What is Japan’s APPI?
The Act on the Protection of Personal Information (APPI) is Japan's primary data protection law. It protects individuals' rights and interests while establishing basic principles and obligations for handling personal information properly.
The APPI covers areas such as:
- Collection and Use of Personal Information
- Data Security Management
- Third-party Data Sharing
- Data Breach/Leak Reporting
- Third-Party and Cross-Border Data Transfer
- Data Subject Rights
- Deletion of Personal Data
- Penalties for Violations
Who Needs to Comply with APPI?
Under Article 16 (2), the APPI applies to a business handling personal information, a personal information database, or the equivalent for business purposes, subject to the exclusions specified in the Act.
The APPI can also apply to businesses located outside Japan in certain circumstances. Under Article 171, the Act applies when a business outside Japan supplies goods or services to a person in Japan and handles certain personal information in a foreign country. The 2026 amendment strengthens the PPC's oversight of foreign business operators by making them subject to certain reporting requirements and orders.
The APPI also contains separate provisions for administrative entities, including national and local government organizations and certain administrative agencies.
Therefore, organizations handling personal information in Japan need to understand the APPI requirements that apply to their activities.
What Information Does APPI Protect?
The APPI defines several categories of information, including personal information, sensitive personal information, pseudonymized personal information, and anonymized personal information, whether directly (name, ID number) or in combination with other data.
- Personal Information: Under Article 2(1), personal information is information relating to a living individual that can identify a specific individual. It also includes information that can identify an individual when easily collated with other information and information containing an individual identification code. Examples include names, dates of birth, identification codes, and other information that can identify an individual.
- Sensitive Personal Information: Article 2(3) defines sensitive personal information as personal information relating to matters such as race, creed, social status, medical history, criminal record, or having suffered damage from a crime. Businesses generally need the individual's prior consent to acquire sensitive personal information, subject to exceptions under Article 20.
- Pseudonymized and Anonymized Personal Information: Pseudonymized personal information is processed in a way that an individual cannot be identified unless it is collated with other information. Anonymized personal information is processed so that an individual cannot be identified and the original personal information cannot be restored. The APPI establishes specific requirements for handling both categories.
What Are the Key Japanese APPI Compliance Requirements?
Businesses handling personal information must follow several requirements under the APPI, just like any other data protection law.
- Specify & Restrict the Purpose of Use: Under Article 17, businesses must specify the purpose of using personal information as much as possible. Article 18 requires businesses not to handle personal information beyond the scope necessary to achieve the specified purpose without consent, subject to exceptions. Article 19 further requires that the business must not utilize the information in a way that may foment or induce an unlawful or unjust act.
- Proper Acquisition & Notification: Under Article 20, businesses must not acquire personal information through deception or other wrongful means. Additional requirements apply when acquiring sensitive personal information. Businesses must also notify individuals of or publicly disclose the purpose of use as required under Article 21.
- Maintain Data Accuracy: Article 22 requires businesses to endeavor to keep personal data accurate and up to date within the scope necessary for use. It also states that personal data should be deleted without delay when the business no longer needs it.
- Manage the Security of Personal Data: Under Article 23, businesses must take necessary and appropriate measures to manage the security of personal data, including preventing leakage, loss, or damage.
Businesses must also appropriately supervise employees handling personal data and organizations entrusted with handling personal data under Articles 24 and 25.
- Report Data Leaks: Under Article 26, businesses must report certain personal data leaks, loss, damage, and other security incidents prescribed by PPC rules as likely to harm individual rights and interests. The Article also establishes notification requirements for affected individuals, subject to specified exceptions.
- Third-Party and Cross-Border Transfer Restrictions: Article 27 generally requires businesses to obtain an individual's consent before providing personal data to a third party, subject to specified exceptions.
Additional requirements apply when transferring personal data to a third party in a foreign country. Under Article 28, businesses may need to obtain consent and provide information about the destination country's personal information protection system and the recipient's data protection measures.
What Are the Rights of Individuals Under Japan APPI?
The APPI provides individuals with several rights concerning personal data held by businesses.
- Under Article 32, businesses must make the following information about the personal data they hold accessible to identifiable persons: the name and address of the business, the purpose of use of the personal data, and the procedures for responding to certain requests.
- Under Article 33, an identifiable person can request disclosure of personal data held by a business that can identify that person. Once a business receives this request, it is obligated to fulfill it without delay.
- Under Article 34, an individual can request correction, addition, or deletion when personal data held by a business is not factual.
- Under Article 35, individuals can request that a business stop using or delete their personal data in certain situations. This includes cases where the data is handled beyond the permitted purpose, used inappropriately, obtained unlawfully, is no longer necessary for the business, or is involved in certain personal data breach situations. Individuals can also request that a business stop providing their personal data to a third party when the transfer does not comply with APPI requirements or when continued handling of the data is likely to harm their rights and interests. The 2026 update expands on this right and covers additional circumstances.
What Does the 2026 APPI Amendment Mean for Businesses?
Japan enacted a further amendment to the Act on the Protection of Personal Information (APPI). The National Diet passed the amendment on July 10, 2026, and it was promulgated as Act No. 56 of 2026 on July 17, 2026. The reform introduces or expands rules concerning improper acquisition and use of personal information, minors’ and biometric information, certain cross-border and overseas-operator obligations, individual notification and rights, and the PPC’s enforcement powers. It also establishes administrative monetary penalties for specified serious conduct and creates limited consent exceptions for certain statistical and AI-related processing. It further increases several criminal penalties, including the penalties under Articles 176, 179, and 180.
Most provisions are not yet in force and will take effect on dates prescribed by Cabinet Order, while specified penalty provisions are expected to take effect earlier.
What Are the Penalties Under Japan APPI?
The APPI establishes criminal penalties in Chapter VIII, Penal Provisions (Articles 176–185). The applicable penalty depends on the offense and the status of the offender.
| Article |
Offense |
Custodial Sentence |
Fine |
| 176 |
Unlawful provision of personal information files containing confidential information by a government employee |
Up to 2 years |
Up to JPY 1 million |
| 179 |
Improper provision or appropriation of a personal information database, etc., by a personal information handling business operator for an illegal benefit |
Up to 1 year |
Up to JPY 500,000 |
| 180 |
Improper provision or appropriation of retained personal information by a government employee for an improper benefit |
Up to 1 year |
Up to JPY 500,000 |
| 181 |
Abuse of authority by a government employee to collect documents containing confidential personal information |
Up to 1 year |
Up to JPY 500,000 |
| 184 |
Corporate liability for certain violations committed by an employee or other worker in connection with the corporation's business |
— |
Up to JPY 100 million |
Note: The July 2026 amendment to the APPI increases several criminal penalties, with the maximum fine increasing to JPY 1.5 million and the maximum custodial sentence increasing to 3 years. These revised penalties have been approved but are not yet in effect.
How Data Erasure Supports Japan's APPI Compliance?
Secure data erasure is relevant to APPI requirements concerning the deletion and security of personal data.
Under Article 22, businesses must endeavor to delete personal data without delay when it is no longer required for the purpose of use. Article 23 also requires appropriate security management measures to prevent leakage, loss, or damage.
Secure data erasure can help organizations permanently remove personal information from HDDs, SSDs, NVMe drives, and other storage devices when the data is no longer required.
However, secure data erasure should not be confused with anonymization under APPI. Anonymized personal information must meet the specific processing requirements defined under Article 43, including making it impossible to identify the individual and restore the original information.
A professional data erasure solution such as BitRaser can help organizations securely erase data from storage media and maintain erasure reports and certificates as records of the disposal process, in compliance with Japan’s APPI.
