parties and external transmission destinations, and align your documents and internal operations with the flow of data from collection to deletion. Purposes of use, consent, entrustment, third-party provision, joint use and cross-border transfer each call for different responses, so we assess each situation separately.

  • Just before release, your policy does not match the actual data flow
  • You cannot tell whether using overseas SaaS counts as a cross-border transfer
  • A breach is suspected, and you need to decide quickly whether to report it
  • Personal information clauses vary in standard from contractor to contractor

Why LegalAgent

With LegalAgent, you can sort out personal information issues without holding up your release

We support your use of data in three ways: fast answers, fees you know before we start, and deliverables you can put straight into operation.

  1. 01Speed

    Typical law firms3–5 business days

    LegalAgent1 business day, as a rule

    Reviews worked back from your launch date

    We answer contract reviews and routine legal questions within one business day as a rule. If your launch date is set, we propose a review order worked back from that schedule.

  2. 02Fees

    Hourly billingTotal unknown at the start

    LegalAgentScope and fee set before we start

    Review scope and fee decided before we start

    We ask about the types of data you handle and the range of documents to be drafted or revised, and give you an estimate before we start. Matter-based work is generally on a fixed fee.

  3. 03Deliverables

    • Draft privacy policy
    • Data flow summary table
    • Revised entrustment contract clauses

    Ready to use in both documents and operations

    Down to comments on consent screens and internal summary memos, we deliver everything in a form you can use in actual operations.

* Response times are for contract reviews and routine legal questions; they vary by matter.

How it works

The AI Agent identifies the issues; attorneys decide what applies

The AI Agent extracts issues from the materials you provide and prepares drafts; attorneys decide whether something counts as entrustment, third-party provision or cross-border transfer.

AI Agentdoes the work

  • Maps the data collected and its destinations from policies, contracts and screen materials
  • Draws on past analyses and templates
  • Drafts revisions to policies and clauses

Attorneysmake the judgment

  • Decide whether entrustment, third-party provision, joint use or cross-border transfer applies
  • Decide whether a breach must be reported and individuals notified
  • Take responsibility for the final wording and operational points to note
ConsultationDraft wording and summary memo delivered
  1. STEP 01Confirming the consultation and the data flow

    Confirm the data flow from collection to deletion and the positions of the parties involved

    Memo summarizing matters to check and candidate response approaches

  2. STEP 02Sorting out the issues

    Analyze the specification of purposes of use, whether consent is required, and whether entrustment, third-party provision, joint use, external transmission or cross-border transfer applies

    Issue table and priorities

  3. STEP 03Drafting or revising documents and clauses

    Draft the privacy policy, consent wording, personal information clauses of entrustment contracts or internal rules

    Proposed revisions to documents and clauses

  4. STEP 04Internal review and rollout

    Adjust the drafts based on the review results and set out operational points to note

    Final drafts and memo on operational points to note

  • Attorneys make the final callAn attorney checks every deliverable and takes responsibility for it.
  • Your inputs are not used to train AIOn top of attorneys' statutory duty of confidentiality, we work in an environment where your inputs are not used to train AI.
  • An AI Agent built in-houseOur own engineers develop it. Information Security Policy

Use cases

Common requests and what you receive

For each situation that prompts a consultation, we summarize the consequences of leaving it unaddressed, what LegalAgent reviews and organizes, and the deliverables.

  1. 01

    You need to prepare a privacy policy ahead of releasing a new service

    If left aloneThe items collected and purposes of use stated do not match the actual data flow, and the inconsistency may be pointed out after publication

    What we doWe review the screen design, input forms, entrusted parties and external transmission destinations, organize the data flow from collection to deletion, and then determine how purposes of use should be specified and whether consent is required

    What you receive
    • Draft privacy policy
    • Comments on the consent screen
    • Data flow summary table

  2. 02

    You are introducing cookies, advertising IDs or analytics tools

    If left aloneMisjudging whether notice of external transmission or consent is required may lead to problems under your terms or in ad platform reviews

    What we doWe review the tags in use, the recipient businesses and the scope of information collected, and analyze the external transmission rules and whether third-party provision applies case by case

    What you receive
    • Draft explanatory wording on external transmission
    • Comments on consent and opt-out flows
    • Memo summarizing the review results

  3. 03

    You are handing part of your operations to an outside contractor or an overseas SaaS provider

    If left aloneSigning a contract without working out whether the arrangement is entrustment, third-party provision or joint use means operations begin without the necessary clauses or explanations

    What we doWe review the data flow and the relationship between the contracting parties, and set out the clauses the entrustment contract should contain and whether explanations or consent are needed for cross-border transfer

    What you receive
    • Proposed revisions to the personal information clauses of the entrustment contract
    • Draft explanatory wording on cross-border transfer
    • Internal summary memo

  4. 04

    A data breach is suspected based on system logs or inquiries from customers

    If left aloneDelays in deciding whether a report or notice to individuals is required may cause you to miss response deadlines or to take unnecessary steps

    What we doWe organize the facts known so far and check whether a reporting obligation applies, whether notice to individuals is required and what records should be secured in the initial response

    What you receive
    • Initial response memo
    • Draft internal report
    • Draft notice to individuals (if needed)

Scope of our data privacy support

We provide support organized by theme, from preparing privacy policies to obtaining consent, entrustment, third-party provision and joint use, cross-border transfer and the initial response to data breaches.

