2019/04/07

CBPR Certification Standards

This rule is based on APEC Cross-Border Privacy Rules System Policies, Rules and Guidelines
Personal information means any information about an identified or identifiable individual.

No

Title

Revised

1.1

Compliancewith APEC
Information
Privacy
Principles

The applicant business entity shall implement measures and practices consistently with the APEC Privacy Principles for all personal
information that the applicant business entity has collected or received that is subject to cross-border transfer to other participating APEC
economies.(hereafter Personal Information)

Identification of
personal
information

The applicant business entity shall establish and maintain a procedure for identifying the personal information and information gathering
methods.

Identification of
the purpose ofuse

The applicant business entity, when acquiring personal information, shall identify the purpose of use insofar as is possible, and use personal
information within the scope of such purpose. The following conditions related to the identification of the purpose of use shall be fulfilled.

1.2

1.3

The measures and practices shall include the following:・Privacy policies and statements
・Internal regulations
・Contracts
・Compliance with applicable industry or sector laws and regulations
・Compliance with self- regulatory applicant code and/or rules

1.
2.
3.
4.
5.
6.

1.
2.
3.

1.4

Laws,
guidelines, andother codes
stipulated by
the state

1.

3.
4.

Recognition,
analysis of risk,
and related
measuresInternal
regulations

1.

Emergency
responses

Procedures for identifying and assessing personal information protection risks and taking necessary measures against the risks are
established and maintained
Risks of personal information is identified and assessed, and necessary measures are taken against the risks
Measures to be taken against identified risks are approved by the representative of the entity.
Aforementioned measures are reflected in the regulations of the entity.
Procedures for periodic review and occasional review in accordance with needs are established clearly; and the review of risks is
conducted in accordance with the procedures.

The applicant business entity shall have detailed regulations which cover items 1. to 15. below. These regulations shall be determined inaccordance with its formal internal procedures, and they shall be available for reference to all employees.
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
11.
12.
13.
14.
15.

1.7

Procedure for identifying, referring to, and maintaining laws, guidelines, and other codes stipulated by the government of Japan related
to the handling of personal information is established.
Laws, guidelines, and other codes that need to be referenced are identified in accordance with the aforementioned procedure and updated
as necessary with approval of a manager in charge.
Identified laws, guidelines, and other codes that need to be referenced are appropriate.
Identified laws, guidelines, and other codes that need to be referenced are made available for reference as necessary and such references
are required to include appropriate procedures to handle inquiries, requests, etc. from abroad.

The applicant business entity shall establish and maintain procedures for identifying and assessing risks in personal information protection
and taking necessary measures for reducing and eliminating the risks.

2.
3.
4.
5.

1.6

Upon acquisition of personal information, the purpose of use thereof is identified to the greatest possible extent, and personal information
is used within the scope necessary for the achievement of the purpose, in accordance with the regulation of the entity; and the business ofthe entity is conducted accordingly.
Procedure for identifying the purpose of use is established, and approval is obtained from a manager in charge when identifying the
purpose of use.
Employees of the entity that handles personal information recognize clearly the purpose of use.

The applicant business entity shall establish a procedure and management system for identifying and referring to laws, guidelines, and othercodes stipulated by the government of Japan regarding the handling of personal information including responding to judicial or othergovernment subpoenas, warrants and orders. The procedure and management system shall fulfill the following conditions

2.

1.5

Procedure for identifying every piece of personal information is provided clearly.
Personal information is identified in accordance with the aforementioned procedure, and approval is obtained from a manager in charge.
The methods to acquire personal information in provided clearly.
Records, etc. for identifying personal information is maintained.
Procedure for updating and periodic review of the records, etc. of personal information identification is provided clearly.
Updating and periodic review of the records, etc. of personal information identification are conducted in accordance with theaforementioned procedure.

Procedure for identifying personal information
Procedure for identification, reference, and maintenance of laws, guidelines, and other codes stipulated by the government of Japan.
Procedure for recognizing and analyzing risks related to personal information and taking relevant measures
Authority and responsibility to protect personal information in each section and at each level of the entity
Preparation for states of emergency and responses thereto (when leakage, loss, or damage of personal information occurs)
Acquisition, use, and provision of personal information
Appropriate management of personal information
Response to a request for disclosure and other matters from individual
Education of staff members
Management of documents of the personal information protection management system
Responses to complaints and consultations
Internal inspection
Corrective action and preventative action
Review by the representative
Punitive provisions for violation of the internal regulations

The applicant business entity shall establish, implement, and maintain a procedure for identifying states of emergency and responding
thereto. Such procedure shall be established to minimize the effects in consideration of the possibility of economic disadvantages and loss ofsocial credibility, effects on the individual, etc., supposed in case of leakage, loss, or damage of personal information. The procedure shallfulfill the following conditions.
1.
2.
3.
4.

Procedure for identifying states of emergency and responding thereto is established; and the procedure is implemented.
Procedure for minimizing the effects in consideration of the possibility of economic disadvantages and loss of social credibility, effects on
the individual, etc., supposed in case of leakage, loss, or damage of personal information, is established; and measures in accordance withthe procedure are implemented.
Procedure for ensuring that the individual is promptly informed of the content of the personal information leaked, lost, or damaged, or
ensuring that the individual is easily accessible to be informed of the content thereof, is established and measures in accordance with theprocedure are implemented.
Procedure for publicly announcing facts, causes, and counter measures insofar as is possible without delay from the perspective ofprevention of secondary damage and avoidance of the occurrence of similar events is established, and measures in accordance with theprocedure are implemented.

