Every SaaS company selling into Japan eventually has the same conversation with a customer’s legal team: your SOC 2 report looks solid, but how are you handling APPI’s cross-border transfer requirements? If your compliance program was built around US and European buyers, this question can catch you off guard. A clean SOC 2 report does not touch it at all, and assuming it does is one of the more common and more expensive mistakes companies make when Japan becomes a real part of their pipeline.
Why SOC 2 and APPI solve different problems. A SOC 2 Type 2 report tells a customer that an independent CPA firm tested your controls over a real review period: access management, encryption, monitoring and incident response. It says nothing about the legal basis for moving personal data about a person in Japan outside the country. A Japanese legal team treats these as two separate questions. SOC 2 answers “can we trust your controls”, while APPI answers “do you have a lawful basis to move our users’ data to servers outside Japan”.
APPI applies even without an office in Japan. If you handle personal data of individuals located in Japan while providing goods or services to people or companies there, APPI applies to you wherever you are based. A US or Indian SaaS company selling entirely remotely is in scope the moment it processes data from users in Japan.
What counts as a cross-border transfer. Making data accessible to a foreign entity over a network counts as provision, not just physically handing it over. Even a Japanese subsidiary’s data being accessible to its foreign parent company can trigger the transfer rules. For SaaS companies, this usually means any customer data from Japanese users that is stored on or accessible from infrastructure or personnel outside Japan, including standard offshore cloud hosting.
Three paths to a lawful transfer.
First, destination whitelisting. If the receiving country is designated by Japan’s Personal Information Protection Commission as adequate, transfers can proceed without individual consent. The list is narrow, covering the EU and UK, so for most US and Indian companies this route is not available.
Second, individual consent with mandatory disclosure. Generic consent buried in a privacy policy is not enough. The business must name the destination country and explain how that country’s data protection regime differs from Japan’s. If the exact country cannot be specified, the business must explain why and give alternative information. Consent without this disclosure is treated as invalid.
Third, a system conforming to the standards. A business can transfer data without consent if a contractual or systemic arrangement ensures the foreign recipient handles data with measures equivalent to APPI’s. The catch is an ongoing duty: the business must check at least once a year that the equivalent protection is still in place, and must provide information about it to data subjects on request.
Why this trips up strong SOC 2 programs. Legal and privacy teams usually handle consent language while security teams manage the SOC 2 audit, and if the two do not meet, a company can pass its SOC 2 cycle every year while staying non-compliant with APPI. Typical gaps are consent that never named the destination country, or no one owning the annual monitoring cycle.
What to do. Map where Japanese user data actually goes, including your own foreign parent and affiliates. Choose a transfer mechanism deliberately. Put the annual monitoring on a calendar with an owner if you use the systemic route. Keep privacy notices specific to each destination country. And bring your SOC 2 auditor and privacy counsel together so a Japanese buyer gets one coherent answer.
Read the complete guide, including the FAQs:
https://accorppartners.com/blogs/soc-2/soc-2-isnt-enough-for-japan-what-appis-cross-border-transfer-rules-actually-require
Top comments (0)