It has long been a source of intrigue that the transfer of personal data to some ‘third countries’ such as Japan has not yet been deemed adequate by the EU. Article 45 of the General Data Protection Regulation ((EU) 2016/679) permits transfers of personal data to a third country or an international organisation where the European Commission decides there is an adequate level of protection.

However, on 23 January 2019, the European Commission adopted its adequacy decision finding that data protection standards in the EU and Japan are equivalent. In parallel, Japan adopted an equivalent decision, thereby creating the world’s largest area for safe personal data flows.

The EU has unilateral adequacy decisions with several other countries but this is the first time that the EU and a third country have agreed on a reciprocal recognition of the adequate level of protection.

Before the Commission adopted its adequacy decision, Japan put in place additional safeguards to ensure that personal data transferred from the EU will be protected in line with European Standards. These include:

For all businesses that trade with Japan, this decision will be a welcome step.

For more information about the safe transfer of personal data outside of the EEA or any other data protection queries, please contact me or any member of the data protection team on 023 8048 2482.