1

2019/04/07
5.

2.1

Privacy policy

The privacy policy of the applicant business entity shall satisfy the following conditions.
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
11.

12.
13.
14.
15.

3.1

Appropriateacquisition of
personal
information

Measures foracquiring
personal
information with
documentation
directly from theindividual

1.

1.
2.

4.
Measures foracquiring
personal
information bymethods otherthan directacquisition with
documentation

1.
2.

4.
5.
Appropriateacquisition of
special carerequired personal
information

In cases of direct acquisition of new types of personal information with documentation from an individual, procedure for approval of suchdirect acquisition; and the approval is obtained from a manager in charge in accordance with the procedure.
Procedure for each acquisition method in which the individual is informed of the matters in a) to h) below with documentation andconsent is obtained; and the business is conducted accordingly.
a) Name or nomenclature of the business entityb) Name or title, section, and contact information of the personal information protection manager (or his/her alternate)c) Purpose of use of personal informationd) Matters when it is planned to provide personal information to a third party- Purpose for provision to the third party- Items of personal information to be provided- Means or method for provision- Recipient of the information, or type and attributes of organization of the recipient- When there is an agreement regarding the handling of personal information, the effect thereofe) When entrustment of personal information handling is planned, the effect thereoff) In cases of notice of the purpose of use, disclosure, correction, addition, or deletion of personal information, or the right to refuse useor provision, the effect of response to the request and the person to contact for such inquiriesg) Voluntary nature of the individual’s provision of personal information and, when the individual does not provide personal
information, consequences to such personh) When personal information is acquired by means that the individual cannot easily recognize, the effect thereof
Cases in which consent of the individual is not required are limited only to any of 3. a) to 3. d) of “3.1b Measures for acquiring personal
information by methods other than direct acquisition with documentation” or any of 4. a) to 4. d) of “4.1 Measures concerning use”.
Procedure for approval of the cases stipulated in 3. above, and the business is conducted accordingly with approval of a manager incharge.

The applicant business entity, when acquiring personal information by methods other than direct acquisition with documentation, shallinform the individual of the purpose of use promptly, or publicly announce it unless the purpose of use is publicly announced beforehand. The
following conditions related to such acquisition of personal information shall be fulfilled.

3.

3.1c

Acquisition of personal information is carried out in a fair and lawful manner in accordance with the regulation of the entity; and thebusiness of the entity is conducted accordingly.
In the case of acquiring personal information from any person other than the individual, including in cases of entrustment, the entity
confirms, in accordance with the regulation of the entity, that the provider or the party entrusting the personal information (hereinafter
the “Entruster”) handles personal information in an appropriate manner; and the business of the entity is conducted accordingly toconfirm that personal information is handled by the provider or Entruster in accordance with the procedure.

The applicant business entity, when acquiring personal information with documentation directly from a person, shall describe clearly thematters described below in writing beforehand and acquire consent of the individual.

3.

3.1b

The privacy policy defines the concept of personal information protection of the entity, and the content thereof is appropriate.
The privacy policy is available to the employees and the general public. The privacy should be indicated on the website of the applicant
business entity.
The privacy policy includes provisions that are in accordance with the APEC Privacy Framework.
The privacy policy applies to all personal information, regardless of whether the information has been acquired online or offline.
The privacy policy indicates the date of enactment, and the date of enactment (including the date of the latest revision) is indicated in
the personal information protection policy published on its website
The published personal information protection policy is identical to that described in the regulations of the entity.
The privacy policy indicates the strict abidance by laws, guidelines and other codes stipulated by the state regarding the handling of
personal information, and the content thereof is appropriate.
It indicates the name of the relevant representative, and the content thereof is appropriate.
Contact information for inquiries about personal information protection is indicated
It indicates matters related to the appropriate acquisition, use, and provision of personal information considering the content and thebusiness size (including matters related to not handling personal information beyond the scope necessary to achieve the intended
purpose of use; hereafter referred to as “use other than for intended purposes”), and the content thereof is appropriate.
The privacy policy includes the following items- The types of personal information acquired- Whether the personal information is acquired directly or through a third party or agent- The purpose of use
The privacy policy provides information regarding whether and how an individual can access and correct their personal information
It indicates how to respond to complaints and consultations, and the content thereof is appropriate.
It indicates how to prevent leakage, loss, and damage of personal information and correction of the same, and the content thereof isappropriate.
It indicates matters related to the continual improvement of a personal information protection management system of the entity, and thecontent thereof is appropriate.

The applicant business entity shall acquire personal information by fair and lawful means. The following conditions related to the acquisitionof personal information shall be fulfilled.

2.

3.1a

Procedure for promptly reporting on facts, causes, and counter measures to related organizations (organizations that have an interest inreceiving such reports) in case of emergency is established.

