[For Companies Expanding into Europe] Monolith Law Office Partners with Polish GDPR Authority 'GP Partners'

## A Powerful Alliance with a Global Authority on European Data Protection Rules

Monolith Law Office (Chiyoda-ku, Tokyo; Representative Lawyer: Kei Kawase), a firm specializing in IT, Internet, and cross-border legal affairs, has commenced a business partnership with 'GP Partners,' a law firm co-founded by Attorney Maciej Gawroński, who is globally recognized as an authority on GDPR (EU General Data Protection Regulation). This partnership eliminates the barriers of language and local legal interpretations that Japanese companies face when expanding into Europe, creating a system that allows them to complete high-level legal risk management in-house in Japan.

## The Threat of GDPR Extraterritorial Application and Massive Fines

With the development of internet infrastructure, establishing a global service platform from a base in Japan has become a common strategy for all types of businesses. However, one of the biggest hurdles facing management and legal departments of Japanese companies in this borderless business environment is compliance with GDPR. GDPR is extremely powerful, having extraterritorial application not only to companies with physical offices in the European Economic Area but also to Japanese domestic companies that provide services to and collect data from customers and users in Europe.

For example, if a Japanese B2B SaaS company processes customer data of European firms on the cloud, if a cross-border e-commerce site obtains browsing history of European consumers, or if a smartphone app collects location information from users in Europe, they are all subject to strict regulations without exception. Once a violation is identified, the company could be fined up to 4% of its total global annual turnover or 20 million euros, whichever is higher. There is no end to cases where massive fines are imposed for inappropriate data handling or inadequate privacy policies, making the lack of GDPR compliance a critical business risk that could shake the very foundation of a company's survival.

However, it is extremely difficult for Japanese companies to accurately grasp the latest local legal interpretations and actual operations. The task of pursuing the strict culture of privacy unique to Europe and the enforcement status by data protection authorities in each country in real-time, and applying it to one's own business model, exceeds what a single company's legal department can cover.

## Fusion of Europe's Top Expertise and Japanese IT Legal Affairs

In the past, when Japanese companies handled GDPR compliance, they typically used a multi-layered structure of requesting investigations from local law firms through domestic law firms. This process not only required a great deal of time for communication but also carried the structural risk of subtle nuances of legal interpretation being lost in the translation process, as well as incurring enormous costs.

To fundamentally solve these issues, our office has achieved a robust business partnership with GP Partners, a law firm based in Warsaw, Poland. Attorney Maciej Gawroński, a founding partner of the firm, is a leading expert active at the forefront of cloud computing and data protection in Europe, possessing deep insight into the movements of local law enforcement agencies and data protection authorities.

By closely and directly linking Monolith Law Office, which is well-versed in Japanese IT business and technology legal affairs, with GP Partners, which has the highest level of local expertise, we have completely eliminated the time lag and miscommunication caused by the multi-layered structure. Japanese companies can now directly enjoy high-quality and practical legal support that clears the strict standards of local Europe simply by communicating with our lawyers in Japanese. Being able to quickly grasp how a company's issues are evaluated within the framework of GDPR through the lens of a local authority brings immeasurable value to management decision-making.

## Practical GDPR Compliance Support Services Based on Local Interpretation

The GDPR compliance support services provided through this partnership offer comprehensive assistance ranging from abstract legal explanations to concrete practical responses according to the company's business situation. While the major practical issues requiring attention are numerous, our office provides precise solutions based on local legal interpretations.

In practical matters involving the transfer of personal information from Europe to outside the region, including Japan, the conclusion of standard contractual clauses and the implementation of transfer impact assessments are mandatory procedures. These procedures require high expertise in comparing the legal systems of the country of data destination with European standards, but our partnership structure supports the construction of a safe and reliable data transfer scheme. Furthermore, regarding the drafting of privacy policies that meet the strict transparency requirements demanded by GDPR, we act as a proxy for drafting and revising them in both Japanese and English, compliant with the latest local guidelines.

Moreover, for the Data Protection Officer (DPO), which is mandatory to appoint depending on the company scale and the nature of the data handled, we support the accurate judgment of whether a company is required to appoint one and the actual appointment procedures locally in Europe. In addition, we fully back the construction of an internal system that requires complex and specialized knowledge, such as the creation and review of 'records of processing activities' that comprehensively record what purposes a company handles personal information for and how. These cannot be handled by simple literal translation of provisions; living information about what interpretation local supervisory authorities are actually applying in practice is indispensable. Through this partnership, we realize the construction of an unshakable compliance system backed by local authorities.

## Supporting Japanese Companies' Global Challenges from a Legal Perspective

As a law firm with high expertise in both IT and law, Monolith Law Office has supported the business model legality audits and system development legal affairs of numerous companies. This partnership with GP Partners is a significant milestone for supporting the safe overseas expansion of Japanese companies and directly contributing to strengthening their competitiveness in the global market.

With the evolution of technology and the development of a data-driven economy, legal regulations concerning the cross-border transfer of data are expected to become even more complex in the future. By making maximum use of our international legal network, we will continue to provide the latest and most optimal solutions for the ever-changing European data protection regulations, thereby powerfully supporting the innovative challenges of Japanese companies. We believe that it is our mission to provide an environment where companies considering expansion into the European market or those concerned about their current data management systems can concentrate on the growth of their own businesses.