Legal Counsel – Data Privacy & Cybersecurity

Legal Counsel – Data Privacy & Cybersecurity at Sony Group Corporation

Sony Group Corporation is seeking a data privacy and cybersecurity legal counsel to join its Legal & Compliance Division at the Minato-ku, Tokyo headquarters. With over 100 million PlayStation Network accounts and vast consumer data across music, film, and electronics, Sony requires world-class privacy and cybersecurity legal capabilities.

About the Role

You will be the primary legal adviser for Sony's compliance with the Act on the Protection of Personal Information (個人情報保護法 / APPI), including the 2022 amendments that strengthened individual rights, breach notification requirements, and cross-border data transfer restrictions. You will also advise on cybersecurity incident response, the Telecommunications Business Act (電気通信事業法), and global data protection frameworks including GDPR and CCPA as they affect Sony's Japanese operations.

Working from the Minato-ku headquarters, you will interface with Sony's global privacy team, engineering and product development teams, and the Personal Information Protection Commission (個人情報保護委員会 / PPC). This hybrid role allows for flexibility while maintaining close collaboration with business teams.

Focus Areas

• APPI (個人情報保護法) compliance programme management
• Cross-border data transfer mechanisms and adequacy assessments
• Cybersecurity incident response and breach notification
• Privacy impact assessments for new products and services
• Coordination with the PPC (個人情報保護委員会) and global privacy regulators

• Lead APPI compliance programme including privacy policies and consent mechanisms
• Advise on cross-border data transfers including supplementary measures
• Manage cybersecurity incident response from a legal perspective
• Conduct privacy impact assessments for new products, services, and features
• Coordinate with the PPC on regulatory inquiries and policy developments
• Draft and review data processing agreements and vendor contracts
• Deliver privacy and cybersecurity training to business units

• Registered bengoshi (弁護士) with the JFBA, or equivalent legal professional with deep privacy expertise
• 4-7 years of experience in data privacy, cybersecurity, or technology law
• Expert knowledge of APPI (個人情報保護法) including the 2022 amendments
• Familiarity with GDPR, CCPA, and international data protection frameworks
• Business-level English essential for global coordination
• IAPP certification (CIPP/A, CIPM, or CIPT) preferred
• Experience in the technology, gaming, or entertainment sector advantageous