Under Japan's Act on the Protection of Personal Information (APPI), sending personal data to anyone in India, including your own Indian subsidiary or an Indian service provider, is a transfer to a third party in a foreign country under Article 28. Because India has no adequacy finding from Japan's Personal Information Protection Commission (PPC), the Japanese company needs either the individuals' informed consent or a recipient that maintains a system meeting the PPC's standards, usually set up through an intragroup data agreement. In India, the Digital Personal Data Protection Act, 2023 and its 2025 Rules apply fully to data of people in India, but processing of Japanese residents' data under a contract with the Japanese parent is largely exempt.
← Back to the complete guide: How to Set Up a Subsidiary in India from Japan
Key facts
| Japanese law | Act on the Protection of Personal Information (APPI), as amended with effect from 1 April 2022 |
|---|---|
| Japanese regulator | Personal Information Protection Commission (PPC) |
| Transfer rule | Article 28: consent, an equivalent country, or a recipient with a system meeting the PPC's standards |
| India's status in Japan | No equivalence designation; the EU and the UK are the designated regions |
| Indian law | Digital Personal Data Protection Act, 2023 and DPDP Rules, 2025 |
| Indian timetable | Rules notified in November 2025; main duties apply from 13 May 2027 |
| Indian exemption | Section 17(1)(d): data of people outside India processed under a contract with a foreign person |
| Maximum Indian penalty | INR 250 crore per breach for failing to take reasonable security safeguards |
Who is responsible for what
Most Japanese groups use their Indian subsidiary in one of two ways, and the legal position differs between them. Mapping each data flow to one of these patterns first saves a great deal of confusion later.
| Data flow | Japanese law | Indian law |
|---|---|---|
| Japanese customers' or employees' data sent to the Indian team to process for the parent (IT support, back office, engineering, analytics) | APPI Article 28 applies to the transfer out of Japan | Largely exempt under section 17(1)(d), except security safeguards and general accountability |
| Data of people in India collected by the subsidiary (its employees, Indian customers, Indian suppliers' staff) | Generally outside APPI unless the Japanese company handles it as part of its own business | DPDP applies in full; the subsidiary is the data fiduciary |
| Indian employees' data sent to Japan for group HR, payroll or approvals | APPI applies once the Japanese company holds it | Transfer abroad allowed unless India restricts the destination country; employment use is a legitimate use |
Transferring data from Japan under APPI Article 28
Article 28 of the APPI governs providing personal data to a third party in a foreign country. Two points surprise many Japanese companies. First, the domestic exception for entrusting data to a processor (itaku) does not by itself cover a recipient abroad, so outsourcing to an Indian company is caught. Second, the Indian subsidiary counts as a separate third party, even though it is wholly owned.
| Route | When it works | What it requires |
|---|---|---|
| Equivalent country | Only for countries the PPC has designated | Not available for India |
| Recipient with a system meeting the PPC's standards | The usual route for group companies and long-term service providers | A contract or binding internal rules obliging the recipient to handle data in line with the APPI, plus ongoing checks |
| Informed consent | Small or occasional transfers, or where a contract is impractical | Before consent, tell the person the destination country, an overview of its data protection system, and the measures the recipient takes |
Consent is harder to use at scale than it looks. It must be given before the transfer, by each person, after they receive the required information about India's system, and it is weak where consent cannot be freely refused, as in employment. Most Japanese groups therefore use the standards route for their Indian subsidiary.
The PPC standards route in practice
Under this route the Japanese company ensures the Indian recipient handles the data under arrangements equivalent to the APPI's core duties. In practice that means:
- An intragroup data processing agreement between the Japanese company and the Indian subsidiary, covering purpose limits, security measures, staff confidentiality, restrictions on onward transfer, breach reporting to the parent, and return or deletion at the end.
- Security measures to Japanese standards: access controls, logging, encryption, and keeping Japanese data segregated where practical.
- Periodic checks by the Japanese company that the arrangements are actually followed, for example an annual questionnaire and evidence review, and remediation if they are not.
- Information on request: if an individual asks, the Japanese company must be able to explain the measures the recipient takes and any Indian law that could affect them, so keep a short summary of India's DPDP regime on file.
- Onward transfers: if the Indian team uses a cloud provider or vendor in a third country, the agreement should require the same protection to follow the data.
This mirrors what many Japanese groups already do for EU data under the GDPR, so the documents can often be adapted rather than written from scratch.
What India's DPDP Act requires of the subsidiary
For personal data of people in India, the Indian subsidiary is a data fiduciary and must meet the full DPDP regime as its duties take effect by 13 May 2027:
- Give clear notices and obtain consent where consent is the basis, with an easy way to withdraw it.
- Rely on a legitimate use where the Act allows, such as employment purposes for staff data.
- Take reasonable security safeguards, including encryption, access control, logs kept for at least a year, and contracts with processors.
- Report personal data breaches to the Data Protection Board of India and to affected individuals.
- Erase data once the purpose is served, and answer access, correction and erasure requests within the time the Rules set.
- Publish contact details for data protection queries; a significant data fiduciary also needs a data protection officer in India, audits and impact assessments.