In cases of acquisition of new types of personal information through methods other than direct acquisition with documentation, procedure
for approval of such acquisition is established, and the approval is obtained from a manager in charge in accordance with the procedure.
In cases of acquisition of personal information through methods other than direct acquisition with documentation, procedure for publicly
announcing the purpose of use beforehand, or procedure for informing the individual of the purpose of use or publicly announcing it
immediately after acquisition are established., and the business is conducted accordingly in these cases.
Always notify the individual or make an announcement except in the cases prescribed in a) to d) below; and the business is conductedaccordingly.
a) Cases in which informing the individual of the purpose of use or publicly announcing it may harm the life, body, property, or otherrights or interests of the individual or a third party.
b) Cases in which informing the individual of the purpose of use or publicly announcing it may harm the rights or legitimate interests ofthe entity.
c) Cases in which the entity cooperates with a governmental institution or a local public body when executing activities prescribed bylaw and in which informing the individual of the purpose of use or publicly announcing it may disturb the execution of suchactivities.
d) Cases in which it is regarded that the purpose of use is clear in view of the circumstances of the acquisition.
In cases of application of any of a) to d) above, procedure for approving such application is established, and the business is conductedaccordingly.
Application of the cases d) above is restricted in accordance with the regulation of the entity; and the business is conducted accordingly.

In the acquisition of special care-required personal information, the applicant business entity must obtain the written consent of the relevant
individual.
However, the applicant business entity will not need the written consent in the following cases.
a) Cases based on laws and regulationsb) Cases in which there is a need to protect a human life, body or fortune, and when it is difficult to obtain a principal's consentc) Cases in which there is a special need to enhance public hygiene or promote fostering healthy children, and when it is difficult toobtain a principal's consent

22019/04/07
d)
e)

4.1

Measuresconcerning use

The applicant business entity shall use the personal information within the scope necessary for the achievement of the identified purpose ofuse. When using personal information beyond the scope necessary for the achievement of the identified purpose of use, the entity shall informthe person of matters equivalent to or more satisfactory than those provided upon direct acquisition of personal information with
documentation from the individual in content, and obtain consent of the person. The following conditions related to the measures concerninguse shall be fulfilled.
1.
2.
3.
4.

5.
6.

4.1a

Procedure foraccessing an
individual

3.
4.

5.
6.
Measuresconcerning
provision of
personal
information

1.

3.

4.
Option for theindividual

Procedure for approving access to the person is established, and the business is conducted accordingly.
Procedures for informing the individual of the matters stipulated in 2. a) to 2. f) of “3.1b Measures for acquiring personal information
with documentation directly from the individual” or matters equivalent to or more satisfactory than such matters in content and theacquisition method and for obtaining consent of such person are established, and the business is conducted accordingly.
Document for informing the individual satisfies the conditions of the matters stipulated in 2. a) to 2. f) of “3.1b Measures for acquiring
personal information with documentation directly from the individual” or matters equivalent to or more satisfactory than such matters incontent and the acquisition method.
Always require the consent of the person except in the cases in a) to e) below, and the business is conducted accordingly.
a) When all or part of the handling of personal information is entrusted, and the personal information is handled within the scopenecessary for the achievement of the purpose of useb) When personal information is provided with succession of business because of mergers or other reasons, and the business entity thatprovides personal information had already clearly specified or informed the individual about the matters stipulated in 2. a) to 2. f) of“3.1b Measures for acquiring personal information with documentation directly from the individual” or matters equivalent to or moresatisfactory than such matters in content, and acquired the consent of the person, and in case the personal information is handledwithin the scope of the purpose of use before the business succession.
c) When personal information is used jointly by specific entities, and the joint user already clearly specified or informed the individual
about the matters stipulated in 2. a) to 2. f) of “3.1b Measures for acquiring personal information with documentation directly fromthe individual” or matters equivalent to or more satisfactory than such matters in content, and acquired the consent of the person,
and in case the joint user informed the individual of the matters described below or the matters equivalent to or more satisfactory
than such matters in content beforehand, or made information on such matters readily accessible to the person.
- The fact that the personal information will be used jointly- Items of the personal information jointly used
- Scope of the joint users- Purpose of use of the joint users- Name or nomenclature of a person who has responsibility for controlling the personal information jointly used
- Acquisition methods of the personal information jointly usedd) When the business entity accesses the individual by using the acquired personal information without describing clearly, notinforming, nor publicly announcing the purpose of use, etc. to the individual as 3. d) of “3.1c Measures for acquiring personal
information by methods other than direct acquisition with documentation” is applied.
e) When any of 4. a) to 4. d) of “4.1 Measures concerning use” is applied.
In cases of application of any of a) to e) above, procedure for approving such application is established, and the business is conductedaccordingly.
In cases in which d) above is applied, procedure therefor is established, and the business is conducted accordingly.

The applicant business entity, when providing a third party with personal information, shall inform the individual of the acquisition method
and matters equivalent to or more satisfactory than the matters stipulated in 2. a) to 2. d) of “3.1a Measures for acquiring personal
information with documentation directly from the individual” in content beforehand, and obtain the consent of the person. The following
conditions related to the measures concerning provisional information shall be fulfilled.

2.

