DGKV Data Protection Team notes that on 4 April 2023, the first review of the Japan-EU mutual adequacy arrangement in data protection was completed successfully demonstrating increased convergence between the EU’s and Japan's data protection frameworks. Japan was the first Asian country whitelisted for data protection adequacy pursuant to the GDPR. Originally, the European Commission adopted its adequacy decision on Japan in January 2019 thus allowing personal data to flow freely between the business and other organizations in the EU and Japan.

The confirmed adequate level of personal data protection in Japan is important for businesses and other organizations as cross-border transfers of personal data from the EU to Japan does not require any specific authorization and can be done freely, subject always to the general principles and other applicable rules of the GDPR.

It is also worth noticing that recent reforms of the Japanese data protection framework have extended its safeguards to new areas, such as the academia and the public sector. On that basis, the EU has agreed to explore the possibility of expanding the scope of its adequacy decision for Japan, which is expected to further boost research and regulatory cooperation.