APPI

Act on the Protection of Personal Information (Japan)

In force privacy

WhenIn effect since 1 April 2005

Who enforces itPersonal Information Protection Commission

Who it applies toBusinesses handling personal information in Japan.

Tell the regulatorReport reportable breaches (sensitive data, financial harm, improper purpose, over 1,000 perso… DPO requiredNo DPO requirement RegistrationNo general registration Transfers abroadTransfer abroad needs prior consent after information on the destination regime, an adequate c… Request deadlineRespond 'without delay'; no fixed number of days in the Act Maximum fineCriminal corporate fine up to JPY 100 million for violating PPC orders or unlawful database pr…

If you already comply with

86%

of Japan's 21 requirements are already met by European Union (GDPR). Here is what APPI adds, biggest gaps first.

RegistrationGovernanceGap

GDPR0 No general registration; controllers communicate DPO contact details to the supervisory authority.

APPI adds1 No general registration; businesses using the opt-out route for third-party provision must notify the PPC in advance. Art. 27(2) · source ↗

Tell peopleBreachesGap

GDPR2 Notify affected individuals without undue delay when the breach is likely to result in high risk.

APPI adds3 Notify affected individuals of reportable breaches, unless notification is difficult and alternative measures are taken. Art. 26(2) · source ↗

Criminal liabilityEnforcementGap

GDPR1 Member States set other penalties, including criminal penalties, for infringements not subject to administrative fines.

APPI adds2 Imprisonment up to 1 year for violating PPC orders or providing databases for illicit gain; corporate fines up to JPY 100 million. Arts. 178, 179, 184 · source ↗

Already covered by GDPR: Reach abroad, Lawful basis, Consent, Sensitive data, Children, Rights, Request deadline, Marketing, DPO required, DPO qualifications, DPIA, Records, Retention, Tell the regulator, Transfers abroad, Localization, Maximum fine, Private action.

A gap means APPI is more demanding than GDPR on that requirement, on our 0 to 3 scale (how we score). Read the cited section before acting. Not legal advice.

Regulations library

Every US state privacy law, on one map

24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.

Explore the map Follow Regulatory Watch

In force
Coming into force
Sector laws

AK ME VT NH WA ID MT ND MN IL WI MI NY RI MA OR NV WY SD IA IN OH PA NJ CT CA UT CO NE MO KY WV VA MD DE AZ NM KS AR TN NC SC DC OK LA MS AL GA HI TX FL