5.1

Personal information is utilized within the scope necessary for the achievement of the identified purpose of use in accordance with theregulation of the entity; and the business is conducted accordingly.
Procedure for approving changes in the purpose of use is established; and the business is conducted accordingly.
Procedures for informing the individual of the matters stipulated in 2. a) to 2. f) of “3.1a Measures for acquiring personal information
with documentation directly from the individual” or matters equivalent to or more satisfactory than such matters in content upon making
changes in the purpose of use and for obtaining consent of such person are established, and the business is conducted accordingly.
Use other than for intended purposes that does not require the consent of the individual is limited exclusively to the cases in a) to d)
below, and the business is conducted accordingly.
a) Cases in which the use of personal information is required by a law.
b) Cases in which the use of personal information is necessary for the protection of the life, body, or property of an individual and inwhich it is difficult to acquire the consent of the individual.
c) Cases in which the use of personal information is especially necessary to improve public hygiene or promote the sound growth ofchildren and in which it is difficult to acquire the consent of the individual.
d) Cases in which the use of personal information is necessary for cooperating with a governmental institution or a local public bodywhen executing activities prescribed by law and in which acquiring the consent of the individual may disturb the execution of suchactivities.
In cases of application of any of a) to d) above, procedure for approving such application is established; and the business is conductedaccordingly.
When it is found difficult to determine whether or not a case falls under the use other than for intended purposes, a manager in charge isrequested to determine the same in accordance with the regulation of the entity; and the business is conducted accordingly.

The applicant business entity, when accessing an individual by using his/her personal information, shall inform the individual of mattersequivalent to or more satisfactory than those provided upon direct acquisition of personal information with documentation from theindividual in content and the acquisition method, and obtain consent of the person. The following conditions related to the measures foraccessing the individual shall be fulfilled.
1.
2.

4.2

Cases in which there is a need to cooperate in regard to a central government organization or a local government, or a person
entrusted by them performing affairs prescribed by laws and regulations, and when there is a possibility that obtaining a principal's
consent would interfere with the performance of the said affairs
Other sensitive personal information belonging to an entity exempted from the obligations of the business entities handling personal
information or published by entities specified by rules of the Personal Information Protection Commission or special care-required
personal information set forth under government ordinances.

In cases in which personal information is provided to a third party, procedure for approving such provision is established, and thebusiness is conducted accordingly
In cases in which personal information is provided to a third party, procedures for informing the individual of the acquisition method andmatters stipulated in 2. a) to 2. d) of “3.1a Measures for acquiring personal information with documentation directly from the individual”
or matters equivalent to or more satisfactory than such matters in content beforehand, and for obtaining the consent of such person are
established, and the business is conducted accordingly.
In cases in which personal information is provided within the scope necessary for the achievement of the identified purpose of use and thefollowing are stated clearly- Type of data provided to the third party- Purpose of use for each type of data to be provided- How providing the data fulfills the identified purpose
The applicant business entity must obtain the prior consent of the individual, except in cases based on laws and regulations.

The applicant business entity shall make the acquisition, use and disclosure of personal information optional for the individual.
1.
2.
3.
4.
5.
6.
7.

The applicant business entity allows the individual to exercise choice in relation to the acquisition, use and disclosure.
The opportunity to exercise choice must be provided to the individual at the time of acquisition of personal information.
The applicant choice mechanism is in place and operates appropriately.
The applicant choice mechanism is displayed in a clear and conspicuous manner
The applicant choice mechanism is clearly worded and easily understandable
The applicant choice mechanism is easily accessible and affordable
The applicant`s choice mechanism promptly responds to the request from the individual.

32019/04/07
5.2

Securement of
accuracy of
personal
information

The applicant business entity shall maintain personal information correct and in an up-to-date state, within the scope of the purpose of use.
The following conditions related to the maintenance of personal information shall be fulfilled.
1.

Procedure for enabling reference and confirmation upon input of personal information(1) Person in charge of inputting personal information is clearly indicated.
(2) Procedure for enabling reference to and confirmation of inputted personal information is clearly indicated.
(3) Referencing and confirmation work are conducted in accordance with the procedure.
2.
Procedure for data correction(1) Person in charge of correcting personal information data is clearly indicated.
(2) Procedure for discovering inaccuracy or inconsistency of corrected personal information data is clearly indicated.
(3) Procedure for enabling reference to and confirmation of corrected personal information data is clearly indicated.
(4) Data correction work is conducted in accordance with the procedure.
3.
Procedure for verifying that personal information is accurate and in an up-to-date state(1) Person in charge of verifying that personal information is accurate and in an up-to-date state is clearly indicated.
(2) Procedures for verifying that personal information is accurate and in an up-to-date state and correcting it as necessary are clearly
indicated.
(3) Verification work is conducted in accordance with the procedure.
4.
Update of matters recorded(1) Person in charge of maintenance of records of conducted work is clearly indicated.
(2) Procedure for updating records of conducted work is clearly indicated.
(3) Procedure for keeping records of conducted work is clearly indicated.
(4) Update of matters recorded is conducted in accordance with the procedure.
5.
Retention period of personal information(1) Person in charge of determining retention period is clearly indicated.
(2) A criterion for determining retention period is clearly indicated.
(3) Retention period is determined in accordance with the procedure.
6.
Notification of Corrections (as defined in “7.6 Correction, addition, or deletion of personal information”) to information recipient(1) Corrections of personal information shall be informed to the recipient of the personal information (hereinafter the “Information
Recipient”)
7.
Correction procedures of an entrusted person(1) If the applicant business entity is entrusting the handling of personal information, procedures to ensure that the corrections are madeby the entrusted party (including processors, agents, contractors or other service providers who are entrusted to handle personal
information on behalf of the applicant business entity. Hereinafter the “Trustee”), when the Trustee is informed the correction of
personal information.
8.
Establishment of procedure for confirmation with the Trustee(1) Procedures to receive the Corrections about any personal information known to be inaccurate incomplete, or outdated from Trustees are
established6.1

Security
Protection
Measures

The applicant business entity shall take necessary and appropriate measures to prevent leakage, loss, and damage of personal information,and other security control measures for personal information, according to the risk of the personal information to be handled.

