Data processing addendum (DPA)

Where a corporate customer uses Pulse, UNCHAIN, Inc. stands as the party entrusted with processing the personal data that the customer handles as a personal information handling business operator. This addendum sets out, in the form of contract provisions, both parties' rights and obligations in relation to that entrustment. It covers everything a customer needs in order to supervise its processor under Article 25 of the Act on the Protection of Personal Information (“the Act”).

---

[the customer's corporate name] (“the controller”) and UNCHAIN, Inc. (“the processor”) conclude this data processing addendum (“this addendum”) as follows, in relation to the controller entrusting the processing of personal data to the processor in connection with the controller's use of Pulse (“the service”).

#Chapter 1 General provisions

#Article 1 (Purpose and scope)

1. The purpose of this addendum is to set out the rights and obligations of the controller and the processor so as to ensure that personal data the controller has the processor handle in connection with use of the service is processed in compliance with the Act and other relevant legislation.

2. The parties confirm that the controller's provision of personal data to the processor, and the processor's handling of it, constitute provision in connection with entrustment under Article 27, paragraph 5, item 1 of the Act, and are not provision to a third party under paragraph 1 of that article.

3. This addendum forms part of the terms of service and the other contracts between the controller and the processor concerning provision of the service (“the contract”).

4. Where this addendum and the contract conflict on a matter concerning the processing of personal data, this addendum prevails. The contract applies to everything else.

5. This addendum applies to personal data the controller handles in the service as a personal information handling business operator. It does not apply to personal information the processor obtains for its own business and handles for purposes it determines itself (the names and contact details of the controller's staff, billing and invoicing information, information about service availability and the like), which is governed by the processor's privacy policy.

#Article 2 (Definitions)

In this addendum, the following words have the meanings given below. Words not defined here have the meanings given in the Act and in the contract.

1. Personal information means personal information as defined in Article 2, paragraph 1 of the Act: information about a living individual that can identify a specific individual by name or other description (including anything expressed by voice, movement or other means), including information that can readily be collated with other information and thereby identify a specific individual.

2. Personal data means personal data as defined in Article 16, paragraph 3 of the Act — that is, personal information constituting a personal information database.

3. Sensitive personal information means sensitive personal information as defined in Article 2, paragraph 3 of the Act: personal information including descriptions of the individual's race, creed, social status, medical history, criminal record, the fact of having suffered harm from a crime, or the other matters set out in Article 2 of the Enforcement Order.

4. Personal information handling business operator means a personal information handling business operator as defined in the Act.

5. Entrustment means entrusting all or part of the processing of personal data within the scope necessary to achieve the purpose of use, as referred to in Article 27, paragraph 5, item 1 of the Act.

6. Controller personal data means personal data the controller has the processor handle in connection with use of the service. Its specific categories, the categories of individuals, the purposes of processing and the duration of processing are set out in Schedule 1.

7. Sub-processor means a party to which the processor entrusts all or part of the processing of controller personal data, including any party to which a sub-processor in turn entrusts it (and so on down the chain).

8. Breach means leakage, loss or damage of controller personal data, including a situation where there is a risk that such a thing has occurred.

9. Security measures means the necessary and appropriate measures taken under Article 23 of the Act to prevent breaches and otherwise keep personal data secure.

10. Individual means a specific individual identified by controller personal data.

#Article 3 (What is entrusted)

1. The controller entrusts the processing of controller personal data to the processor to the extent needed for the controller to receive the service, and the processor accepts that entrustment.

2. The work entrusted, the categories of personal data processed, the categories of individuals, the purposes of processing and the duration of processing are as set out in Schedule 1.

3. In providing controller personal data to the processor, the controller warrants that it was obtained properly in accordance with the Act and other legislation, and that the processor's handling of it is within the scope necessary to achieve the purpose of use the controller has specified.

