On January 24, 2024, the Personal Information Protection Commission (PPC) announced that it had issued a notice regarding safety management measures related to the handling of personal data in call center operations, points to be noted regarding the supervision of employees and the supervision of subcontractors. 

In particular, the PPC stated that:

• regarding safety management measures, Article 23 of the Act on the Protection of Personal Information (Act No. 57 of 2003 as amended in 2020) (APPI) must be considered and businesses handling personal information shall be responsible for preventing the leakage, etc. of the personal data they handle, and for other individuals. Further, necessary and appropriate measures must be taken for data security management;
• regarding the supervision of employees, the PPC highlighted Article 24 of the APPI and stated that when a business entity handling personal information has its employees handle personal data, it must provide necessary and appropriate supervision over the employees to ensure the safe management of the personal data as call centers involve the handling of a large amount of personal data; and
• regarding the supervision of data that is outsourced, the business must consider Article 25 of the APPI and ensure the safe management of personal data and supervise the outsourcing company to ensure that it takes the same safety control measures. 

You can read the notice, only available in Japanese, here.