6.2.

Identifying,
Analyzing and
Evaluating
personal
information
protection
risks

The applicant business entity must identify and analyze the risks such as loss or unauthorized access, destruction, use, modification of personal
information or other misuses.
(1) The applicant business entity shall clearly specify the personal information protection risks regarding the handling (including without
limitation, the handling of personal information at acquisition and input, transfer and transmission, use and processing, storage and backup,
and erasure and disposal) of personal information(2) The applicant business entity shall clearly specify the organizational, human, physical and technical security control measures that has
been adopted for protecting personal information.
(3) The applicant business entity shall implement measures to detect, prevent and respond to attack, intrusion and other security threats, andimplement processes to verify such measures are properly implemented at appropriate intervals.
(4) The security control measures fulfills the criteria specified in “Annex 1（Security control measures for personal information）”(5) The applicant business entity shall analyze the concrete risk which effects the protection of privacy information.
(6) The applicant business entity must properly evaluate the personal information protection risks. The applicant shall not accept information
protection risks, except as otherwise provided by relevant law.

6.3

Risk
Treatment,
and theestablishmentof security
controlmeasures

The applicant business entity shall establish reasonable measures against the specified personal information protection risks, which aresuitable to the size and complexity of the applicant business entity, the nature and scope of its business activities and the types of personal
information. The measures shall also be proportional to the sensitivity of the information, probability and severity of the harm threatened of
the information, and the condition in which the information is held.
(1) The organizational, human, physical and technical security control measures established and conducted by the applicant business entity isnecessary and appropriate against the specified personal information risks.
(2) The applicant business entity shall take all measures that are practicable under current circumstances, and identify and control theuntreated issues as residual risks.
(3) The applicant business entity shall regularly conduct audit on the risk analyzation and proper implementation of the risk treatments.

6.4

Supervision of
the Trustee

The applicant business entity shall require the Trustee to identify and analyze, properly evaluate, and establish reasonable measures against
the personal information protection risks.
(1) The applicant business entity shall establish necessary measures (including without limitation, concluding contracts with Trustees) torequire the Trustee to identify and analyze, properly evaluate, and establish reasonable measures against the personal information protection
risks.
(2) The applicant business entity shall require the Trustee to notify the applicant business entity when the Trustee becomes aware of any
occurrence of breach of privacy or security of the personal information.
(3) The applicant business entity shall establish procedures to ensure the Trustee to respond to the breach of privacy or security.

6.5

Periodic
review

The applicant business entity shall periodically review the identification, analyzation and evaluation of the personal information protection
risks, and the measures established against the risks, and make adjustments to reflect the results of the reviews.

7.1

Public Disclosureof the mattersconcerning
personal
information

The applicant business entity shall configure the personal information in a condition that it is readily accessible by the individual (including
those cases in which it, at the request of the individual, responds without delay).
The following conditions regarding the issue shall be fulfilled.
1.

Concrete procedure for making the matters described below in a) to f) readily accessible by the individual is established, and the businessis conducted accordingly.
a) Name of the applicant business entity and a person to contact for resolution of complaintsb) Name or title, section and contact information of the personal information protection manager (or his/her alternate)c) Purpose of use of personal informationd) Person to contact for complaints regarding handling of personal informatione) Name of the authorized personal information protection organization, and person to contact for resolution of complaintsf) Procedure for responding to requests for disclosure and other requests

4

2019/04/07
7.2

7.3

7.4

7.5

Rights of theindividual
concerning
personal
information

Concerning requests on personal information for which the applicant business entity has the authority to respond to all requests for thedisclosure, correction of content, addition or deletion, stopping use, erasing, and stopping provision to a third party by the individual(hereinafter “Disclosures”), the business entity shall respond to such requests without delay

Procedure forsatisfying therights of theindividual
concerning
personal
information

The applicant business entity shall establish a procedure including the following items to respond to requests for Disclosures.
The procedure for responding to request for Disclosures shall be simple and easy to use presented in a clear and visible manner, and, shall beestablished so as not to impose an excessive burden on the said individual.

Notification
regardingpurpose of use of
personal
information

When notification of purpose of use is requested from an individual concerning personal information, the applicant business entity shall
respond thereto without delay.

Disclosure of
personal
information

When disclosure of personal information is requested from an individual concerning personal information, unless there are any relevant laws
prohibiting the disclosure, the applicant business entity shall disclose the personal information without delay in writing to the individual.

1.
2.
3.

a) Person to contact for the requests for Disclosure are submittedb) Form of documentation to be submitted when making the Requests and other methods for making the requestsc) Method for confirming that the individual who makes a request for Disclosure is the individual to whom the personal information
belongs to or his/her alternated) Method for collecting charges in cases of disclosure, correction, addition, or deletion of personal informatione) Reasonable period of time in responding to the request for Disclosures

1.
2.

1.
2.
3.

7.6

Correction,
addition, ordeletion of
personal
information

1.

4.
Discontinuanceof use orprovision of
personal
information

2.
3.
4.

