Japan. Comprehensive data protection. Act
APPIAct on the Protection of Personal Information (Act No. 57 of 2003)
§1Summary
- Synopsis
Japan's general privacy law covering private businesses and, since 2022–23, public bodies. It regulates purpose specification, third-party provision (with opt-out and records), security, breach reporting, retained-data requests and overseas transfers.
- Key themes
- Unique features
Pseudonymously processed information category allows internal analytics with relaxed purpose rules; overseas transfers need informed consent unless recipient country is whitelisted (EU/UK) or recipient has equivalent systems.
- SaaS relevance
Applies to foreign businesses handling personal information of people in Japan in connection with supplying goods or services to them; SaaS processors receiving data under 'entrustment' must be supervised by the client.
§2Obligations
- Extraterritorial
- Yes
- Breach notification
- PPC and individuals for prescribed breaches (sensitive data, financial-harm risk, malicious purpose, >1,000 people): preliminary report promptly (c. 3–5 days), full report within 30 days (60 if malicious)
- DPO
- No
- Cross-border transfers
- Consent with country information, or whitelisted country (EU/UK), or equivalent-system recipient (e.g. APEC CBPR)
- Maximum penalty
- Entities up to JPY 100m for violating PPC orders or unlawful database provision (pre-2026)
§3Dates
- Key dates
- Adopted
- In force
- Major amendments in force 2017-05-30, 2022-04-01 (2020/2021 amendments), 2023-04-01 (local government); 2026 amendment (Act No. 56 of 2026) promulgated 2026-07-17 – see jp-appi-amendment-2026
§4Text and authority
- Text
- Authoritative text elaws.e-gov.go.jp
- English text japaneselawtranslation.go.jp
- Authority
- Personal Information Protection Commission (PPC)
§5Where it applies
- Domestic law of
- Japan
§6Sources and verification
- Sources consulted
- Verification
High confidence.
Breach report day-counts from PPC rules (general knowledge). Mutual EU adequacy since 2019-01-23.