Data Protection & Privacy
One programme that shows how personal data is handled, in Europe and in Japan.
The problem
The GDPR asks organisations not only to comply but to be able to show it (Article 5(2)). That means records of processing, notices, processor contracts, a working process for rights requests and a plan for data breaches, all kept current.
Companies working between Europe and Japan also face Japan's Act on the Protection of Personal Information (APPI). Since the amendments in force from April 2022 it requires certain breaches to be reported to the Personal Information Protection Commission and sets stricter rules for transfers out of Japan. Two sets of rules often end up as two sets of paperwork.
What we do
We compare your current practice with the GDPR, the German BDSG and TDDDG and, where you handle personal data from Japan, the APPI, and give you a prioritised list of gaps.
We set roles and responsibilities, write or update the privacy policy, retention rules and internal guidelines, and define how privacy decisions are made.
We build or update your records of processing activities under Article 30 GDPR, with purposes, legal bases, recipients, transfers and retention for each activity.
We review privacy notices, consent and cookie processes, data processing agreements and transfer mechanisms, including transfers between the EU and Japan.
We set up processes to answer data subject requests within the GDPR deadline of one month and to assess and report breaches within 72 hours, and align them with APPI reporting duties.
We train staff, review the programme regularly and keep it current as your business, your vendors and the rules change.
How we deliver
We run the GDPR and APPI gap assessment and build your records of processing, policies and roadmap.
Learn moreWe set up the processes: data subject requests, consent management, breach handling and processor contracts.
Learn moreWe run privacy operations for you: rights requests, records upkeep, vendor reviews and breach assessments.
Learn moreFrameworks
Platform
From December 2026, the Fidempli platform adds the AI part of your privacy programme: every AI system with its purpose, data categories and DPIA, ready to feed your records of processing.
Explore the platform
Many of our clients work between Europe and Japan. Both laws ask for clear purposes, security measures, breach handling and transfer rules, so one programme with Japanese specifics added avoids duplicate work.
The EU and Japan recognise each other's data protection as adequate since 2019, so personal data can generally flow from the EU to Japan without additional transfer tools, subject to supplementary rules on the Japanese side. Transfers out of Japan to other countries follow the APPI's own rules.
Under the GDPR without undue delay and within one month, which can be extended by two further months for complex or numerous requests if you inform the person.
No. We support the person who holds the role. If you need an external data protection officer, that is a separate service.
We give practical compliance support. For questions that need legal advice in the strict sense, we work with your legal team or external counsel.
Fidempli provides governance, risk and compliance advisory and works alongside your legal counsel. We do not provide legal advice.
A senior consultant replies within one business day. Or join the 3–5 design partners shaping the platform before launch.
