Compliance
Microsoft 365 Copilot in Japan
Structured issue-spotting for deploying Microsoft 365 Copilot in Japan, read against the rules for that jurisdiction.
- Source
- Rules engine over a generic brief — no anchored quote on this page
- Verified
- Evidence not verified
- Confidence
- Low
Structured issue-spotting to support your own review — not legal advice. Verify against the cited primary sources and your counsel.
01What this reading assumes
- Jurisdiction
- Japan
- Principal framework
- Act on the Protection of Personal Information (個人情報の保護に関する法律, Act No. 57 of 2003). Requires the purpose of use to be specified and adhered to, restricts acquisition and third-party provision, sets security control measures, and imposes duties when personal data is entrusted to a contractor — which is what using a model provider usually is. Transfers to a third party in a foreign country are subject to their own regime, with an information duty to the individual. The e-Gov entry currently shows unenforced provisions pending, so check which version applies before relying on an article number.
- Delivery assessed
- Enterprise SaaS
- Data leaves the network
- unknown — the deciding question for a hosted product
- Vendor home jurisdiction
- the United States
- Verified vendor positions
- none — every vendor position below is a question, not an assurance
- Rules evaluated
- 20
- Rules fired
- 14
Assumptions about use
- An internal deployment used by employees, not a public-facing product.
- A person reads the output before acting on it — but that is not recorded, so the engine reports it as a gap rather than assuming it.
- No significant automated decision is taken about a person by the system alone.
02Issues to work through
Cross Cutting
Confidentiality duties bind independently of data protection law
Material can be entirely free of personal data and still be the material a contract stops you disclosing. Client retainers, non-disclosure agreements, supplier contracts and common-law duties are the usual sources, and several of them require consent before a third party processes the material at all — which a model API call is.
- Required checks
- Review the confidentiality clauses in the contracts covering the material going into the system.
- Identify any contract requiring notice or consent before a subcontractor processes the material.
- Decide whether the deployment needs a confidentiality carve-out negotiated into new contracts.
- Vendor questions
- Will the vendor accept a confidentiality undertaking beyond its standard terms?
- Which staff at the vendor can access customer content, under what controls?
- Technical controls
- Segregate the most sensitive corpora into an index that the general assistant cannot reach.
Human review required — take this to your counsel
What ends up in a prompt, and where it goes next
Every prompt is a transfer of whatever it contains. Staff paste more than they intend, retrieved context travels with the prompt, and system prompts can often be extracted from the output. Assume anything reaching the model has left your control unless the contract and the architecture say otherwise.
- Required checks
- Write down which categories of information may be entered into a prompt, and tell people.
- Establish what the system prompt contains and whether disclosing it would matter.
- Establish which shadow tools staff are already using; the policy has to name the permitted ones.
- Vendor questions
- Are prompts and completions retained, for how long, and can retention be set to zero?
- Are prompts used for abuse monitoring, and if so who can read them and for how long?
- Technical controls
- Redact or block high-risk patterns before the prompt leaves the application.
- Keep prompt and completion logs out of general-purpose observability tools.
- Set an explicit retention period on prompt logs and enforce it.
The acceptable-use policy may exclude your use case
Acceptable-use policies commonly carve out unsupervised legal, medical and financial advice, decisions about people without human review, and some surveillance and biometric uses. They are incorporated into the contract by reference and change without a signature, so the version that matters is the one live on the day you rely on it.
- Required checks
- Read the acceptable-use policy against your actual use case, not against a summary of it.
- Where a carve-out applies, decide whether human review brings the use back inside the policy.
- Set a reminder to re-read the policy — it changes without notice to you.
- Vendor questions
- Does your acceptable-use policy permit this use case, and will you confirm that in writing?
- How are we notified when the acceptable-use policy changes?
Human review required — take this to your counsel
Being able to reconstruct a decision months later
The question that arrives after a complaint is what the system was shown and what it produced on a particular day. Models change, prompts change, and indexes are rebuilt, so the answer has to be recorded at the time. Without it, the only available response is that the output cannot be reproduced.
- Required checks
- Decide what is recorded per interaction: model and version, prompt template version, retrieved document ids, output, reviewer and outcome.
- Set how long those records are kept, balanced against the retention duties that also apply to them.
- Vendor questions
- Does the vendor pin model versions, and how much notice is given before a model is retired or changed?
- Technical controls
- Version prompt templates in source control and log the version used.
- Log the model identifier and version returned by the provider, not the one you requested.
