On October 5, after review of public comments, the Personal Information Protection Commission released (source document in Japanese) the Enforcement Regulation of Personal Information Protection Act. The enforcement regulation provides rules for creating and using de-identified information, obligations to verify and document transfer of personal data, and safeguards for extraterritorial data transfer.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.