Privacy policies and obtaining consent
We check the statements of items collected and purposes of use against the actual screen design and how consent is obtained in practice.
  • Drafting and revising privacy policies
  • Reviewing consent flows
Cookies, advertising IDs and external transmission
Based on the destinations and information collected by analytics, ad delivery and external integration tools, we determine whether notice wording or consent is required.
  • Identifying external transmissions and preparing notice wording
Entrustment, third-party provision and joint use
We review the flow of personal data and the relationship between the contracting parties, and determine whether the arrangement is entrustment, third-party provision or joint use.
  • Personal information clauses in entrustment contracts
  • Determining whether third-party provision or joint use applies
Cross-border transfer
We confirm where data is stored and the country of the recipient, and set out the explanations or contractual measures needed for cross-border transfer.
  • Reviewing the use of overseas businesses and overseas servers
Initial legal response to breaches and internal rules
We develop internal rules for normal times and the initial response for when a breach occurs as a single whole.
  • Initial response when a data breach occurs
  • Developing internal rules and records

Our approach

What we focus on in Data Privacy

We consider data privacy and data protection to be an area where tidying up the form of documents is not enough.

  1. 01

    Checking the data flow before the wording

    Rather than starting by revising the wording of the privacy policy, we review the collection screens, storage locations, entrusted parties and external transmission destinations, understand how data flows from collection to deletion, and then organize the documents and clauses needed.

  2. 02

    Distinguishing purposes of collection, consent, entrustment, third-party provision, joint use, external transmission and cross-border transfer

    These are concepts that require different legal analysis. Even in the same situation, the applicable category changes with the parties' positions and the contract structure, so we check each one individually before deciding how to respond.

  3. 03

    Designing rules for normal times and the initial breach response together

    We review internal rules and management of entrusted parties against the standard of whether they will work when an incident actually occurs. We also consider the allocation of roles and reporting lines for the initial response together with the preparations for normal times.

  4. 04

    Checking that documents are reflected in operations

    Beyond putting privacy policies and contract clauses in order, we check that they take a form used in actual operations, such as consent screens, lists of entrusted parties and internal rules.

Pricing

Data privacy fees

The work required for data privacy and data protection consultations varies with the scope of review, so we provide a quote after hearing the details.

How fees are set

Scope and fee agreed before we start

Matter-based work is generally on a fixed fee. For complex or urgent matters, we propose a schedule and an estimate that fit the matter.

First consultation

A free 30-minute online meeting.

You can come to us before your documents are in order. Tell us what you know so far.

Free consultation

What we check before quoting

  • Types and scope of data handled
  • Number of services and systems to be reviewed
  • Scope of documents to be drafted or revised (privacy policy, internal rules, contract clauses, etc.)
  • Number of entrusted parties and recipients
  • Whether an urgent response is needed

The items shown are factors considered in preparing a quote and do not guarantee any amount. We will provide a formal quote after reviewing your individual circumstances.

Team & Record

Attorneys who know business practice handle your matters

Contract reviews and drafts
2,000+
Client companies
150+
Startup legal matters
200+
Legal and investment DD
20+

* Approximate figures based on matters handled by our firm; actual figures vary by matter.

Engineers

Shinya Makita and Sota Miya build our product on the same team as the attorneys.

Practical Guides to Data Privacy and Data Use

Personal information clausesWhat Is a Personal Information Handling Clause? Points to Check in Outsourcing and SaaS Agreements

Not every use of SaaS or AI constitutes entrustment under the law. You need to check the actual data flow and how the provider handles the data, and reflect in the clause the relationship with the DPA, provision to foreign countries and the allocation of roles in the event of a leak.

Related practice areas

FAQ

Frequently asked questions

Can we engage you only to review our existing privacy policy?

Yes. However, rather than looking only at the text, we answer after checking consistency with the information you actually collect and the external tools you use. If you do not have materials on your data flow, we will organize it as we review.

Can we consult you without materials summarizing our data flow?

Yes. While hearing about your service screens, input forms and the tools you use, we will work with you to organize the flow from collection to deletion.

Can we consult you if a data breach has occurred or is suspected?

Yes. However, whether a reporting obligation applies or notice to individuals is required must be decided after checking the facts individually, so we will ask for the information you have.

Can we consult you only about cookies or external transmission?

Yes. We review the tags you have introduced and the range of destinations, and determine whether notice wording or consent is required.

Does this page handle personal information questions relating to generative AI services?

The handling of input data that includes personal information is covered on this page. For consultations on the overall legal design of AI services, such as their terms of use and copyright, please see the AI Legal Consulting page.

Can you give a general answer on whether something is a cross-border transfer?

Whether a cross-border transfer applies depends on the recipient's country, the contract terms and the data flow, so we avoid answering in general terms only. We will answer after reviewing your individual circumstances.

Can you handle both one-off consultations and ongoing engagements?

Yes, we handle both. You can consult us as you prefer, from a one-off privacy policy review to ongoing reviews as your business changes.

Contact

Talk to us about handling personal information

Please tell us about your service and how you handle data, to the extent currently known. After reviewing the details, we will suggest how to proceed.

  • A free 30-minute online first meeting
  • You can consult us without materials mapping your data flow
  • You can consult us on the first response to a suspected breach