Resources,
roles,
responsibility,
and authorities

The applicant business entity establishes regulations to respond without undue delay when disclosure of personal information that leads
to the identification of the individual is requested by an individual, except when a special procedure is stipulated by relevant law, and thebusiness is conducted accordingly.
Procedure for approving the content of the reply to the individual (including cases in which the request is to be denied) is established, andsuch procedure is clearly indicated. Approval of a manager in charge regarding the content of the reply to the individual is obtained inaccordance with the procedure.
If the applicant business entity decides to reject the disclosure of the individual’s personal information, it must explain to the individual
why the request was rejected, and provide the appropriate contact information for challenging the decision where appropriate.

The applicant business entity establishes regulations to execute the necessary investigation without delay within the scope necessary forachievement of the purpose of use and make Corrections based on the result when Corrections of personal information that leads to theidentification of the individual is requested by an individual, except when a special procedure is stipulated by relevant law, and thebusiness is conducted accordingly.
Provide response within a reasonable time frame following an individual’s request for Corrections.
Procedure for approving the content of the reply to the individual (including cases in which the request is to be rejected) is established,and such procedure is clearly indicated. Approval of a manager in charge regarding the content of the reply to the individual is obtainedin accordance with the procedure.
If the applicant business entity decides to reject the Corrections of personal information, it must explain to the individual why therequest was rejected, and provide the appropriate contact information for challenging the decision where appropriate.

When discontinuing use of, or erasing of personal information is requested by an individual, claiming that the personal information is being
handled in violation of 1.3”Identification of the purpose of use”, or is acquired in violation of 3.1”Appropriate acquisition of personal
information” or 3.1c”Appropriate acquisition of special care-required personal information”, or, stopping provision of personal information to athird party is requested by an individual claiming that the personal information is provided in violation of 4.2”Measures concerning provisionof personal information”, and when it has become clear that there is a reason in the request, the applicant business entity shall discontinueuse, erase or stop the provision of the personal information to a third party (hereinafter, ”Discontinuity”) except in cases in which there is any
legal basis.
The applicant business entity, after taking relevant measures, shall inform the individual of the result without delay.
1.

8.1

The applicant business entity establishes regulations to respond without undue delay when notification of the purpose of use is requested
by an individual, and the business is conducted accordingly.
Procedure for approving the content of the reply to the individual (including cases in which the request is to be denied) is established, andsuch procedure is clearly indicated.

When correction, addition, or deletion (hereinafter “Corrections”) of personal information is requested from an individual claiming that
content of the personal information is unfounded, except in cases in which there is any legal basis, the applicant business entity shall executea necessary investigation without delay within the scope of the purpose of use, and on the basis of the results, make the necessary
Corrections.

2.
3.

7.7

The business entity established procedures to respond to requests and the business is conducted accordingly.
There are no omissions in personal information subject to Disclosures.
Procedure for approving the application of the exceptional provisions is established, and the business is conducted accordingly.

The applicant business entity establishes regulations to respond to a request from an individual regarding the Discontinuity of personal
information that leads to the identification of the individual, and the business is conducted accordingly.
The applicant business entity establishes regulations to inform the individual after taking relevant measure without delay, and thebusiness is conducted accordingly.
Procedure for approving the content of the reply to the individual (including cases in which the request is to be denied) is established, andsuch procedure is clearly indicated. Approval of a manager in charge regarding the content of the reply to the individual is obtained inaccordance with the procedure.
If the applicant business entity decides to reject the Discontinuity of personal information, it must explain to the individual why the request
was rejected, and provide the appropriate contact information for challenging the decision where appropriate.

Representative of the applicant business entity shall prepare indispensable resources for establishing, implementing, maintaining, andimproving its personal information protection management system.
The resources shall fulfill the following conditions.
1.
2.
3.
4.
5.

Role and authority of each staff member are determined clearly and documented.
Role, responsibility, and authority of each staff member are determined clearly.
A personal information protection manager is appointed from within the entity by the representative. A personal information protection
auditor is appointed from within the entity by the representative; and auditors as defined by the Companies Law shall not take part in
the system. The personal information protection manager is not the same person as the personal protection auditor.
The role and authority of each staff member are informed to every staff member.
The personal information protection manager is obliged to report on the operational status of the personal information protection
management system to the representative of the entity in order to provide a basis for reviewing and improving the personal information
protection management system; and the reporting is conducted.

5

2019/04/07
8.2

Responses tocomplaints andconsultation

The applicant business entity shall establish and maintain a procedure and system for implementing proper and prompt actions when
receiving complaints from an individual and undertaking consultation with the individual.
The following conditions regarding the issue shall be fulfilled.
1.
2.
3.
4.
5.
6.

8.3

Supervision of
employees

The applicant business entity, when making its employees handle personal information, shall supervise the employees in an appropriatemanner and to the extent necessary to ensure security control measures of the personal information.
The following conditions related to the supervision of employees shall be fulfilled.
1.
2.
3.
4.
5.
6.
7.

8.4

Training of
employees

Procedures for accepting and appropriately and promptly responding to complaints from an individual and undertaking consultation with
the individual with regard to the handling of personal information as well as the personal information protection management system of
the entity are established.
Person to be contacted for complaints and requests for consultation is clearly identified.
Complaints and requests for consultation are accepted and responded in accordance with the procedures.
The procedures for accepting complaints and requests for consultation are functioning, and responses are made promptly.
Procedure for approving the content of the responses to be made to the individual is established, and the business is conductedaccordingly, while approval of a manager in charge regarding the content of the responses is obtained.
Procedure for reporting on the details of complaints and consultation and the results of the responses thereto to representative of theentity is established, and the reporting is conducted accordingly.

