PRIVACY · JAPAN

Japan (APPI): The Cloud Exception

For clients in Japan, we operate under the framework of the Act on the Protection of Personal Information (APPI). The most relevant concept for our partnership is the “Cloud Exception.”

Why we are not “handling” your data

Under our service model, we are not considered to be “handling” your personal data under APPI. This is because two key conditions are met:

Our contract clearly states that we do not access or handle the personal data stored on your servers.
We implement strict access controls — our team has no direct access to your Virtual Machines (VMs) or the data within them.

Compliance benefits for you

No “third-party provision” consent required. Because we are not handling the data, you — as the data controller — do not need to obtain individual consent from data subjects to use our services.

Reduced supervisory obligations. As we are not handling the data, you are not required to supervise us as a data processor under the APPI.

Clarity for cross-border data. Because you retain complete control over your VMs, the regulatory requirements for cross-border data transfers become less complex.

Control stays with you

We handle the physical engineering and maintenance of your infrastructure, but you maintain complete, unmediated control of your VMs and data. This is the same principle we apply across every engagement — you own the infrastructure, and our access model is built so that no Vavelio engineer can reach your data without your explicit authorisation.

Learn more about our air-gapped environments and client independence.

This page describes how Vavelio’s service model relates to the APPI as we understand it. It is provided for information and is not legal advice. Clients should seek qualified counsel for their specific circumstances.

Last updated: August 2026

Loading…