4. The controller is responsible for specifying, notifying or publishing the purpose of use and taking any other necessary steps, so that controller personal data is not processed beyond the purpose of use specified in advance.

5. The controller is responsible for telling participants that meetings are being recorded and transcribed, and for obtaining individuals' consent where sensitive personal information may be recorded.

Article 3, paragraphs 3 to 5 place responsibility for the lawfulness of acquisition and for dealings with individuals on the controller. How to think about telling participants, with sample wording, is set out in How far you can go with AI minutes (a guide for teams).

#Chapter 2 The processor's obligations

#Article 4 (Processing on the controller's instructions, and no use for other purposes)

1. The processor is to process controller personal data only within the scope set out in the contract, this addendum and Schedule 1, and in accordance with the controller's instructions, and must not process it beyond that.

2. The processor must not use controller personal data for any purpose other than performing the work entrusted. It is not to carry out processing beyond the scope of the entrustment, including analysis for its own business, producing statistics, or developing or improving AI models. Use for training AI models is dealt with in Article 14.

3. The contract and this addendum constitute the controller's general instructions to the processor concerning the processing of personal data. Individual instructions going beyond the contract and this addendum are to be in writing (including electromagnetic record; the same below), and the parties are to agree separately on who bears the cost of carrying them out.

4. Where the processor considers that an instruction from the controller would breach the Act or other legislation, it is to notify the controller without delay. In that case the processor may refuse to follow the instruction.

5. Where the processor is required by law to process controller personal data, it is to notify the controller in advance, unless the law prohibits it from doing so.

#Article 5 (Restriction on disclosure to third parties, and responding to legal demands)

1. The processor must not provide or disclose controller personal data to a third party without the controller's prior written consent, save for provision to sub-processors under Article 9 and as provided in the following paragraph.

2. The processor may disclose controller personal data, to the extent necessary, only where required by law or where it receives a lawful and valid demand from a court, an investigating authority or another competent public body.

3. Where the processor receives a demand under the preceding paragraph, it is to notify the controller before disclosing, so that the controller has the opportunity to object or take other steps, save where the law prohibits it or the matter is urgent.

4. So far as possible, the processor is to ask the party making such a demand to approach the controller directly.

5. The processor must not sell controller personal data under any guise.

#Article 6 (Security measures)

1. The processor is to take the necessary and appropriate measures under Article 23 of the Act to prevent breaches of controller personal data and otherwise keep it secure.

2. The measures in the preceding paragraph are as set out in Schedule 2, under the headings of organisational, personnel, physical and technical security measures and understanding the external environment, on the basis that a basic policy on the handling of personal data has been established and rules for its handling put in place.

3. The processor may change the security measures in line with technological developments, changes in the threat landscape and industry standards, provided the level of the measures after the change is not materially below the level before it.

4. Where the processor processes controller personal data in a foreign country, it is to understand that country's personal data protection regime and take the necessary and appropriate measures to keep the data secure. At the controller's request, the processor is to provide the controller with the name of that country, the name of the country the servers are in, and the measures taken in light of that understanding.

5. In using the service, the controller is responsible for taking appropriate measures in relation to managing account and API credentials, setting permissions within its own organisation, and administrators' sharing settings.

#Article 7 (Supervision of staff and confidentiality)

1. The processor is to exercise the necessary and appropriate supervision under Article 24 of the Act over staff who handle controller personal data.

2. The processor is to limit the staff who handle controller personal data to those who need to for their work, and to impose confidentiality obligations on them by agreement. Those obligations survive the end of their employment.

3. The processor is to provide training on the handling of personal data to staff who handle controller personal data, both when they start work and periodically.

4. The processor must not use the controller's confidential information and controller personal data that come to its knowledge under this addendum for any purpose other than that of this addendum, and must not disclose or leak them to third parties. This obligation survives the end of this addendum.