Regulation to conduct necessary and appropriate supervision of the employees is established, and the business is conducted accordingly.
Non-disclosure agreement with respect to personal information is signed with each employee at the start of employment contract or
entrustment contract in accordance with the regulation of the entity, and the business is conducted accordingly.
At the start of employment contract or entrustment contract, etc., the non-disclosure provision is made valid for a certain period evenafter the termination of the contract in accordance with the regulation of the entity, and the business is conducted accordingly.
Regulations regarding measures to deal with cases of breaches of the personal information protection management system areestablished, and the business is conducted accordingly.
In cases of monitoring of employees using a video or online, implementation measures of such monitoring are established, and thebusiness is conducted accordingly.
Regulations concerning a person in charge of the monitoring and his/her authority are established, and the business is conductedaccordingly.
Regulations concerning the monitoring are established and shared throughout the entity beforehand; and audit or confirmation withregard to proper implementation of the monitoring is conducted.

The applicant business entity shall periodically provide employees with appropriate training, and establish and maintain a procedure formaking employees understand necessary matters for each relevant function and level. The following conditions regarding the training shallbe fulfilled.
1.
2.
3.

4.
5.
6.

The applicant business entity establishes regulations to periodically provide all employees with appropriate training concerning personal
information protection, and the training is provided in accordance with a training plan.
All employees are provided with appropriate training concerning personal information protection.
The regulation or training plan includes at least the contents of a) to e) below.
a) Policy and procedure regarding personal informationb) Importance and advantage of being conformity with APEC information privacy principlesc) Role and responsibility to conform with APEC information privacy principlesd) Results to be anticipated when APEC information privacy principles are violatede) Response to complaints and consultationf) Procedures for providing personal information based on the law
Training materials include the contents of a) to e) above.
Procedure for checking the participants’ level of understanding is established, and the business is conducted accordingly.
Procedures for determining the responsibility and authority regarding the training plan and the implementation thereof, reporting ofresults of the training and their review, review of the training plan, and retention of records thereof are established, and the business isconducted accordingly.

8.5

Procedures forprovidingthepersonal
information

The applicant business entity shall establish the procedures for providing the personal information based on the law

8.6

Supervision oftrustees

The applicant business entity, when entrusting handling of personal information, shall establish criteria for selecting Trustees and selectTrustees who satisfy the requirements for the sufficient protection level that is the same as or higher than the protection level of theapplicant business entity.

The applicant business entity shall supervise the Trustee in an appropriate manner and to the extent necessary to ensure the security controlof the entrusted personal information. The following conditions related to the supervision of Trustees shall be fulfilled.
1.
2.
3.
4.
5.

6.
7.
8.

9.1

Internal audit

Procedure for establishing and reviewing criteria for selecting Trustees is established, and concrete and feasible criteria for selecting
Trustees is set in place accordingly.
Review of the criteria for selecting Trustees is conducted as necessary.
Trustees are evaluated based on the criteria for selecting Trustees (including periodical reevaluations) in accordance with the regulationof the entity, and the business is conducted accordingly.
All relevant Trustees are recognized.
The applicant business has mechanisms (including without limitation, concluding contracts with Trustees which include the following
requirements), to ensure that the obligations to the individual will be met.
a) Implementation of privacy rules that in effect resemble the privacy policy stated explicitly in the applicant's privacy statement andthe implementation rulesb) Follow instructions provided by Applicant relating to the manner in which personal information must be handledc)Clarification of responsibilities of the Entruster and Trusteed) Matters regarding security control of personal informatione)Provision regarding restriction of subcontracting to other parties without prior consent
f)Content and frequency of reports about the handling status of personal information to the trustorg) Matters that enable the trustor to confirm that the content of the agreement is observedh) Measures in case the content of the agreement is not observedi)Matters regarding report and communication to the trustor when an incident or an accident occurs
Require Trustees to provide the applicant business entity with self-assessments to ensure compliance with the instructions and/or
agreements/contracts by the applicant business entity
Carry out regular spot checking or monitoring of Trustees to ensure compliance with the instructions and/or agreements/contracts
Procedure for retaining the relevant documents including the above said contract for the personal information retention period isestablished, and the business is conducted accordingly.

The applicant business entity shall periodically conduct internal audit regarding the status of the conformance of its personal information
protection management system with the requirements of the certification standards, and the operational status of the personal information
protection management system.
The following conditions regarding the internal audit shall be fulfilled.
1.
2.
3.
4.

The applicant business entity establishes regulations to conduct internal audit with regard to conformance with the requirements of thecertification standards and the operating status thereof, and the internal audit is implemented in accordance with an audit plan.
Internal audit regarding the conformance and operating status is conducted at all sections of the entity.
The applicant business entity establishes regulations to let representative of the entity appoint a person within the entity whose position
is fair and objective as the personal information protection auditor, and the business is conducted accordingly.
The applicant business entity establishes regulations to let the personal information protection auditor direct the internal audit, prepare
an audit report, and submit it to representative of the entity, and the business is conducted accordingly.

62019/04/07
5.

The applicant business entity establishes regulations to ensure that objectivity and fairness of the internal audit and no auditor audits a
section to which he or she belongs to, and the business is conducted accordingly.
Procedures for determining responsibility and authority regarding the audit plan and the implementation thereof are established, and thebusiness is conducted accordingly.

