A new amendment will come into force before 9 September 2017 which places new restrictions on exporting personal data from Japan. If a data controller inside Japan wishes to transfer personal data (including data that personally identifies an employee) to a separate legal entity outside Japan (including a group company), the data controller must (1) obtain the data subject's consent; or (2) fulfil the requirements under the pre-amendment Act and then, either (i) the foreign jurisdiction receiving the data must have a data protection regime that meets the standards set by the Japanese government; or (ii) the specific transferee upholds data protection standards set by the Japanese government.