Japanese companies without a European subsidiary that sell to customers in Germany and the European Union, for example online retailers of Japanese goods, game and app developers, tourism businesses marketing to German travellers, and software companies, are subject to the GDPR for that activity and must appoint an EU representative under Art. 27 GDPR. Kanzlei Matutis, a German law firm specialised in data protection, provides this service for Japanese companies for 350 EUR per year. We correspond in English and German; Japanese-language correspondence is not possible.
Does a company from Japan need an EU representative?
Yes, if it has no establishment in the EU and its processing of personal data relates to offering goods or services to people in the EU or to monitoring their behaviour there (Art. 3(2) in conjunction with Art. 27(1) GDPR). Examples: a Tokyo online shop selling stationery or fashion to customers in Germany with EUR pricing and EU shipping; a mobile game studio whose titles are listed in EU app stores and track player behaviour; a Kyoto hotel or tour operator with a German-language booking site. Large Japanese groups with a German or Dutch subsidiary do not need a representative; the EU entity is the contact point. A Japanese company that already has a subsidiary, branch or office in an EU Member State does not need a representative; that EU entity is the point of contact. The exceptions of Art. 27(2) GDPR (occasional, low-risk processing without large-scale sensitive data; public authorities) are narrow and rarely apply to a business that actively markets to the EU. The full criteria are explained on the page What is the legal situation?.
The Japanese APPI, mutual adequacy and the EU representative
Japan’s Act on the Protection of Personal Information (APPI) is enforced by the Personal Information Protection Commission (PPC). In January 2019 the EU and Japan adopted mutual adequacy decisions, creating the largest area of free data flows in the world; the Commission’s decision under Art. 45 GDPR covers transfers from the EU to business operators in Japan subject to the APPI. The adequacy decision governs data transfers out of the EU. It does not change the territorial scope of the GDPR under Art. 3(2) GDPR, and a Japanese company that offers goods or services to people in the EU, or monitors their behaviour, still needs an EU representative under Art. 27 GDPR. APPI compliance at home and GDPR compliance for the EU-facing business, including the representative, are two separate requirements.
What we do as EU representative for Japanese companies
Rechtsanwaltskanzlei Matutis is a German law firm in Potsdam, near Berlin, specialised in data protection law. Under a written mandate pursuant to Art. 27(1) GDPR we act as your point of contact in the EU for all supervisory authorities of the Member States and for data subjects. Letters and emails addressed to us are checked, scanned and forwarded to your contact person without undue delay; we point out deadlines, such as the one-month period for data subject requests under Art. 12(3) GDPR. With a time difference of seven to eight hours, mail received in Potsdam during our working day is forwarded by email and waits in your inbox the next morning; urgent deadlines are flagged in the subject line. We communicate in English and German. We do not replace your Data Protection Officer and do not take over your compliance decisions; the difference is explained on the page EU representative vs. Data Protection Officer.
Cost for companies from Japan
The annual flat fee is 350 EUR. Because the service is provided by a German law firm to a business customer outside Germany, German VAT is not charged (reverse charge), so net equals gross. We invoice in EUR; payment by international transfer or by credit card or PayPal is possible. Please instruct your bank so that the full EUR amount is credited. Forwarding of scanned mail by email is included; postal forwarding of originals is charged at 2 EUR per item plus postage. Full details: What does it cost and what is included?
Next step
Send us your company name, website and a short description of your activities in the EU via the inquiry form. We confirm whether a representative is required in your case and send you the contract and written mandate. The complete process is described on the page How to appoint an EU GDPR representative. Other countries: EU representative by country.