Memorandum of Cooperation
between
The Personal Information Protection Commission of Japan
andThe Information Commissioner for the United Kingdom of Great Britain and NorthernIreland
for Cooperation in the Personal Information Protection

This Memorandum of Cooperation (“MOC”) establishes a framework for cooperation between
the Data Protection Authorities:(I)
The Personal Information Protection Commission of Japan (the “PPC")
and(II)
The Information Commissioner (the “Commissioner”),
hereinafter referred to individually as a “DPA” and collectively as the “DPAs”.
The DPAs;
Recognising the nature of the modern global economy, the increase in circulation andexchange of personal information across borders, the increasing complexity of information
technologies, and the resulting need for increased cross-border enforcement cooperation;
Acknowledging that the DPAs have similar functions and duties for the protection of
personal information in their respective countries;
Reaffirming the intent of the DPAs to deepen their existing relations and to promoteexchanges to assist each other in the enforcement of laws protecting personal information;
Emphasizing that one of the most important and fundamental functions of the DPAs is to
exercise their authorities, conferred by legislation, against violations of individual privacy
and to prevent further possible breaches. This function is essential to protect the rights andinterests of individuals and should not be limited unnecessarily by prioritizing the economic
benefits of business operators; andConvinced that the bilateral cooperation between the DPAs may support them to exercise
their authorities against violations of their national legislations on the protection of personal
information,

Have reached the following recognition:
11. General Matters(a) The Japanese Data Protection Authority is represented by the PPC, and the United
Kingdom of Great Britain and Northern Ireland Data Protection Authority is represented
by the Commissioner.
(b) Requesting DPA means the DPA that requests information or assistance.
(c) Requested DPA means the DPA to which information or assistance is requested.
2. Non-Binding Effect of This MOC
This MOC is a statement of intent that does not give rise to legally binding obligations on thepart of each DPA.
3. Scope of Cooperation(a) All measures mentioned in this MOC will be provided and implemented in accordancewith the applicable laws and regulations of the DPA’s respective jurisdictions and within
the limits of its competence and available resources.
(b) The DPAs will provide each other, either on their own initiative or on request, withinformation necessary to ensure proper application of national legislations on personal
information protection by exchanging relevant information and providing necessary
assistance pursuant to this MOC.
4. Information Exchange(a) In order to facilitate information exchange, each DPA will ensure that the information on
contact points is kept up to date. The DPAs will mutually exchange information on theirown initiatives or on request and to the extent it is available, through the contact points.
(b) On request, the requested DPA will, within the limits of the laws, regulations andavailable resources, provide the following information:(i) contact information of entities that the requesting DPA needs to communicate for its
own investigation on a specific case,(ii) past enforcement record which deems relevant to and helpful for the requesting DPA toconduct an investigation on a specific case, provided that such enforcement records will
not contain any personally identifiable data, and(iii) any other relevant information which deems relevant to and helpful for the requesting2

DPA to conduct an investigation on a specific case.
(c) Requests pursuant to this MOC will be made in writing in English. Information deemeduseful for the execution of such requests will accompany the requests. When the urgencyof the situation so requires, oral requests may also be made and accepted, but will bepromptly confirmed in writing.
(d) Requests pursuant to this MOC will include the following information:(i) the nature of the proceedings in respect of which the request is made;(ii) the purpose and the reason for the request;(iii) contact information of the persons to whom the request relates, if known; and(iv) a brief description of the matter under consideration and the legal elements involved.
(e) The Requested DPA may impose restrictions and conditions on its use when sharing
information with the Requesting DPA.
(f) Personal information will not be shared, except for cases where contact information
including personal information will be shared according to subparagraphs (b) (i) and(d)(iii) of this paragraph.
(g) If the Requested DPA is unable to provide information, or declines or postpones doingso, it will explain the reasons why.
(h) The DPAs may provide non-confidential information on their own initiative. The nonconfidential information includes but not limited to methods, practices, and guidance
documents that may be useful for the other DPA to exercise their legal authorities.
5. Use of Information(a) When the Requesting DPA receives information from the Requested DPA pursuant tothis MOC, the information will be used solely for the purpose defined pursuant toparagraph 4 (d) of this MOC. Where the Requesting DPA wishes to use such informationfor other purposes, it will obtain a prior written consent of the Requested DPA which
provided the information. Such use will then be subject to any restrictions laid down by
the Requested DPA.
(b) When the Requesting DPA receives information from the Requested DPA pursuant tothis MOC, the use of information will comply with restrictions and conditions laid down by3

the Requested DPA pursuant to paragraph 4 (e) of this MOC.
(c) Information provided pursuant to this MOC will not be used in criminal case investigation
and adjudication, without prior written consent.
(d) Information shared pursuant to this MOC will be marked with the appropriate
confidentiality classification. Security measures will be decided to be taken by theRequesting DPA for storage, use, disclosure to the third party or any other processing of
the information in line with the sensitivity of the information and any classification that isapplied by the Requested DPA. Where confidential information is wrongfully disclosed,
the Requesting DPA who has wrongfully disclosed the information will bring this to theattention of the Requested DPA.
(e) Where one DPA has received information from the other DPA pursuant to this MOC, it
will consult with the other DPA before disclosing the information to a third party such asother relevant competent authorities or using the information in an enforcement
proceeding or court case.
6. Further Cooperation(a) The DPAs may jointly identify one or more areas or initiatives for cooperation. Suchcooperation may include:(i) sharing of experiences and exchange of best practices on data protection policies,education and training programmes;(ii) implementation of joint research projects;(iii) cooperation in specific projects of interest; and(iv) any other areas of cooperation as mutually decided by the DPAs.
(b)The DPAs may convene bilateral meetings annually or as mutually decided between theDPAs.
7. CostExpenses incurred by the Requested DPA in carrying out a request from the Requesting DPA
under this MOC will be borne by the Requested DPA. If the execution of a request requires
expenses of a substantial or extraordinary nature, the Requested DPA will consult todetermine the conditions under which the request will be executed as well as the manner inwhich the costs will be borne.
8. Review and Modification
4

(a) Both of the DPAs will monitor the operation of this MOC and review it biennially, orsooner if either DPA so requests.
(b)Any issues arising in relation to this MOC will be notified to the designated point ofcontact for each DPA.
(c) This MOC may only be modified by the DPAs in writing and signed by each DPA.
9. Commencement and Discontinuation(a) This MOC will commence upon signature by the DPAs and will continue indefinitelyunless either DPA notifies, in written form, the other DPA of its intention to cease this
MOC at least three months in advance of the discontinuation date.
(b) The discontinuation of this MOC will not affect the duration of any ongoing programmes
or activities made under this MOC.
ForthePersonal

Information For the Information Commissioner

Protection Commission of Japanfor the United Kingdom of GreatBritain and Northern Ireland

Name: Ms Mieko Tanno

Name: Mr John Edwards

Title: Chairperson, Personal

Title: UK Information Commissioner

Information Protection Commissionof Japan
Date: 11 October 2023

Date: 17 October 2023

5