On November 10, 2016, after a review of public comments, the Personal Information Protection Commission released Guidelines Concerning Personal Information Protection Act (General Rules) (source document in Japanese). On the same date, the Commission also released a set of specific guidelines, including: (i) guidelines regarding the provision of personal data to a foreign third party; (ii) guidelines regarding verification and recording obligations related to the transfer of data to third parties; and (iii) guidelines regarding de-identified information (all source documents in Japanese). Companies are advised to review their internal handling of personal information and the relevant internal rules in light of these guidelines, which will provide practical guidance to measures that companies will need to take pursuant to the Act.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.