Sending Indian data to Japan is permitted: the DPDP Act allows transfers abroad unless the Government restricts a particular country, and no such restriction affects Japan. Sector rules can be stricter; for example, some RBI-regulated payment data must stay in India.
The exemption for Japanese residents' data
Section 17(1)(d) of the DPDP Act exempts processing by a person in India of personal data of people outside India, under a contract with a person outside India, from most of the Act. Only the general duty to comply and the duty to take reasonable security safeguards continue to apply. This was written for India's services exports and covers the typical Japanese capability-centre pattern: the Indian subsidiary processing Japanese customers' data under a services agreement with the Japanese parent.
The exemption depends on the contract, so the intragroup services agreement should state that the subsidiary processes the data on the parent's behalf and instructions. It does not reduce the Japanese company's APPI duties, which apply to the transfer regardless of what Indian law says.
Breach reporting in both countries
| Japan (APPI) | India (DPDP) | |
|---|---|---|
| What triggers a report | Breaches involving sensitive data, risk of financial loss, a likely improper purpose, or more than 1,000 people | Any personal data breach |
| Who is told | The PPC and the affected individuals | The Data Protection Board of India and each affected individual |
| Timing | A preliminary report promptly, and a final report generally within 30 days (60 days where an improper purpose is suspected) | Without delay, with a detailed report to the Board within 72 hours of becoming aware |
| Who reports | The Japanese company handling the data, even if the breach happened at the Indian recipient | The Indian data fiduciary for Indian data |
A single incident in the Indian centre can therefore trigger reports in both countries on different timetables. Build one incident playbook with both clocks in it, and make the intragroup agreement require the Indian team to tell Japan within hours, not days.
Records, audits and penalties
- Under the APPI, the Japanese company must keep records of personal data it provides to third parties, including transfers to India.
- The PPC can request reports, inspect and issue orders; breaching an order can lead to fines of up to JPY 100 million for a company.
- Under the DPDP Act, the Data Protection Board can impose penalties of up to INR 250 crore for failing to take reasonable security safeguards and up to INR 200 crore for failing to report a breach.
- Keep the transfer analysis, the agreement, check results and incident logs together: they answer regulators in both countries and the group's auditors.
A checklist for the Japanese parent and the Indian team
- Map every data flow between Japan and India and classify it under the three patterns above.
- Choose the APPI Article 28 route for each flow; for the subsidiary, put an intragroup data agreement in place.
- Prepare the summary of India's data protection system that the Japanese company must provide on request.
- Draft or update the intragroup services agreement so the section 17(1)(d) exemption is available for Japanese data.
- Build DPDP notices, consent and grievance processes for Indian employees and customers before 13 May 2027.
- Write one breach playbook covering PPC and Data Protection Board timelines.
- Review the arrangements each year and keep the records.
How AU Corporate handles this
AU Corporate sets up and runs the Indian subsidiary's compliance, including the intragroup agreements that data transfers depend on. We work with your Japanese legal team or data protection adviser on the APPI side, and handle the Indian side: the services agreement wording for the non-resident exemption, DPDP processes for Indian staff data, and keeping the documents consistent with the transfer pricing file.
Related services: secretarial and ROC compliance and GCC setup in India.
Frequently asked questions
Is sending data to our own Indian subsidiary a transfer under the APPI?
Yes. The Indian subsidiary is a third party in a foreign country under Article 28, even though it belongs to the same group.
Does Japan treat India as having equivalent data protection?
No. The PPC's equivalence designation covers the EU and the UK, so transfers to India need consent or a recipient with a system meeting the PPC's standards.
What is the usual APPI route for an Indian subsidiary?
An intragroup data agreement under which the Indian company handles data in line with the APPI, plus periodic checks by the Japanese company.
Does India's DPDP Act apply to Japanese customer data processed in India?
Mostly not. Section 17(1)(d) exempts processing of data of people outside India under a contract with a foreign person, except the duties to comply generally and take reasonable security safeguards.
When do India's DPDP duties start?
The DPDP Rules were notified in November 2025, and the main duties apply from 13 May 2027.
Can Indian employee data be sent to Japan?
Yes. The DPDP Act allows transfers abroad unless the Government restricts the destination, and Japan is not restricted. The subsidiary still needs proper notices to its staff.
Who reports a breach that happens in the Indian centre?
For Japanese data, the Japanese company reports to the PPC and affected individuals. For Indian data, the Indian subsidiary reports to the Data Protection Board and affected individuals.
What are the penalties?
In Japan, breaching a PPC order can lead to fines of up to JPY 100 million for a company. In India, penalties reach INR 250 crore for failing to take reasonable security safeguards.
Related guides
GCC for Japanese Companies
Running a capability centre in India.
Read the guide →Hiring and Payroll
Contracts and HR data for Indian staff.
Read the guide →Transfer Pricing
Pricing the intragroup services agreement.
Read the guide →Japan Parent Obligations
Japanese reporting on the Indian company.
Read the guide →Sources
Last updated 3 November 2026. General information only, not legal or tax advice. Indian rules change often; confirm current requirements before acting.