ASIA PACIFIC | ALL INDUSTRIES

PPC (Japan)

The Personal Information Protection Commission (PPC) is a Japanese government commission primarily responsible for protecting the rights and interests of individuals, including considerations of the proper use of personal information.

PPC compliance offerings

Learn more about various laws, regulations, and guidelines prescribed by the PPC.

APPI

One of the guidelines issued by the PPC pertains to the Act on the Protection of Personal Information (APPI), which lays out the key obligations that personal identifiable information (PII) handlers have towards the individuals whose PII they handle. The guidelines include security measures broken out into four categories; organizational measures, personnel controls, physical security controls, and technical controls.

Google Cloud has produced a whitepaper that examines APPI from the perspective of adopting Google Cloud services. It addresses roles and responsibilities under the shared responsibility model and shows how Google Cloud provides a secure foundation for PII workloads. The whitepaper also provides information on how Google Cloud products and services can help customers meet the recommended security measures of the PPC Guidelines.

My Number Act

The Japanese government issues a unique number to every resident of Japan. This number, also referred to as the Social Benefits or Tax Number, is protected by the My Number Act. The Personal Information Protection Commission (PPC), which acts as Japan’s data protection authority, supervises and monitors compliance with the My Number Act.

The responsibility to protect “My Number” and personal data lies with our customers when using Google Cloud Platform. As part of their due diligence, customers may choose to review the information provided here and other relevant information, including our ISO/IEC 27001, ISO/IEC 27017, and ISO/IEC 27018 certifications. These international certifications relate to practices to protect information (such as personal information and “My Number” data) and include appropriate access control measures.