Regulations › Rest of world › Japan
APPI
Act on the Protection of Personal Information (Japan)
WhenIn effect since 1 April 2005
Who enforces itPersonal Information Protection Commission
Who it applies toBusinesses handling personal information in Japan.
Tell the regulatorReport reportable breaches (sensitive data, financial harm, improper purpose, over 1,000 perso…
DPO requiredNo DPO requirement
RegistrationNo general registration
Transfers abroadTransfer abroad needs prior consent after information on the destination regime, an adequate c…
Request deadlineRespond 'without delay'; no fixed number of days in the Act
Maximum fineCriminal corporate fine up to JPY 100 million for violating PPC orders or unlawful database pr…
Every requirement we score, with the rule in plain words and the section it comes from. Darker means more demanding. See every law side by side →
Reach and lawful basis
Reach abroad
2
Applies to foreign businesses handling personal information of people in Japan in connection with supplying goods or services to them.Art. 171 · source ↗
Official English text could not be fetched this session (tool block); article number from the consolidated official translation, not re-verified.
Lawful basis
1
No list of lawful bases; purpose must be specified and notified, and consent is needed for use beyond purpose and for most third-party provision.Arts. 17, 18, 21, 27 · source ↗
Official English text could not be fetched this session (tool block); article number from the consolidated official translation, not re-verified. Scored 1: purpose-based model, closer to legitimate-interest flexibility than consent-default. Act No. 56 of 2026 (promulgated 17 Jul 2026) amends the APPI; main reforms take effect by Cabinet Order no later than 17 Jul 2028. It broadens consent exceptions (contract necessity).
Consent
1
Prior consent required for out-of-purpose use, third-party provision and foreign transfers; form not prescribed, implied consent not generally accepted by PPC guidance.Arts. 18(1), 27(1), 28(1) · source ↗
Official English text could not be fetched this session (tool block); article number from the consolidated official translation, not re-verified.
Sensitive data
2
Special care-required information (race, creed, medical history, criminal record, etc.) needs prior consent to acquire and cannot be shared by opt-out.Arts. 2(3), 20(2), 27(2) · source ↗
Official English text could not be fetched this session (tool block); article number from the consolidated official translation, not re-verified. Amendment adds 'specified biometric personal information' (Art. 16(5)) when in force.
Children
1
No statutory age today; PPC Q&A treats roughly 12-15 as needing a guardian. Amendment sets under 16 for guardian consent once in force.Art. 40-2 (as amended by Act No. 56 of 2026, not yet in force) · secondary source · source ↗
Scored on the law in force on 18 Oct 2026 (guidance only). Will rise to level 2 when Art. 40-2 commences (by 17 Jul 2028).
People's rights
Rights
2
Disclosure (access), correction/deletion, cessation of use or erasure, cessation of third-party provision, and disclosure of third-party provision records.Arts. 33, 34, 35 · source ↗
Official English text could not be fetched this session (tool block); article number from the consolidated official translation, not re-verified. Counted: access, correction, deletion, objection (cessation), restriction-like cessation of provision = 5. No portability or automated-decision right.
Request deadline
0
Respond 'without delay'; no fixed number of days in the Act.Arts. 33(2), 34(2), 35(3) · source ↗
Official English text could not be fetched this session (tool block); article number from the consolidated official translation, not re-verified.
Marketing
2
Marketing email requires prior opt-in consent under the Act on Regulation of Transmission of Specified Electronic Mail.Specified Electronic Mail Act Art. 3 · secondary source · source ↗
Sector law outside APPI; article number from memory, not verified this session.
Governance
DPO required
0
No DPO requirement; controllers must take necessary security control measures, including organizational measures.Art. 23 · source ↗
Official English text could not be fetched this session (tool block); article number from the consolidated official translation, not re-verified.
DPO qualifications
–
Not addressedNone · source ↗
Official English text could not be fetched this session (tool block); article number from the consolidated official translation, not re-verified.
Registration
1
No general registration; businesses using the opt-out route for third-party provision must notify the PPC in advance.Art. 27(2) · source ↗
Official English text could not be fetched this session (tool block); article number from the consolidated official translation, not re-verified.
DPIA
1
Not required by statute; PPC encourages PIAs. Amendment discussions covered PIAs but the in-force law has no duty.None (PPC guidance) · secondary source · source ↗
No statutory DPIA duty confirmed in the Act in force.
Records
1
Records required only for providing personal data to, or receiving it from, third parties.Arts. 29, 30 · source ↗
Official English text could not be fetched this session (tool block); article number from the consolidated official translation, not re-verified.
Retention
1
Businesses must endeavor to delete personal data without delay once it is no longer needed.Art. 22 · source ↗
Official English text could not be fetched this session (tool block); article number from the consolidated official translation, not re-verified. Effort obligation only.
Breaches
Tell the regulator
2
Report reportable breaches (sensitive data, financial harm, improper purpose, over 1,000 persons) promptly (3-5 days guidance), final report within 30 days, 60 if malicious.Art. 26(1); PPC Enforcement Rules Arts. 7-8 · secondary source · source ↗
Article numbers from official text not re-verified this session. Deadlines confirmed via IAPP summary of PPC guidelines.
Tell people
3
Notify affected individuals of reportable breaches, unless notification is difficult and alternative measures are taken.Art. 26(2) · secondary source · source ↗
Scored 3 because notice is mandatory for all reportable breaches. Amendment will allow PPC low-risk exemptions.
Transfers
Transfers abroad
2
Transfer abroad needs prior consent after information on the destination regime, an adequate country (EU/UK), or a recipient with equivalent systems.Art. 28 · source ↗
Official English text could not be fetched this session (tool block); article number from the consolidated official translation, not re-verified.
Enforcement
Maximum fine
2
Criminal corporate fine up to JPY 100 million for violating PPC orders or unlawful database provision. Amendment adds revenue-linked administrative surcharges.Arts. 178, 179, 184 · source ↗
Official English text could not be fetched this session (tool block); article number from the consolidated official translation, not re-verified. JPY 100m is about USD 0.7m. Surcharge (Art. 148-3, amended) not yet in force; amount equals consideration received.
Criminal liability
2
Imprisonment up to 1 year for violating PPC orders or providing databases for illicit gain; corporate fines up to JPY 100 million.Arts. 178, 179, 184 · source ↗
Official English text could not be fetched this session (tool block); article number from the consolidated official translation, not re-verified. Amendment adds improper-acquisition offenses effective 17 Jan 2027.
Private action
2
Individuals may sue to compel disclosure, correction or cessation, and claim tort damages under the Civil Code.Art. 39; Civil Code Art. 709 · source ↗
Official English text could not be fetched this session (tool block); article number from the consolidated official translation, not re-verified.
Scores are our reading on the published rubric, checked 18 October 2026. Not legal advice.
Regulations library
Every US state privacy law, on one map
24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.
- In force
- Coming into force
- Sector laws