9.2

Internal audit

The applicant business entity shall make, document, and maintain a plan related to education, audit, etc., required to ensure theimplementation of the personal information protection management system.
The plan shall fulfill the following conditions.
1.
2.

9.3

Corrective
actions andpreventive
actions

An education plan is required to be created upon approval of the representative, and the same is created in an appropriate manner.
An audit plan is required to be created upon approval of the representative, and the same is created in an appropriate manner.

The applicant business entity shall establish, implement, and maintain a procedure for determining the responsibility and authority toensure the implementation of corrective actions against non conformance and preventive actions, and the business is conducted accordingly.
The procedure shall include the following items.
a) Confirm the content of the non conformance.
b) Identify the cause of the non conformance and propose corrective actions and preventive actions.
c) Determine necessary period for the action, and implement the proposed actions.
d) Record the results of the corrective actions and preventive actions that were implemented.
e) Review the effectiveness of the corrective actions and preventive actions that were implemented

7

2019/04/07
Annex1
Security control measures for personal information
The applicant business entity, as shown below I and II, shall take necessary and appropriate measures to prevent
leakage, loss, and damage of personal information, and other security control measures for personal information,according to the risk of the personal information to be handled.
I. Measures that should be taken as physical security control measures(1). Entrance/exit controla) Entrance to and exit from the buildings, rooms, server rooms, and places in which personal information ishandled are restricted.
b) Records of entrance to and exit from the buildings, rooms, server rooms, and places in which personal
information is handled are made and maintained.
c) Records of entrance to and exit from the buildings, rooms, server rooms, and places in which personal
information is handled are periodically checked.
(2). Antitheft controla) Documents, media, portable computers, etc., on which personal information is contained are not left on the desk
when the person in charge is not at the desk.
b) Each computer with which personal information is handled is logged off or a screensaver with a password islaunched whenever the person in charge leaves his/her computer.
c) Any media (papers and recording media) on which personal information is recorded are kept under lock and key.
d) Keys to the storage places for media on which personal information is recorded are in the custody of a person inchange.
e) Any media (papers and recording media) on which personal information is recorded are made unusable when
they are disposed of.
f) Antitheft measures are applied to portable computers, etc., on which personal information is recorded.
g) Rules are established and followed with regard to the use of portable computers and external storage media
such as, USB flash memory, and CD-ROM.
h) Operation manuals for information systems with which personal information is handled are not left on desks.
(3). Physical protection of equipment and devices, etc.
a) Equipment and devices, etc., with which personal information is handled are physically protected from security
risks (including theft, disposal, and breakage) as well as environmental risks (including water leaks, fire, power
failures, and earthquakes).

1

2019/04/07
Annex1
II. Measures that should be taken as technical security control measures(1). Identification and authentication with respect to access to personal informationa) Authentication using identification data (username, password, etc.) is performed in order to control access topersonal information.
b) Default settings for information systems on which personal information is stored are properly changed asnecessary.
c) Issuance, updating, and disposal of identification data are taking place in accordance with the rules.
d) Identification data is not stored in plain text.
e) Setting and use of identification data are taking place in accordance with the rules.
f) Use of terminals and addresses, etc., for employees having access rights to personal information is restricted.
(2). Control of access to personal informationa) The number of employees who have access to personal information is kept to a bare minimum.
b) Identification data for accessing personal information is not shared with more than one person.
c) Access rights granted to employees are kept to a bare minimum.
d) The number of simultaneous users of an information system on which personal information is stored is limited.
e) Utilization time of the information systems on which personal information is stored is limited.
f) Information systems on which personal information is stored are protected against unauthorized access.
g) Unauthorized use of applications which enables accessing to personal information is prevented.
h) Effectiveness of the access control functions introduced to the information systems for handling personal
information has been verified.
(3). Control of access rights to personal informationa) Control of rights to give permission to persons to access personal information is performed appropriately on aregular basis.
b) Access to information systems for handling personal information is controlled by being kept to a bare minimum.
(4). Records of access to personal informationa) Records of access to personal information and of the success or failure of such operations are acquired andmaintained.
b) Acquired records are appropriately protected against leaks, loss, and damage.
(5). Protection measures against malware for information systems handling personal informationa) Antivirus software is installed in the information system.
b) Security-fix programs (or security patches) for the operating systems and applications are applied.
c) Effectiveness and stability of the protection measures against malware are confirmed.
d) File-sharing software (such as Winny, Share, and Cabos) is not installed in terminals from which access topersonal information is possible.

22019/04/07
Annex1(6). Measures at the time of transfer and communication of personal informationa) Records of giving and receiving personal information are maintained upon transfer of personal information.
b) Measures are established in case a recording medium containing personal information is lost or stolen duringtransfer.
c) Personal information being transmitted through a network that is vulnerable to sniffing (e.g. internet andwireless LAN) is encrypted or password-locked for security purposes.
(7). Measures when checking the operations of information systems for handling personal informationa) Personal information is not used as test data when checking the operations of the information systems.
b) When changes are made in the information systems, it is confirmed that the level of security of the information
systems and the operational environment are not decreased thereby.
(8). Monitoring of information systems for handling personal informationa) Usage of the information systems for handling personal information is periodically checked.
b) Status of access to personal information (including operation details) is periodically checked.

3