Vendor documentation has not been verified
We could not verify a data processing agreement, a subprocessor list, a position on training on customer data and a stated processing region for this vendor from a retrieved document. That is a gap in our evidence, not a finding against the vendor: until a document has been fetched and read, nothing here should be treated as settled either way.
- Required checks
- Obtain the current versions of the processing agreement, subprocessor list, security page and any regional-processing commitment.
- Check that what the sales conversation promised also appears in the contract.
- Vendor questions
- Where is your data processing agreement published, and which version applies to us?
- Where is your subprocessor list, and how much notice do we get before it changes?
- Do you train on customer content by default, and where is that stated contractually?
- In which country or region is inference performed, and where are logs retained?
We were not told whether a person reviews the output
Where output influences a decision about a person, the reviewer has to be able to disagree with it. That needs three things a rubber-stamp review lacks: enough information to judge, enough time to judge, and an override that is used often enough to be real. Design it before the volume makes it impossible.
- Required checks
- Name the role that reviews the output and what they see when they do.
- Decide what evidence is retained about each review, so the practice can be shown to exist.
- Set a threshold below which the system must not act without review.
- Vendor questions
- Does the product expose the retrieved context and the confidence behind a suggestion, or only the answer?
- Technical controls
- Show the reviewer the retrieved sources next to the suggestion, not the suggestion alone.
- Record the reviewer’s decision, including overrides, as part of the audit trail.
Human review required — take this to your counsel
An AI deployment creates new copies of the data
Vector indexes, prompt logs, completion caches, evaluation datasets, fine-tuning checkpoints and backups are all copies of the source material in places the existing retention schedule does not mention. Deletion requests are the moment this is discovered, because deleting the source document does not delete its embedding.
- Required checks
- List every store the deployment creates and add each to the retention schedule.
- Establish how a deletion request propagates to the index, the caches and the logs.
- Establish how long backups keep material that has been deleted from the live system.
- Vendor questions
- What does the vendor retain, where, and for how long after we delete our copy?
- Technical controls
- Store the source document id with every embedding so deletion can cascade.
- Set time-to-live on prompt and completion logs rather than relying on manual cleanup.
The vendor’s terms may not permit the deployment you are planning
Provider terms routinely restrict things architectures assume: sharing seats, building a competing service, benchmarking and publishing results, reselling capacity, and processing certain data categories. A consumer or self-serve plan often carries different terms from the enterprise agreement, and the enterprise agreement is the one worth reading.
- Required checks
- Identify which contract actually governs — self-serve terms, an order form, or a negotiated agreement.
- Check restrictions on seat sharing and on service accounts, which a shared internal assistant can breach without anyone noticing.
- Check whether the terms allow the categories of data you intend to send.
- Vendor questions
- Which agreement governs our use, and can we have the current version in writing?
- Are there restrictions on the data categories or the industries we may use the service for?
Japan
Provision to a third party in a foreign country is its own category
The APPI treats provision of personal data to a third party in a foreign country separately from domestic provision, with an information duty to the individual about the destination country and the recipient’s protection measures. Sending a prompt to an overseas model provider is usually both entrustment and a cross-border provision, and the two questions have different answers.
- Required checks
- Identify the destination countries for inference, storage, logging and support access.
- Decide which route you rely on, and prepare the information the individual must be given.
- Vendor questions
- In which countries is our content processed and retained, and can that be fixed contractually?
- What protection measures do you have in place that we can describe to data subjects?
Human review required — take this to your counsel
Entrusting handling to a provider carries a supervision duty
Where the handling of personal data is entrusted to a contractor, the APPI requires necessary and appropriate supervision of that contractor. Using a model provider is normally entrustment. Supervision means terms plus evidence that you check them, not a signature filed away.
- Required checks
- Confirm the contract covers security control measures and permitted sub-entrustment.
- Decide what periodic check constitutes supervision here, and diarise it.
- Vendor questions
- Which sub-contractors handle our content, and where are they located?
- What evidence of your security control measures can you provide on request?
The Commission has already said what it expects about prompts
The Personal Information Protection Commission announced a cautionary notice on the use of generative AI services, published as an attachment to the announcement, and issued a separate notice to OpenAI, L.L.C. and OpenAI OpCo, LLC as the developers of ChatGPT. The instructions on what may be entered into a prompt are in the attachment rather than on the announcement page, so read the attachment before writing a staff policy.
- Required checks
- Write the internal rule on what may be entered into a prompt, in concrete terms.
- Check that the sanctioned tool covers the work people are currently doing elsewhere.
- Technical controls
- Redact or block obvious personal identifiers before the prompt leaves the application.