5. As regards information subject to the secrecy of communications that comes to the processor's knowledge in connection with those features of the service that carry exchanges between users, the processor and its staff will not obtain, use or disclose it, save where required by law or where there is other proper reason. This obligation continues both during and after employment.

Which features of the service fall within the Telecommunications Business Act depends on how they are built. UNCHAIN, Inc.'s current position, and whether registration is required, are set out in Our security arrangements.

#Article 8 (Creating and keeping records)

1. So that how controller personal data is processed can be established, the processor is to create and keep records of the following.

• Access to controller personal data (who accessed it, when, and what they did)
• The granting, changing and removal of permissions
• The copying, transfer and deletion of controller personal data
• The provision of controller personal data to sub-processors

2. The records in the preceding paragraph are kept for [ ] years. Where different kinds of record are kept for different periods, the period for each kind is set and notified to the controller on request.

3. At the controller's request, the processor is to provide the controller with a summary of the parts of those records relating to controller personal data, to a reasonable extent. This does not apply to parts whose provision would risk prejudicing the processor's own security.

4. Because the processing of controller personal data is entrustment under Article 27, paragraph 5, item 1 of the Act, no record of provision to a third party is created under Article 29. How a request for disclosure of records of provision to third parties is handled is set out in Article 11.

#Chapter 3 Sub-processing and provision to third parties in foreign countries

#Article 9 (Sub-processing)

1. The processor may sub-process all or part of the handling of controller personal data to a third party. The form of consent for sub-processing is to be one of the following, and the parties agree on execution which applies.

• Option A (individual consent) Before sub-processing, the processor is to notify the controller in writing of the sub-processor's name, the country it is in, the work to be sub-processed and the security measures the sub-processor will take, and to obtain the controller's written consent.
• Option B (general consent with prior notice) By executing this addendum, the controller consents in advance to sub-processing to the sub-processors listed in Schedule 3. Where the processor intends to add or change a sub-processor, it is to update Schedule 3 and notify the controller at least [ ] days before the change.

2. Where Option B applies, the controller may, within [ ] days of receiving notice, object in writing to the addition or change, giving reasonable grounds relating to the protection of personal data. Where no objection is made within that period, the controller is deemed to have consented.

3. Where the controller objects under the preceding paragraph, the processor is to consider the grounds and use commercially reasonable efforts to address the controller's concerns. Where the processor cannot offer an alternative sub-processor and the controller's concerns are not resolved, the controller may terminate the contract as regards the affected part of the service without paying any penalty.

4. The controller acknowledges that some sub-processors are essential to providing the service, and that objecting to the use of such a sub-processor may make all or part of the service unavailable.

5. The processor is to conclude a written contract with each sub-processor imposing on it obligations at least equivalent to the processor's obligations under this addendum. That contract is to include at least the following.

• A prohibition on processing beyond the scope of the work entrusted
• The security measures to be taken
• Supervision of staff and confidentiality
• Notification to the processor where a breach occurs
• The conditions for any further sub-processing
• Return or deletion on termination

6. The processor is to keep itself informed periodically of how sub-processors handle controller personal data, and to require corrective action where necessary.

7. The processor is liable to the controller for the acts and omissions of its sub-processors as though they were its own.

#Article 10 (Provision to third parties in foreign countries)

1. The parties confirm that Article 28, paragraph 1 of the Act applies to provision in connection with entrusting the processing of personal data, and that entrustment does not take a provision outside that article.

2. The processor may provide controller personal data to a sub-processor in a foreign country only where one of the following applies.

• Provision to a country with an equivalent regime The country is one designated by rules of the Personal Information Protection Commission as having a personal data protection regime recognised as being of a standard equivalent to Japan's.
• An adequate framework in place The sub-processor has in place a framework meeting the standards set by rules of the Personal Information Protection Commission.
• The individual's consent The controller has obtained the individual's prior consent to provision to a third party in a foreign country.

