APPI Article 28(1): provision to a third party in a foreign country needs consent unless an exception applies (Act on the Protection of Personal Information, Art. 28(1))
Before sending personal data to a company abroad, a Japanese holder needs the person's consent to the foreign provision. The consent is not needed if the country is one the PPC has listed as equivalent, or if the recipient has a system conforming to the PPC's standards (a contract or a recognised certification). The Art. 28 consent takes the place of the Art. 27 consent. The US is not named on the PPC's list (see the guideline entry).
Dated 18 Oct 2026Source checked 18 Oct 2026Basis: primary text
In the source's own words
“Except cases set forth in the items of paragraph (1) of the preceding Article, before businesses handling personal information provide personal data to a third party ... the businesses must obtain an identifiable person's consent to the effect that the person approves the provision to a third party in a foreign country. In this case, the provisions of the preceding Article do not apply.”
Where it was read
Also read from the same source
Figures it counts in
It is shown on its own, not counted into a figure.
Cited in this guide