Before HQ Gets Japan Employee Data: APPI Transfer Rules

If headquarters wants the Japan team's employee records in a global HR system, the legal question comes before the migration plan. Under Japan's Act on the Protection of Personal Information (APPI), sending employee data from a Japanese subsidiary to its overseas parent is a transfer to a third party in a foreign country. It has its own rules, and they decide the order of the whole rollout.

Is the overseas parent really a "third party"?

Yes. The Personal Information Protection Commission (PPC), Japan's privacy regulator, says in its guidelines on transfers to foreign third parties that for companies, the test is whether the recipient is a separate legal entity. Your Japanese KK and your parent are separate entities. The parent is a foreign third party. A branch of the same legal entity abroad would not be.

Most headquarters think of employee data as company data, full stop. Japanese law sees it differently. The data belongs to the Japanese entity. Handing it to the parent is a transfer.

Cloud hosting is a separate question. The PPC's Q&A (Q7-53, Q12-3, Q12-4) says that if the cloud provider is contractually not handling the personal data you store, storing it there is not a transfer. But if HR people at the parent can open and edit Japanese employees' records, the parent is handling the data. Putting the servers in Tokyo doesn't change that.

Which legal basis should you pick?

Article 28 of the APPI gives you a short menu, and you should choose before anything moves.

Option one is the employee's consent. Since April 1, 2022, before asking for consent you must tell the person which country the data goes to, what that country's privacy regime looks like, and what protective measures the recipient takes. A single line saying "I consent to sharing with group companies" no longer does the job.

Option two is what the law calls a conforming system at the recipient. In plain terms, a contract or group-wide internal rules that commit the parent to measures equivalent to Japanese law. The PPC's Q12-6 accepts a combination of an outsourcing contract and internal rules. This route has running costs. The Japanese entity has to check periodically that the parent is complying, which the guidelines describe as roughly once a year or more. If an employee asks, you have to explain the arrangement and how you check it. If the parent stops complying, you stop sending.

Option three is a recipient in a country Japan has recognized as equivalent. Today that list is the EU and the UK. If your parent sits in the United States, China or Singapore, this option doesn't exist for you.

My own preference, for employee data, is option two. Consent collected inside an employment relationship is weaker than it looks. If a new hire can't finish onboarding without signing, someone will eventually ask whether that signature reflects free choice. The PPC's Q1-60 already says silence over a period cannot be treated as consent across the board. The conforming-system route means annual checks, but it doesn't rest on a few hundred individual signatures.

Pick the legal basis first and move the data last; reverse the order and every later step becomes rework

Basis: APPI Article 28; PPC guidelines on transfers to foreign third parties and PPC Q&A; Ministry of Health, Labour and Welfare guide on rules for workers' health information (March 2019). Sequence arranged by the author

1. 1Inventory the fieldsWhat goes, who uses it, why. Separate special-care data such as health check results
2. 2Choose the legal basisConsent, or a conforming system (contract plus group rules). Outside the EU and UK, these are the only two
3. 3Tell employeesPublish the purpose of use. For consent, first give country, its regime and the recipient's measures
4. 4Sign and set rulesIntra-group data agreement; who can see which fields
5. 5Move the minimumOnly fields with a confirmed use from step 1. Health data stays out of the global system
6. 6Check every yearConfirm the parent complies, keep records, be ready to answer employees

Step 2 decides how every later document is written, so settle it before go-live.

The step everyone skips

The field inventory. The migration template from headquarters usually has dozens of columns, and the Japan team fills them all in. The point of the inventory is to delete. Family details, bank accounts, health check results: does the parent actually use them? Send what is used.

Check the stated purpose of use too. If the Japanese work rules say employee data is used "for the company's personnel management," a global talent review run by the parent may fall outside it. A change within a range reasonably related to the original purpose can be made by notifying employees. Beyond that, you need fresh consent.

Keep health data in Japan

Health check results are special-care personal information under the PPC's general guidelines, which explicitly include checkups under the Industrial Safety and Health Act. Collecting them generally requires consent, with exceptions such as checks required by law, and they cannot be passed to third parties on an opt-out basis.

The labor ministry's March 2019 guide goes further. Employers set rules on the purpose, method and access rights for health information through labor-management consultation and tell employees. When health staff pass information to anyone else, they should process it down to what is needed to protect the worker. People with direct authority over personnel decisions must not handle stress check results without the employee's consent.

In my view, putting all that in a system where an HR business partner at headquarters can open it with one click won't fly in Japan. I'd keep health data in Japan under Japanese rules. The global system can carry, at most, a yes or no on whether work accommodations are needed.

The more you can see, the more you should explain first

After the HR system come attendance tools, PC activity logs and remote work monitoring. The PPC's Q5-7 lists points for monitoring employees: define the purpose in advance, write it into internal rules and show it to employees; appoint someone responsible and set their authority; set the rules beforehand and make sure operators follow them. It adds that employees should ideally be informed and understand.

Whether more monitoring actually raises performance is a separate question, and the research I reviewed in Does Monitoring Raise Performance? Data on 23,461 People is not encouraging. What to think through before headquarters watches the Japan team remotely is in Before HQ monitors the Japan team through software.

Japanese employees rarely object out loud. Nobody pushes back in the meeting. Trust just drains, quietly. What they watch is whether the company explained first: what is collected, who gets it, what it's for. Companies that say this before go-live seem to have an easier time with every system change after it.

Which route costs less in practice depends on size. A Japanese entity of a few dozen people sending data to one parent HR system may be fine with well-informed consent. A group with thousands of employees across several countries will probably find the conforming-system route steadier. That's a call worth making with a Japanese lawyer in the room.

---