3. To ensure a framework meeting the standards in the preceding paragraph, the processor is to conclude a contract with each sub-processor in a foreign country ensuring the implementation of measures in line with the intent of Chapter 4, Section 2 of the Act.

4. So that the controller can meet its own obligations under Article 28 of the Act and explain matters to individuals, the processor is to provide the controller, on request and without delay, with information on the following.

• The name of the sub-processor in the foreign country
• The name of the foreign country it is in
• Whether that country has a personal data protection regime, and an outline of it (including whether it has any regime capable of significantly affecting individuals' rights and interests)
• The categories of controller personal data provided to that sub-processor, and how often
• An outline of the measures the sub-processor takes in line with the intent of Chapter 4, Section 2 of the Act (“equivalent measures”)
• The means by which the processor ensures the implementation of those equivalent measures
• How often and by what means the processor verifies this
• Where any impediment to the implementation of the equivalent measures arises, that fact and an outline of it

5. The processor is to verify, at least once a year, how sub-processors in foreign countries are implementing the equivalent measures and whether those countries have a personal data protection regime and what it contains.

6. Where that verification shows an impediment to the implementation of the equivalent measures, the processor is to take the necessary and appropriate measures and, where it becomes difficult to ensure their continued implementation, to stop providing controller personal data to that sub-processor. In that case the processor is to notify the controller without delay.

7. Where an individual asks the controller for information under Article 28, paragraph 3 of the Act, the processor is to provide the necessary information on the matters in paragraph 4 without delay, so that the controller can respond.

8. Where the controller chooses the route of the individual's consent under paragraph 2, the processor is to provide the controller with the matters it must give the individual when obtaining consent (the name of the destination country, information on that country's personal data protection regime, and information on the measures the sub-processor takes).

9. Where the processor adds or changes a sub-processor in a foreign country, it is to notify the controller of the matters in paragraph 4 in addition to following the procedure in Article 9.

The countries currently designated by rules of the Personal Information Protection Commission as having a personal data protection regime of a standard equivalent to Japan's are the European Union (excluding the United Kingdom) and the United Kingdom. Where controller personal data is provided to a sub-processor in any other country, either the adequate-framework route or the individual's consent under Article 10, paragraph 2 is required. Designations can change, so check what the Personal Information Protection Commission has published before executing this addendum.

Which suppliers in which countries controller personal data is actually provided to is set out in Schedule 3. The explanation for controllers is in the security and privacy FAQ, and the explanation for individuals is under “Provision to third parties in foreign countries” in the privacy policy.

#Chapter 4 Responding to individuals and to security breaches

#Article 11 (Responding to requests from individuals)

1. The controller is responsible for responding to requests from individuals under Articles 33 to 35 of the Act (requests for disclosure of retained personal data, for disclosure of records of provision to third parties, for correction, addition or deletion of content, and for cessation of use, erasure or cessation of provision to third parties; “access requests”), and to complaints about the handling of personal information (Article 40).

2. The processor is to assist the controller to a reasonable extent, on request, with extracting, copying, correcting, deleting and other work needed for the controller to respond to an access request. The processor is to endeavour to complete that assistance within [ ] business days of the controller's request.

3. Where the processor receives an access request or a complaint directly from an individual concerning controller personal data, it is not to respond itself but is to direct that individual to the controller and, unless the law prohibits it, to notify the controller without delay. This does not apply where the controller has instructed otherwise in writing or where the law requires the processor to respond.

4. Because the processing of controller personal data is entrustment and not provision to a third party, no record of provision to a third party is created under Article 29 of the Act. Where an individual requests disclosure of records of provision to third parties, the controller is to notify the individual without delay that no such record exists.

5. The processor provides a feature in the service for outputting notes, transcripts and other data containing controller personal data in electromagnetic form. The controller may use that feature to respond to a request for disclosure.

6. Where the assistance in paragraph 2 would involve excessive work for the processor, the parties are to discuss separately who bears the cost of it.

