Japan APPI — Act on the Protection of Personal Information
- ClassificationCategoryData Protection & PrivacyDomainPrivacyFramework FamilyGlobal Privacy Regulations
- Regulatory ContextTypeRegulationLegal InstrumentActSectorCross-SectorIndustryCross-Industry
- Region / PublisherRegionAsia-PacificRegion DetailJapanPublisherNational Diet of Japan (enacting body); enforced by the Personal Information Protection Commission (PPC)
- VersioningVersionAct No. 57 of 2003 as amended through Act No. 37 of 2021 (current text in force April 1, 2023); amending Act promulgated July 17, 2026, not yet in forceEffective DateFully enforced 2005; current amended text in force April 1, 2023; 2026 amendments phased in from 2027 to 2028 at the latestIssue DateMay 30, 2003 (Act No. 57); amending Act promulgated July 17, 2026
- AdoptionAdoption ModelRegulatory ComplianceImplementation ComplexityHigh
- Official ReferenceOpen Link in New TabSource
License included / downloadable: Yes
The APPI is Japanese national legislation. The PPC and the Ministry of Justice publish official English translations free of charge for reference only; only the Japanese text has legal effect. The platform links to the PPC's page.
Framework text is licensed by its publisher and is included only where stated above.
- The APPI (Act No. 57 of 2003) is Japan's national data protection law, enforced by the Personal Information Protection Commission.
- It binds every business using a personal information database and applies to foreign businesses supplying goods or services to people in Japan.
- The 2020 amendment, in force April 1, 2022, added mandatory breach reporting, pseudonymized information, and stricter foreign transfer rules.
- The current text has been fully in force since April 1, 2023, after the 2021 amendment merged public-sector rules into the Act.
- A further amending Act promulgated July 17, 2026 adds administrative surcharges, higher criminal penalties, and rules for children under 16; it is not in force.
Overview
The Act on the Protection of Personal Information (APPI, Act No. 57 of 2003) is Japan's national data protection law. The National Diet enacted it on 30 May 2003 and it has been fully in force since 2005; it binds every business that uses a personal information database for business (Article 16(2)), applies to foreign businesses that supply goods or services to people in Japan (Article 171), and is enforced by the Personal Information Protection Commission (PPC). Since the 2021 amendment it also governs public bodies, and the current text has been fully in force since 1 April 2023.
The Act has been amended in rounds. The 2015 amendment, in force on 30 May 2017, created the PPC (established 1 January 2016) and the rules on sensitive information and anonymized data; the 2020 amendment (Act No. 44 of 2020), in force on 1 April 2022, added mandatory breach reporting (Article 26), pseudonymized personal information (Article 41), stricter foreign transfer rules (Article 28) and extraterritorial scope; and the 2021 amendment (Act No. 37 of 2021) merged the public-sector rules into the Act. On 10 July 2026 the Diet passed a further amending Act, promulgated on 17 July 2026, which is not yet in force.
The 2026 Act adds an administrative surcharge system, higher criminal penalties, a statistics and AI-development consent exemption, rules for children under 16 and for facial feature data, and relaxes notification of individuals after a breach. Its penal provisions take effect six months after promulgation and the remainder by Cabinet Order no later than two years after it, so organizations should keep the current obligations in force and plan for the new ones.
Why does it matter?
The APPI is the legal basis for handling personal data about people in Japan, and it reaches foreign businesses: Article 171 applies the Act where a business handles information about a person in Japan while supplying goods or services to them. The PPC supervises both private and public bodies, and orders and criminal penalties back the duties.
Key benefits include:
- Consent and purpose control
Articles 17 and 18 require a specified purpose of use and consent before handling data beyond it; Article 20(2) requires consent to acquire sensitive personal information.
- A fixed breach clock
Article 26 and the PPC rules require a report to the PPC for defined events: a preliminary report within 3 to 5 days of discovery and a final report within 30 days, or 60 days if an unlawful purpose is suspected.
- Controls on third-party and foreign transfers
Articles 27 to 30 require consent or a statutory exception for third-party provision, records of provision, and extra information or equivalent measures for transfers abroad (Article 28).