The purpose of use has to be specified and then adhered to
The APPI requires a business handling personal information to specify the purpose of use as far as possible and not to exceed it without consent. A purpose written for a document management system rarely covers indexing that content for a generative assistant, so extending the purpose — and notifying or publicising the change — is a specific step rather than an implicit one.
- Required checks
- Retrieve the current purpose-of-use statement for the data in scope.
- Decide whether the AI use is within it, within a reasonably related change, or beyond it.
- Where it is beyond, plan the notification or the consent before indexing anything.
Human review required — take this to your counsel
AI Guidelines for Business are the governance benchmark, and there is no AI penalty regime
The AI Guidelines for Business are at version 1.2, compiled by the MIC and METI review panel. The AI Promotion Act of 2025 sits above them as a promotion statute: it establishes national policy and an AI Strategy Headquarters in the Cabinet, and imposes no obligations or penalties on a company deploying AI.
- Required checks
- Map your governance against the current version of the guidelines rather than an older one.
- Where a customer asks how the deployment is governed, answer in the guidelines’ vocabulary.
- Vendor questions
- Do you publish a statement of alignment with the AI Guidelines for Business, and at which version?
The APPI is mid-amendment, with no commencement date yet
An amending act was promulgated on 17 July 2026 and commences on a date to be fixed by Cabinet Order within two years, with earlier tranches for some provisions. The Commission has published its implementation programme and is still preparing the orders, rules and guidelines. A design decision with a multi-year life should assume the rules will move.
- Required checks
- Note the amendment in the deployment’s review schedule rather than treating today’s text as final.
Structured issue-spotting to support your own review — not legal advice. Verify against the cited primary sources and your counsel.
03What this reading does not know
- Whether any of the data falls into a special or sensitive category.
- Whether any material is covered by legal professional privilege.
- Whether prompts or documents leave the company network.
- Whether a person reviews the output before it is acted on.
04Instruments these issues point at
- standardAI Guidelines for BusinessJoint guidance from the Ministry of Internal Affairs and Communications and METI for businesses developing, providing or using AI. Version 1.2 is the current edition, superseding 1.0, 1.01 and 1.1. Non-binding, but it is the reference point Japanese counterparties and procurement teams use when asking how an AI deployment is governed.
- statuteAI Promotion ActA promotion statute. Defines AI-related technologies, sets national and local government responsibilities, and establishes an AI Strategy Headquarters chaired by the Prime Minister. It contains no penalties and imposes no direct obligations on a company deploying AI; its effect on a deployment is indirect, through the policy and guidance it drives.
- statuteAPPIJapan’s personal information statute. Specifies the purpose of use and holds processing to it, restricts acquisition and third-party provision, requires security control measures, and imposes supervision duties when handling is entrusted to a contractor. Cross-border provision has its own regime with an information duty. The e-Gov entry marks provisions that are promulgated but not yet in force.
- statuteAPPI 2026 AmendmentAmending act promulgated on 17 July 2026. Its main body commences on a date to be fixed by Cabinet Order within two years of promulgation, with earlier tranches for some provisions. The Commission has published an implementation programme and is still preparing the orders, rules and guidelines beneath it.
- guidancePPC Generative AI NoticeCommission notice on generative AI. Tells businesses to confirm that entering a prompt containing personal information stays within the necessary scope of the specified purpose of use, and records that a separate cautionary notice was issued to the developers of ChatGPT.
05Vendor documents being watched
- Data processing agreementhttps://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPAnot yet fetched
- Pricinghttps://azure.microsoft.com/en-us/pricing/details/cognitive-services/openai-service/not yet fetched
- Pricinghttps://www.microsoft.com/en-us/microsoft-365/enterprise/microsoft365-plans-and-pricingnot yet fetched
- Privacy policyhttps://privacy.microsoft.com/en-us/privacystatementnot yet fetched
- Security pagehttps://learn.microsoft.com/en-us/copilot/microsoft-365/microsoft-365-copilot-privacynot yet fetched
- Security pagehttps://www.microsoft.com/en-us/trust-centernot yet fetched
- Security pagehttps://learn.microsoft.com/en-us/azure/ai-foundry/responsible-ai/openai/data-privacynot yet fetched
- Supported countrieshttps://azure.microsoft.com/en-us/explore/global-infrastructure/data-residency/not yet fetched
- Supported countrieshttps://learn.microsoft.com/en-us/azure/foundry/foundry-models/concepts/models-sold-directly-by-azure-region-availabilitynot yet fetched
06Ask about your own deployment
This page reads the rules against a generic organisation. Your size, industry, data and existing contracts change which of these issues matter and which fall away.