#Article 12 (Responding to a breach)

1. Where the processor learns that a breach of controller personal data has occurred or may have occurred, it is to notify the controller promptly, and in any event within [ ] hours of learning of it.

2. That notification is to include the following, so far as known at the time. Where anything is not yet known, the processor is to report further promptly once it is.

• An outline of the breach or suspected breach
• The categories of controller personal data affected or potentially affected
• The number of individuals whose controller personal data is affected or potentially affected
• The cause
• Whether there is secondary harm or a risk of it, and what it is
• What has been done for the individuals concerned
• What has been published
• Measures to prevent recurrence
• Any other relevant matters

3. The processor is to take the measures needed promptly to prevent the breach spreading, investigate the cause and restore the position, and is to report progress and the outcome to the controller.

4. Reporting to the Personal Information Protection Commission (both the preliminary and the final report) and notifying individuals in respect of controller personal data are for the controller to do. The processor's notification under paragraph 1 is made as a notification to the controller under the proviso to Article 26, paragraph 1 of the Act.

5. Notwithstanding the preceding paragraph, where the parties agree in writing, the processor may report to the Personal Information Protection Commission and notify individuals on the controller's behalf. In that case the processor is to obtain the controller's approval of the contents in advance.

6. The processor is to provide, without delay and on request, the information the controller needs in order to report to the Personal Information Protection Commission and notify individuals.

7. Where either party intends to make a breach public, it is to discuss the timing, content and manner of publication with the other party in advance, save where publication is required by law or the matter is urgent.

8. Notification, reporting and assistance under this article do not amount to an admission of responsibility by the processor for the incident.

#Chapter 5 Audit, restrictions on processing, and measures on termination

#Article 13 (Audit and reporting on processing)

1. So that the controller can supervise its processor under Article 25 of the Act, the processor is to provide, on request, information on how controller personal data is processed. That information includes how the security measures are implemented, the list of sub-processors and compliance with this addendum.

2. That information may be provided by any of the following means.

• Providing the information published in this help centre and in Our security arrangements
• Answering a security questionnaire produced by the processor
• Providing an assessment report or evidence of certification obtained by the processor from a third party

3. Where there is reasonable ground for saying that compliance with this addendum cannot be established from that information, the controller may, on prior written notice, carry out an audit of the processing of controller personal data.

4. Such an audit is to be carried out on the following conditions.

• Written notice to the processor at least [ ] days before it takes place
• No more than [ ] times a year, save where a breach has occurred or a serious breach of this addendum by the processor has been established
• During the processor's business hours
• Limited to matters relating to the processing of controller personal data
• With an auditor who is not a competitor of the processor
• With the auditor having concluded a confidentiality agreement with the processor
• Not covering other customers' information, the processor's trade secrets, or information whose disclosure would risk prejudicing security

5. The cost of an audit is borne by [the controller / the processor]. Where the audit establishes a serious breach of this addendum by the processor, however, the processor bears the cost.

6. The controller is to provide the results of the audit to the processor. The processor is to remedy any deficiency identified within a reasonable period.

#Article 14 (No training of AI models or other processing beyond what is entrusted)

1. The processor must not use controller personal data for the development, training, retraining or evaluation of AI models provided by the processor or by a third party.

2. Such processing goes beyond the scope of the work entrusted. For the processor to carry it out, the controller would have to specify a purpose of use and obtain individuals' consent, or the data would have to be processed into pseudonymously or anonymously processed information under the Act; neither is within the scope of this addendum.

3. Where the processor uses an inference service provided by an external supplier for transcription, summarisation or other generation, it is to provide in its contract with that supplier that data sent will not be used for any purpose other than generating the response, including the supplier's own machine learning.

4. At the controller's request, the processor is to explain whether such a contractual provision exists and outline it.

5. The controller is responsible for judging whether the summaries and other output the service generates are suitable for its intended use, and is to carry out the checks it needs before relying on that output.