- Data subject rights
Articles 33 to 35 let individuals request disclosure, correction and the cessation of use or deletion of personal data a business holds.
- Enforcement with penalties
Under Article 148 the PPC can recommend and order, and breach of an order carries up to one year or a fine of up to 1 million yen under Article 178, with fines up to 100 million yen for the corporation under Article 184.
How does it work?
The APPI regulates a business through the life of personal information. A business specifies the purpose of use (Article 17), notifies or publishes it at acquisition (Article 21), keeps data accurate and deletes it when no longer needed (Article 22), takes security management measures (Article 23), supervises employees and entrusted persons (Articles 24 and 25), and reports qualifying leaks (Article 26).
Provision to third parties needs the person's consent in advance (Article 27(1)) unless an exception applies, such as a legal requirement or protection of life. An opt-out route exists with advance notice to the person and a filing with the PPC (Article 27(2)), but not for sensitive information. Entrusting processing, mergers and joint use are not third-party provision (Article 27(5)). Foreign transfers add Article 28, which exempts countries the PPC recognizes as equivalent, and records are kept under Articles 29 and 30.
The PPC supervises through reports and on-site inspections (Article 146), guidance (Article 147), recommendations and orders (Article 148), and publication of non-compliance with an order. The PPC's guidelines, Cabinet Order and enforcement rules fill in detail; the Supplementary Rules cover data transferred from the EU and the UK under an adequacy decision.
Key Elements
- Purpose of use (Articles 17 to 18)
Specify the purpose as far as possible; do not change it beyond a reasonably linked range; consent is needed for use beyond it.
- Sensitive personal information (Articles 2(3) and 20(2))
Race, creed, social status, medical history, criminal record, damage by crime and items set by Cabinet Order; consent needed to acquire.
- Security and supervision (Articles 23 to 25)
Necessary and appropriate security management, employee supervision and supervision of entrusted persons.
- Breach reporting (Article 26)
Report events likely to harm individuals' rights to the PPC and notify the individual.
- Third-party and foreign provision (Articles 27 to 31)
Consent, opt-out with PPC filing, entrustment and joint use, foreign transfer information duties (Article 28), records and confirmation (Articles 29 and 30).
- Individual rights and processed data (Articles 33 to 35, 41 to 46)
Disclosure, correction and cessation requests; rules for pseudonymized personal information (Article 41) and anonymized personal information (Articles 43 to 46).
What does it cover?
The APPI applies to businesses that use a personal information database for business, in Japan and, under Article 171, abroad when they handle information about a person in Japan in connection with supplying goods or services to that person. Public bodies (national government organs, local governments, incorporated administrative agencies) are covered by Chapter V. The PPC (a chairperson and eight commissioners, appointed with the Diet's consent) supervises both sectors, and for some sectors it delegates supervisory powers to ministers such as the Financial Services Agency under Article 150.
What are its objectives?
Article 1 states the Act's purpose: to protect individuals' rights and interests while giving due consideration to the value of personal information and its contribution to new industries, by setting basic principles, a governmental basic policy, business obligations and the PPC.
Require each business to specify and respect a purpose of use for personal information (Articles 17 and 18).
Protect sensitive personal information and require proper acquisition (Articles 19 and 20).
Make businesses secure personal data and report leaks to the PPC and affected persons (Articles 23 to 26).
Control provision to third parties, including those in foreign countries (Articles 27 to 31).
Give individuals rights to disclosure, correction and cessation of use (Articles 33 to 35), and enforce through the PPC's orders and penal provisions.
Framework in Context
The APPI is a general law: sector regulators issue their own guidance on top of it. It is commonly compared to the EU GDPR, and the PPC's Supplementary Rules apply to data transferred from the EU and UK under adequacy decisions. Japan also takes part in the APEC Cross-Border Privacy Rules system, which the PPC promotes. The PPC's guidelines (general rules, pseudonymized and anonymized information, provision to third parties, third parties in foreign countries and accredited organizations) interpret the Act, and the 2026 amendments will change Cabinet Orders, rules and guidelines over the next two years.
