Japan APPI

Nothing changed in the last 90 days. Sign in to read further back.

1. 2026-10-14 PPC decides the third set of basic approaches for the Cabinet Order and rules under the 2026 amendment (preventing improper use and making compliance effective)
2. 2026-07-31 PPC adopts a roadmap for implementing the 2026 amendment
3. 2026-07-17 The 2026 APPI amendment (Act No. 56 of 2026) is promulgated
4. 2022-04-01 The 2020 APPI amendments take full effect

1. 2026-10-01
   Act No. 57 of 2003 (as in force from 1 October 2026) AmendmentCurrent text

   Consequential amendment by the Science Council of Japan Act (Act No. 70 of 2025) took effect. source

2. 2026-07-17
   2026 amendment (Act No. 56 of 2026, promulgated) Amendment

   The Act amending the APPI after the triennial review was promulgated on 17 July 2026; its main provisions take effect on a date set by Cabinet Order within two years of promulgation. source

   More

   • Consent is no longer needed to provide personal data to third parties, or to acquire publicly available sensitive data, when it is used only to create statistical information, including AI development that can be treated as statistics creation.
   • Where the individual is under 16, consent and notices are directed to the legal representative, and a duty is added to give priority consideration to the best interests of minors.
   • Operators must publicise certain matters about facial feature data, and such data can no longer be provided to third parties under the opt-out scheme.
   • The PPC can order payment of an administrative surcharge equal to the economic benefit gained from serious violations that harm individuals' rights (Articles 148-3 to 148-17).
   • Criminal penalties for improper provision of personal information databases are raised, and obtaining personal information by fraud becomes an offence.
   • The revised penal provisions and certain related provisions listed in supplementary Article 1(iii) take effect on the day on which six months have elapsed from promulgation, ahead of the main provisions.
3. 2022-04-01
   2020 and 2021 amendments in force (1 April 2022) Amendment

   The 2020 amending Act (Act No. 44 of 2020) took full effect on 1 April 2022, together with the parts of the 2021 Digital Society Formation Act (Act No. 37 of 2021) covering national government bodies, incorporated administrative agencies and academic research. source

   More

   • Higher statutory penalties under the 2020 amending Act had already applied from 12 December 2020.
4. 2017-05-30
   2015 amendment in force (30 May 2017) Amendment

   Amendments by Act No. 65 of 2015, which amended the APPI together with the My Number Act, took effect. source

5. 2003-05-30
   Act No. 57 of 2003 (promulgated) Major version

   The Act on the Protection of Personal Information was promulgated on 30 May 2003. source

The APPI binds private-sector operators that use personal information databases in their business, including operators abroad serving people in Japan.

Business operators

A business operator handling personal information is anyone who uses a personal information database for business, excluding national bodies, local governments, incorporated administrative agencies and local incorporated administrative agencies (Article 16(2)). source

Outside Japan

The Act applies when operators handle, in a foreign country, personal information of persons in Japan in connection with supplying goods or services to persons in Japan (Article 171). source

Transfers abroad

Providing personal data to a third party in a foreign country requires the individual's prior consent, unless the country is designated as equivalent or the recipient has a system meeting PPC standards (Article 28). source

Operators take their own security control measures and report qualifying data leaks to the PPC while notifying the individuals concerned.

Security control

Operators must take necessary and appropriate measures to prevent leakage, loss or damage of the personal data they handle (Article 23). source

Leak reporting

Leaks and similar incidents that are likely to harm individuals' rights, as specified in PPC rules, must be reported to the PPC and notified to the individuals (Article 26). source

Reporting deadline

The PPC asks for a prompt report on discovery; where the leak may have been carried out for an improper purpose, the deadline is 60 days from discovery. source

The PPC issues recommendations and orders; breaching an order is a crime punishable by imprisonment and fines of up to ¥100 million for companies, and the 2026 amendment adds an administrative surcharge.

Recommendations and orders

The PPC may recommend that a violating operator stop or correct the violation and, if the recommendation is ignored and serious harm is imminent, order it to do so (Article 148). source

Administrative surcharge

Under the 2026 amendment, once in force, the PPC can order a surcharge equal to the economic benefit obtained from serious violations involving large amounts of personal information. source

1. Law text 個人情報の保護に関する法律 (Act No. 57 of 2003, e-Gov)
2. Law text Act on the Protection of Personal Information (Japanese Law Translation)
3. Guidance 令和8年 改正個人情報保護法 (PPC page on the 2026 amendment)
4. Guidance 個人情報保護法等の一部を改正する法律について (PPC overview of the 2026 amendment, July 2026)
5. Guidance 漏えい等の対応とお役立ち資料 (PPC leak reporting page)

1. GDPR

   The EU regulation with turnover-based administrative fines; the APPI relies on PPC orders backed by criminal penalties.

2. Korea PIPA

   South Korea's data protection law, which already imposes turnover-based penalty surcharges.

3. ISMAP

   Japan's cloud security assessment programme for government procurement, not a personal data law.

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 20 September 2026. Subscribe to Japan APPI (RSS)