Article 14, paragraphs 1 and 2 spell out what follows from the framework of entrustment quoted in Article 1, paragraph 2 and Article 4. Using meeting data received from a controller to train the processor's own AI models cannot be done within that framework. In addition, the alert on the use of generative AI services published by the Personal Information Protection Commission on 2 June 2023 asks businesses using generative AI to confirm that the use is within the scope necessary to achieve the specified purpose of use, and that the provider of the generative AI will not use personal data entered for machine learning; Article 14, paragraphs 3 and 4 correspond to that.

This article assumes a business plan (Team or Enterprise). On the free and personal plans, use for training is on by default and users can turn it off in settings themselves. How each plan is treated, and the steps for the setting, are set out in AI models and training data.

#Article 15 (Measures on termination)

1. After this addendum ends, the processor is to return controller personal data to the controller, or delete it, as the controller instructs. The controller is to instruct in writing which of the two applies within [ ] days of the date this addendum ends.

2. Where the controller does not instruct within that period, the processor is to delete the controller personal data.

3. The processor is to complete deletion under the preceding two paragraphs within [ ] days of the date this addendum ends. Controller personal data contained in backups is deleted progressively as the backup retention period expires, and deletion is complete no later than [ ] days after the date this addendum ends.

4. At the controller's request, the processor is to give the controller a written statement that deletion has been completed.

5. Notwithstanding the preceding paragraphs, information the law requires to be kept is retained for the period the law prescribes. In that case the processor is to notify the controller of the scope of the information retained, the legislation requiring it and the retention period, and to continue applying the security measures in this addendum to that information.

6. While using the service, the controller may also delete controller personal data using the service's features, or set a retention period for transcripts. The default retention setting is no automatic deletion, and applying a setting across a whole workspace is available on the Enterprise plan. How to configure it is set out in Automatic transcript deletion.

7. Where the controller requests return under paragraph 1 in a format or by a means other than the output features the service provides as standard, the parties are to discuss separately who bears the cost.

#Chapter 6 General provisions

#Article 16 (Damages and limitation of liability)

1. Where the controller or the processor causes loss to the other by breaching this addendum, it is liable to compensate that loss.

2. The damages the processor owes the controller are capped at the total service charges paid by the controller to the processor in the [ ] months preceding the event giving rise to the loss. That cap does not apply where the processor has acted intentionally or with gross negligence.

3. Where an individual or other third party makes a claim against the controller concerning controller personal data and the cause of that claim is the processor's breach of this addendum, the processor is to compensate the controller's loss within the limits of the preceding paragraph.

4. The controller is responsible for the lawfulness, accuracy and quality of the acquisition of controller personal data, and for the lawfulness of the instructions it gives the processor. Where loss is caused to the processor as a result, the controller is to compensate it.

5. Each party's liability under this addendum is limited to what arises from its own acts or omissions.

6. This article prevails over the limitation of liability provisions in the contract.

#Article 17 (Term and surviving provisions)

1. This addendum takes effect on the day the controller begins using the service under the contract, and remains in effect until the later of the day the contract ends and the day the processor ceases processing controller personal data.

2. After this addendum ends, Article 5 (restriction on disclosure to third parties, and responding to legal demands), Article 7, paragraphs 4 and 5 (confidentiality), Article 8 (creating and keeping records), Article 15 (measures on termination), Article 16 (damages and limitation of liability), Article 18 (governing law and jurisdiction) and this article continue in effect.

3. This addendum may be varied by written agreement of both parties. Variations necessary to reflect amendments to legislation or changes to guidance from the Personal Information Protection Commission may, however, be made by the processor notifying the controller of the changed contents and the effective date before that date arrives. Where the controller does not agree to such a variation, it may terminate the contract before the effective date.

