Pursuant to the provisions of Article 45 of Regulation (EU) 2016/679 of the European Parliament and Council, “a transfer of personal data to a third country or an international organisation may take place where the Commission has decided that the third country, a territory or one or more specified sectors within that third country, or the international organisation in question ensures an adequate level of protection.”

Based on the provisions mentioned above, the European Commission adopted on the 23rd of January 2019 the Implementing Decision pursuant to Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and the free movement of such data, hereafter GDPR, on the adequate protection of personal data by Japan under the Act on the Protection of Personal Information.

On this occasion, we bring to your attention that this is the first decision adopted by the European Commission since the date of application of Regulation (EU) no. 2016/679, which recognised the adequate protection of personal data by a third country.

This decision published on the Authority’s website can be consulted here.