The Act on the Protection of Personal Information (Act No. 57 of 2003) (APPI) did not originally restrict the transfer of personal information to foreign countries, but amendments enacted in 2015 and which took effect in May 2017 added restrictions on cross-border data flows. The amended APPI prescribes three types of legitimate transfers of personal information to a third party in a foreign country under Article 24: (1) transfers to a country that the Personal Information Protection Commission (PPC) has designated as having an acceptable level of data protection; (2) transfers to a third party in a foreign country in circumstances in which actions have been taken to ensure the same level of data protection as in Japan (such as entering into a data transfer agreement imposing obligations on the transferee meeting the requirements of the APPI); or (3) transfers with the data subject’s consent.
Under the Enforcement Rules for the APPI (promulgated in 2016), as for (2), Art. 11 specifies that it means: "(i) a personal information handling business operator and a person who receives the provision of personal data have ensured in relation to the handling of personal data by the person who receives the provision the implementation of measures in line with the purport of the provisions under Chapter IV, Section 1 of the Act by an appropriate and reasonable method or (ii) a person who receives the provision of personal data has obtained a recognition based on an international framework concerning the handling of personal information." To date, the only PPC-recognised international framework is the APEC Cross-Border Privacy Rules System.

Japan has joined agreements with binding commitments to open transfers of data across borders: the Comprehensive and Progressive Agreement for Trans-Pacific Partnership (CPTPP, Art. 14.11), the Agreement Between The United States Of America And Japan Concerning Digital Trade (Art. 11), and the Agreement between the United Kingdom of Great Britain and Northern Ireland and Japan for a Comprehensive Economic Partnership (Art 8.84).

The Act on the Protection of Personal Information (Act No. 57 of 2003) (APPI), enacted in 2003 and last amended in 2022, is Japan's data protection regime. The Amendment Bill of the Act on the Protection of Personal Information was approved by the Diet in June 2020 and entered into effect on 1 April 2022.
In addition to the APPI, the Personal Information Protection Commission (PPC) issued general guidelines, guidelines on data transfer to a third party in a foreign country, guidelines on confirmation and records for providing to a third party, and guidelines on anonymously processed information. Furthermore, the Guideline on Personal Information Protection in Telecommunications Business issued by the Ministry of Internal Affairs and Communications, genetic information guidelines issued by the Ministry of Economy, Trade and Industry, financial affairs guidelines jointly issued by the PPC and the Financial Services Agency, medical care guidelines jointly issued by the PPC and the Ministry of Health, Labour and Welfare are also relevant.

Companies are required to retain their records by the following laws:
- The Consumption Tax Act (Act No. 108 of 1988) business operators and special importers to retain consumption tax-related books and records, such as those related to asset transfers or the purchase and collection of taxable goods, for seven years after the year in which they complete the records (Art. 58.1);
- The Corporation Tax Act (Act No. 34 of March 31, 1965): books, records, and documents for seven years (Art. 126.1);
- The Companies Act (Act No. 86 of July 26, 2005): shareholder meeting minutes for ten years (Art. 318.2), account books and important business materials for ten years (Art. 432.2), and financial statements, business reports, and supplementary schedules used to prepare financial statements for ten years (Art. 435.4).

Japan has ratified the World Intellectual Property Organization (WIPO) Performances and Phonograms Treaty.

Japan is a signatory of the World Trade Organization (WTO) Information Technology Agreement (ITA) of 1996 and its 2015 expansion (ITA II).

In September 2009, the Japanese authorities imposed a definitive antidumping duty on imports of electrolytic manganese dioxide (HS 282010) (a component of the battery cathode mix in alkaline and lithium-ion batteries) from China. This measure was first reviewed and extended in March 2014 and, subsequently, in March 2019. The rate of duty imposed on imports originating in China ranges from 34.3% to 46.5%, depending on the company. In March 2023, the Japanese authorities announced the initiation of a sunset review of the definitive duty imposed on imports of the subject merchandise from China. This follows the application filed on January 2023 by Tosoh Hyuga Corporation and Tosoh Corporation.

The Japanese government maintains policies to encourage the participation of small and medium-sized enterprises (SMEs) in government procurement. According to Arts. 4 and 5 of Act No. 97, the central government and public corporations are required to set their own procurement target values for the procurement from SMEs on an annual basis. It has been reported that in 2021, the target amount for the procurement from micro, small, and medium-sized enterprises (MSMEs) by the Government was set at JPY 4.8 trillion (approx. USD 31 billion), which represents 61% of the total budget for public procurement spending. Furthermore, the target amount for new MSMEs that are less than 10 years old was set at 3%. In accordance with Art. 8, sub-central government entities follow the policies set up for the central government entities on an "endeavour basis".

According to Art. 19 of the Act on Promotion of Securing Quality of Public Works (Act No. 18 of 2005), government entities are permitted to adjust a target price based on the evaluation of technical proposals, particularly when novel technologies and innovations are introduced.

It is reported that the principle of non-discrimination is upheld in all procurement activities, except for preferences granted under Regional Trade Agreements (RTAs), of which Japan is a party. Currently, there are no active RTAs that grant treatment to suppliers from non-GPA (Agreement on Government Procurement) parties more favourably than suppliers from GPA parties. Suppliers from non-GPA parties are not excluded from participating in GPA-covered procurement. However, concerns have emerged over the limited participation of foreign companies in government procurement, which seems partly due to non-regulatory barriers, geographical distance from some overseas markets, and a lack of familiarity with the local market. Foreign industries have also raised issues about Japan's use of technical specifications in public procurement, claiming that these specifications have been employed to exclude certain foreign products and services.

Although the Japan Union is a signatory to the WTO Government Procurement Agreement (GPA), its coverage schedules do not include telecommunications-related services (CPC 754) and only partially cover telecommunications services (CPC 752), which are important service sectors for digital trade.

According to Arts. 4 and 6 of Act No. 85 of 1984, foreigners' aggregate ownership cannot exceed one-third of the aggregate voting rights of Nippon Telegraph and Telephone Corporation (NTT), which holds all the issued shares of NTT-East and NTT-West.

Under the Companies Act (Act No. 86 of 2005) and the Ordinance for Enforcement of the Companies Act (Ordinance of the Ministry of Justice No. 12 of 2006), residency requirements are imposed on the members of the board of directors of joint-stock corporations (Kabushiki Kaisha), which are considered the predominant entities in Japan. Specifically, at least one director and one executive officer with the right of representation must maintain an address and reside in Japan. This regulation pertains to joint-stock companies.

Japan has implemented foreign direct investment (FDI) screening mechanisms through the Foreign Exchange and Foreign Trade Act (Act No. 228 of 1949), supplemented by procedural regulations such as the Cabinet Order on Inward Direct Investment. Under this Act, foreign investors in "Designated Business Sectors" or "Core Business Sectors" are required to submit a prior notification to the relevant ministry. After reviewing the notification, the ministry may either approve, amend, or suspend the proposed investment.
According to the Cabinet Order on Inward Direct Investment, "Core Business Sectors" include industries where foreign investors (e.g., non-residents or foreign corporations) must file prior notification for direct investment, such as acquiring 1% or more of voting rights in a listed company or purchasing shares in an unlisted company. These sectors, considered highly sensitive, are generally not exempt from prior notification requirements due to national security concerns.
The List of Classifications of Listed Companies outlines core business sectors such as semiconductors and dual-use technologies, metal mining of significant mineral resources, cybersecurity-related services (e.g., network security monitoring and critical infrastructure protection), and telecommunications. Non-core business sectors include software, data processing services, and internet-use support businesses.