#Article 18 (Governing law and jurisdiction)

1. The formation and effect of this addendum are governed by Japanese law.

2. The district court with jurisdiction over UNCHAIN, Inc.'s head office (Please contact us) is the exclusive court of agreed jurisdiction of first instance for disputes arising between the controller and the processor concerning this addendum.

#Article 19 (Notices and discussion)

1. Notices under this addendum are given by delivering a document, by email or by display within the service. A notice from the processor to the controller may be given to the contact details the controller has registered in the service.

2. Notices from the controller to the processor are to be addressed to privacy@the-unchain.com.

3. Matters not provided for in this addendum, and any doubt as to its interpretation, are to be resolved by discussion between the parties in good faith.

4. Even where part of this addendum is held void or unenforceable, the effect of the remaining provisions is unaffected. In that case the parties are to discuss how to achieve, in valid terms, what is closest to the intent of the void or unenforceable provision.

---

#Schedule 1 What is entrusted

This schedule sets out the categories of controller personal data, the categories of individuals, the purposes of processing and the duration of processing referred to in Article 2, item 6 and Article 3, paragraph 2.

#The work entrusted

In order to provide the service, the processor carries out the following processing of controller personal data.

• Acquisition (capturing meeting audio, receiving file uploads, synchronising calendar information)
• Storage, organisation and structuring
• Transcription, summarisation and other generation
• Search and display
• Correction, addition and deletion on the controller's instructions
• Encryption and other processing for security
• Output and transmission to external services on the controller's instructions
• Deletion

#Categories of personal data processed

#Categories of individuals

• The controller's officers and employees who use the service
• The controller's officers and employees who took part in a meeting recorded using the service
• The controller's clients, customers and other third parties who took part in a meeting recorded using the service, or who were mentioned during a meeting
• People named in files the controller has uploaded and in calendar information it has synchronised

#Purposes of processing

• Transcribing meeting audio and generating notes
• Storing, searching, sharing and exporting notes
• Referring to meeting content and generating responses through the chat feature
• Administering workspaces and controlling permissions
• Maintaining the availability of the service, responding to faults and detecting misuse
• Responding to enquiries from the controller

#Duration of processing

From the day the controller begins using the service until the day this addendum ends and the return or deletion under Article 15 is complete. Where the controller sets a retention period using the service's features, however, processing of the data concerned ends when that retention period expires.

#Handling of sensitive personal information

Controller personal data is not, as a rule, to contain sensitive personal information (Article 2, item 3). What is said in a meeting may, however, include a medical history, health check results, a disability, a creed, a criminal record or other sensitive personal information; obtaining individuals' consent to acquiring that is the controller's responsibility under Article 3, paragraph 5.

A breach of personal data containing sensitive personal information is reportable to the Personal Information Protection Commission regardless of how many individuals are involved (Enforcement Rule 7, quoted under Article 12). For practice where what is said in a meeting may include sensitive personal information, see Use in healthcare, finance and the professions.

---

#Schedule 2 Security measures

In respect of controller personal data, the processor establishes a basic policy on the handling of personal data, puts in place handling rules covering each stage from acquisition to deletion, and takes the following measures. Detailed access control settings, how unauthorised access is detected and other matters whose disclosure would risk prejudicing security are not set out in this schedule, and are dealt with through the audit in Article 13 or in answer to individual enquiries. The explanation of each measure for controllers is published in Our security arrangements.

#Organisational security measures

#Personnel security measures

#Physical security measures

#Technical security measures

#Understanding the external environment

---

#Schedule 3 List of sub-processors

The processor sub-processes all or part of the handling of controller personal data to the following suppliers.

The “equivalent measures” column states, where the sub-processor is in a foreign country, how implementation of measures in line with the intent of Chapter 4, Section 2 of the Act is ensured (the substance of the contract where it is by contract, or the name of the certification where it is under an international framework). Where the sub-processor is in Japan, state “not applicable — in Japan”.

---

#Related articles

For enquiries about this addendum, contact privacy@the-unchain.com.