ZEROCK
Is Sending Personal Data to an LLM API a Cross-Border Transfer? APPI Article 28
If you put a prompt into an overseas LLM API, is that a cross-border provision under Article 28 of Japan's personal data protection act? The Commission's generative AI alert contains no reference to Article 28, to "a third party in a foreign country" or to cross-border transfers. Here is what the statute, Enforcement Rules 16, 17 and 18, the Guidelines and Q&A items Q7-53 and Q12-4 actually say.
2026-09-06Ryuta Hamamoto
