Question to the Department for Digital, Culture, Media & Sport:

To ask the Secretary of State for Digital, Culture, Media and Sport, how the data provisions of the UK-Japan Comprehensive Economic Partnership Agreement affect the data protections UK citizens are afforded if they are employed by a company based in Japan.

The UK-Japan Comprehensive Economic Partnership Agreement (CEPA) does not affect existing data protection standards in the UK or Japan. Further, the UK has preserved on a transitional basis the effect of the EU’s adequacy assessment of Japan’s data protection regime, which recognises that Japan offers an adequate level of data protection. This allows personal data to flow freely between the two economies on the basis of strong data protection guarantees.

The data provisions in CEPA do not affect the scope of the UK GDPR or the Data Protection Act 2018. If a Japanese company is processing employees’ personal data in the context of an establishment in the UK, or otherwise meets the requirements of the territorial scope provisions of the UK GDPR, then the UK GPDR and Data Protection Act 2018 will apply to the processing.