Common Framework Mappings
Organizations map the APPI to the frameworks below so purpose, transfer and breach controls serve Japanese law and other privacy regimes.
Mapped frameworks include:
APEC PF
CCPA/CPRA
GDPR
ISO 27701
NIST Privacy Framework v1.0
PIPEDA
How SmartSuite Supports the APPI
SmartSuite provides the system for managing controls, evidence, mappings, assessments, and reporting.
Use Privacy Management to hold the APPI's duties as requirements and records: a data inventory that flags sensitive personal information, purpose-of-use records, third-party and foreign provision logs, data subject requests with response deadlines, and a breach record with the PPC reporting clocks, with owners and evidence for each Article.
Purpose of Use Register
Record each purpose specified under Article 17, the data it covers, the notice given under Article 21 and any change made within the reasonably linked range.
Personal Data Inventory and Sensitive Data Flags
Map personal data, systems and owners, and flag sensitive personal information that needs consent under Article 20(2).
Third-Party and Foreign Provision Log
Log each provision under Articles 27 and 28 with the consent or exception relied on, the recipient country and the Article 29 and 30 records.
Individual Request Handling
Track disclosure, correction and cessation requests under Articles 33 to 35 with the handling steps, deadlines and responses.
Breach Reporting Tracker
Run the Article 26 incident record with discovery date, the 3 to 5 day preliminary and 30 or 60 day final report deadlines, and notice to individuals.
Entrusted Processor Oversight
Track entrusted processors in Third Party Risk Management with the Article 25 supervision, contract terms and review evidence.
Related frameworks
The APEC Privacy Framework (2015) sets nine information privacy principles that APEC economies use to protect personal information while keeping data flowing across the region.
The CCPA, as amended by the CPRA, gives California residents rights to know, delete, correct and opt out, and is enforced by the California Privacy Protection Agency.
The GDPR (Regulation (EU) 2016/679) sets principles, lawful bases, individual rights and accountability duties for personal data, with fines up to EUR 20 million or 4 percent of turnover.
ISO/IEC 27701:2025 specifies requirements for a stand-alone privacy information management system (PIMS) for PII controllers and processors, replacing the 2019 edition.
Frequently Asked Questions For Japan APPI (Act on the Protection of Personal Information)
The Act on the Protection of Personal Information (Act No. 57 of 2003) is Japan's general data protection law. It applies to businesses that use a personal information database for business (Article 16(2)) and to public bodies, and the Personal Information Protection Commission supervises it through reports, inspections, guidance, recommendations and orders (Articles 146 to 148).
Article 26 requires a report to the PPC for events the rules prescribe: leaks involving sensitive personal information, risk of financial loss, suspected unlawful purpose such as an attack, or more than 1,000 data subjects. The PPC asks for a preliminary report within 3 to 5 days of discovery and a final report within 30 days, or 60 days where an unlawful purpose is suspected. The individual must also be notified.
Article 27(1) requires the person's prior consent unless an exception applies, with an opt-out route that needs advance notice and a filing with the PPC (Article 27(2)). For a recipient in a foreign country, Article 28 requires consent after the person is given information about that country's system, unless the country is one the PPC has recognized as equivalent or the recipient has a system meeting PPC standards for equivalent measures. Records of provision are kept under Articles 29 and 30.
Yes. Article 171 applies the Act where a business handles information that identifies a person in Japan, abroad, in connection with supplying goods or services to that person. The PPC can also share information with foreign enforcement authorities under Article 172.
The Act amending the APPI, passed by the Diet on 10 July 2026 and promulgated on 17 July 2026, introduces administrative surcharges (Articles 148-3 to 148-17), higher criminal penalties, a consent exemption for statistics including AI development, rules for children under 16 and for facial feature data, and a relaxed duty to notify individuals of low-risk breaches. Its penal provisions take effect six months after promulgation and the rest by Cabinet Order within two years.
Put this framework to work in SmartSuite
Manage controls, risks, evidence, and audits in one platform designed for modern governance, risk, and compliance.