APPI Article 27: provision of personal data to a third party needs prior consent (Act on the Protection of Personal Information, Art. 27(1) and (5))
Giving personal data to another company needs the person's prior consent unless a listed exception applies. A recipient is not a third party only when it is an entrusted processor working within the purpose of use, a successor to the business, or a joint user named in advance (Art. 27(5)); a US buyer that trains its own model fits none of these (my reading).
Dated 18 Oct 2026Source checked 18 Oct 2026Basis: primary text
In the source's own words
“Businesses handling personal information must not provide personal data to a third party without obtaining the identifiable person's consent in advance, except cases set forth below”
Where it was read
Also read from the same source
- APPI Article 28(1): provision to a third party in a foreign country needs consent unless an exception applies (Act on the Protection of Personal Information, Art. 28(1))
- APPI Article 43(4): duties when providing anonymised personal information to a third party (Act on the Protection of Personal Information, Art. 43(4))
Figures it counts in
It is shown on its own, not counted into a figure.
Cited in this guide