Home › Compare laws side by side › APPI vs EU GDPR
APPI vs EU GDPR
Act on the Protection of Personal Information (Act No. 57 of 2003, as amended) (Japan) compared with Regulation (EU) 2016/679 (General Data Protection Regulation) (European Union (EEA)) on the same topics. Every value comes from the law pages, which link to the official sources.
| Topic | APPI Japan 13/14 facts confirmed by two sources | EU GDPR European Union (EEA) ✓ Confirmed by two sources |
|---|---|---|
| Status | In force (last major amendment in force 1 Apr 2022). 2026 amendment (Act No. 56 of 2026) passed 10 Jul 2026, promulgated 17 Jul 2026: some criminal penalty provisions from 17 Jan 2027; main reforms on a date set by Cabinet Order, within two years of promulgation (by July 2028).✓ | In force since 25 May 2018. Digital Omnibus amendments proposed Nov 2025, not adopted as of Oct 2026.✓ |
| Who it applies to | Any business handling personal information in Japan, regardless of size. Foreign businesses are covered when they handle data of people in Japan in connection with supplying goods or services to people in Japan (Art. 171).✓ | Any organisation processing personal data in the context of an EU establishment, plus non-EU organisations that offer goods/services to people in the EU or monitor their behaviour there.✓ |
| Size thresholds | No size or volume threshold. Breach reporting is triggered by sensitive data, risk of financial loss, malicious intent, or more than 1,000 people affected.✓ | None — applies regardless of size. Limited record-keeping relief for organisations under 250 staff (Art 30(5)), lost if processing is risky, not occasional, or includes special-category or criminal data.✓ |
| Regulator | Personal Information Protection Commission (PPC)✓ | National data protection authorities (DPAs), coordinated by the European Data Protection Board (EDPB)✓ |
| Breach or incident reporting | Preliminary report to the PPC promptly (guidance: about 3-5 days), final report within 30 days (60 days if malicious, e.g. cyberattack). Notify affected individuals promptly; public notice if direct notice is impossible. | Notify the competent supervisory authority without undue delay and within 72 hours of becoming aware, unless the breach is unlikely to result in a risk to individuals (Art 33). If you have an EU main establishment, that is your lead authority; if you have no EU establishment (even with an EU representative), notify the authority of every member state where affected people live (EDPB Guidelines 9/2022, para 73). Tell affected individuals without undue delay if the risk is high (Art 34).✓ |
| Deadline to answer personal data requests | the Act requires disclosure, correction and stop-use requests to be handled without delay; no fixed number of days.✓ | 1 month from receipt; extendable by 2 further months for complex requests if the person is told within the first month. Free of charge unless manifestly unfounded or excessive.✓ |
| Data protection officer | No legal requirement for a DPO. PPC guidance recommends assigning a responsible person (e.g. a Chief Privacy Officer).✓ | DPO mandatory for public bodies, and where core activities involve large-scale regular and systematic monitoring, or large-scale processing of special-category or criminal-offence data.✓ |
| Local representative | no general local-representative requirement; foreign businesses using opt-out third-party sharing must name an agent in Japan.✓ | Non-EU controllers/processors caught by Art 3(2) must appoint an EU representative in writing, unless processing is occasional, low-risk and excludes large-scale sensitive data, or they are a public body.✓ |
| Sending data abroad | Needs prior consent after telling people the destination country, an outline of its privacy system and the recipient's safeguards, unless the country is approved (EU, UK) or the recipient has equivalent safeguards (e.g. APEC CBPR). Monitor recipients regularly.✓ | Transfers outside the EEA need an adequacy decision (e.g. UK, Switzerland, EU-US Data Privacy Framework), or safeguards such as Standard Contractual Clauses or Binding Corporate Rules, or a narrow Art 49 derogation.✓ |
| Cookies and consent | No cookie law. Cookie and browsing data are 'personally referable information': get consent before sharing it with a recipient who can link it to a person. Telecommunications Business Act needs notice, consent or opt-out for third-party cookies.✓ | Cookie/tracker consent is governed by the ePrivacy Directive Art 5(3); where consent is the GDPR legal basis it must be freely given, specific, informed, unambiguous and as easy to withdraw as to give.✓ |
| Maximum penalty | Up to JPY 100 million fine for companies (e.g. ignoring PPC orders or improper database provision); individuals up to 1 year in prison or JPY 1 million. From the 2026 amendment: administrative surcharges equal to money gained from certain violations.✓ | Up to EUR 20 million or 4% of total worldwide annual turnover, whichever is higher (lower tier: EUR 10 million or 2%).✓ |
= confirmed by two independent sources, at least one official.
Facts marked “Being verified” are still being confirmed and are not given as answers.
Who each law applies to
- APPI
- Any business handling personal information in Japan, regardless of size. Foreign businesses are covered when they handle data of people in Japan in connection with supplying goods or services to people in Japan (Art. 171).
- EU GDPR
- Any organisation processing personal data in the context of an EU establishment, plus non-EU organisations that offer goods/services to people in the EU or monitor their behaviour there.
What you must do under APPI
- Specify and publish the purpose of use; do not use data beyond it
- Get consent before sharing personal data with third parties, including overseas recipients
- Report qualifying leaks to the PPC (prelim promptly, final within 30/60 days) and notify affected people
- Keep records of third-party transfers and check recipients' safeguards
- Get consent before sharing cookie data a recipient can tie to a person
- Prepare for 2026 rules: parental consent for under-16s and notice for facial and other biometric data
What you must do under EU GDPR
- Identify a lawful basis for every processing purpose and record it.
- Publish a clear privacy notice covering purposes, recipients, retention and rights.
- Keep a record of processing activities and sign Art 28 contracts with processors.
- Run a DPIA before high-risk processing such as large-scale profiling or sensitive data.
- Report qualifying breaches within 72 hours (lead authority, or every relevant DPA if you have no EU establishment) and log all breaches.
- Answer access, erasure and other rights requests within one month.
Information only, not legal advice. Laws change; confirm with the regulator or a qualified lawyer before relying on this page. Spotted an error? Email contact@