Japan advocated "Data Free Flow with Trust (DFFT)" in 2019 and took the lead in promoting free data distribution. Japan takes active measures to build a digital society. For example, Japan revises the Personal Information Protection Law and makes continuous efforts to formulate relevant laws and regulations to ensure information security. Alibaba Cloud incorporates the privacy requirements into the development of all its services to protect the privacy of customers and end users. This way, safe, reliable, and state-of-the-art technologies are provided.

Security:

Japan issued the BAC in 2014, which marks that the nationwide cybersecurity measures have gone into full effect in Japan. The Cybersecurity Strategy Headquarters was established under the Cabinet and the National Center of Incident Readiness and Strategy for Cybersecurity (NISC) is coordinating the implementation of the cybersecurity strategy. NISC has issued the Common Standards on Information Security Measures of Government Entities (2018 edition), which is widely used as a guideline for government agencies to take measures to ensure information security. The 2021 edition is under formulation.

In addition, the government of Japan stipulated a Cloud-by-Default Principle for Government Information Systems in June 2018. As a result, the "Information System Security Management and Assessment Program"(ISMAP) was established and carried out in October 2020. ISMAP is a system for registering cloud service providers that meet the security requirements.
Key laws related to security:
The Basic Act on Cybersecurity

Privacy:

The Act on the Protection of Personal Information of Japan was first enacted in 2005 and then revised three times in 2015, 2017, and 2020.Japan enacted a law related to social security numbers or My Number, which is called "My Number Act". In addition, detailed guidelines are provided to process My Numbers. The processing requirements are particularly strict. The Ministry of Economy, Trade and Industry and the Ministry of Internal Affairs and Communications published a guidebook to promote privacy governance in 2020. The Ministry of Economy, Trade and Industry issued JIS X 9251:2021 in January 2021, which is a JIS translation of ISO 29134:2017. ISO 29134:2017 is used as the global standard for privacy impact assessment.

Supervision bureaus:
Personal Information Protection Commission (Scope of application of the Act on the Protection of Personal Information and the My Number Act)
　* The Ministry of Economy, Trade and Industry and the Ministry of Internal Affairs and Communications are formulating guidelines for the utilization of personal data outside of these frameworks.

Key laws related to privacy protection:
Act on the Protection of Personal Information, which is a law related to the protection of personal Information
My Number Act, which is a law related to the use of numbers to identify specific individuals in administrative procedures
Act on Regulation of Transmission of Specified Electronic Mail, which is a law related to the proper sending of specified emails

Guidelines related to privacy:
Guidelines related to the Act on the Protection of Personal Information
Guidelines related to the My Number Act
Guidebook on Corporate Governance for Privacy in Digital Transformation (DX) ver.1.0

Requirements for cross-border transfer of personal information:
The transfer of personal information to third parties in other countries is limited. Specifically, one of the following requirements must be met:
The Personal Information Protection Commission stipulates in Article 11(2) of the Enforcement Rules for the Act on the Protection of Personal Information that the person to whom the personal information is transferred must be certified based on the international framework for processing personal information. It also stipulates in Section 4-3 of the Guidelines on the Act on the Protection of Personal Information (Provision to Third Parties Located in Foreign Countries) that a third party to which data is transferred in a foreign country must be certified by the APEC CBPR system.

Alibaba Cloud acquired the CPBR certification in April 2021. Personal information can be transferred from Japan to Alibaba Cloud in a safe and secure manner.

Overview:

Similar to many other countries, Japan has formulated regulations dedicated to financial services. The FISC has formulated the Financial Institutions Security Guidelines and Manual as voluntary standards for financial institutions. The Financial Institutions Security Guidelines and Manual is also named the FISC Security Guidelines and Manual. Many financial institutions use the standards as the guidelines for system architecture and operation. The 9th edition of the Safety Guidelines and Manual is the latest edition, which was published in March 2020. In addition, the "Report of the Council of Experts on the Usage of Cloud Computing by Financial Institutions (Trial edition)" was published in May 2021.

Financial institutions have also formulated special regulations to protect personal information. The Personal Information Protection Commission has formulated and issued Financial Sector Guidelines and Practical Guidelines for Security Management Measures.

Alibaba Cloud provides the electronic Know Your Customer (eKYC) API service to verify digital identities.This service confirms to the requirements of Article 6 (1) (e) of the "Enforcement of the Act on Prevention of Transfer of Criminal Proceeds." In addition, Alibaba Cloud made a self-assessment based on the public comments on the "Order for Enforcement of the Act on Prevention of Transfer of Criminal Proceeds" in 2018 to guide customers through the implementation.


Supervision bureaus:
Financial Services Agency
Personal Information Protection Commission (Scope of application of the Act on the Protection of Personal Information and the My Number Act)