APPI

Japan Privacy

Status

In force (last major amendment in force 1 Apr 2022). 2026 amendment (Act No. 56 of 2026) passed 10 Jul 2026, promulgated 17 Jul 2026: criminal penalty changes from 17 Jan 2027; main reforms by Cabinet Order, no later than 17 Jul 2028.

Who it applies to

Any business handling personal information in Japan, regardless of size. Foreign businesses are covered when they handle data of people in Japan in connection with supplying goods or services to people in Japan (Art. 171).

Size thresholds

No size or volume threshold. Breach reporting is triggered by sensitive data, risk of financial loss, malicious intent, or more than 1,000 people affected.

Regulator

Personal Information Protection Commission (PPC)

Breach or incident reporting

Preliminary report to the PPC promptly (guidance: about 3-5 days), final report within 30 days (60 days if malicious, e.g. cyberattack). Notify affected individuals promptly; public notice if direct notice is impossible.

Deadline to answer personal data requests

Being verified

Data protection officer

No legal requirement for a DPO. PPC guidance recommends assigning a responsible person (e.g. a Chief Privacy Officer).

Local representative

Being verified

Sending data abroad

Needs prior consent after telling people the destination country, an outline of its privacy system and the recipient's safeguards, unless the country is approved (EU, UK) or the recipient has equivalent safeguards (e.g. APEC CBPR). Monitor recipients regularly.

Cookies and consent

No cookie law. Cookie and browsing data are 'personally referable information': get consent before sharing it with a recipient who can link it to a person. Telecommunications Business Act needs notice, consent or opt-out for third-party cookies.

Maximum penalty

Up to JPY 100 million fine for companies (e.g. ignoring PPC orders or improper database provision); individuals up to 1 year in prison or JPY 1 million. From the 2026 amendment: administrative surcharges equal to money gained from certain violations.

Facts marked “Being verified” are still being confirmed and are not given as answers.

What you must do

• Specify and publish the purpose of use; do not use data beyond it
• Get consent before sharing personal data with third parties, including overseas recipients
• Report qualifying leaks to the PPC (prelim promptly, final within 30/60 days) and notify affected people
• Keep records of third-party transfers and check recipients' safeguards
• Get consent before sharing cookie data a recipient can tie to a person
• Prepare for 2026 rules: parental consent for under-16s and notice for facial and other biometric data

Recent changes

Act No. 56 of 2026 (promulgated 17 Jul 2026): administrative surcharges (over 1,000 people, profit gained); under-16 rules; specified biometric data; AI/statistics consent exception; low-risk breach notice relief. Most parts start by Cabinet Order by 17 Jul 2028.

Sources

• Primary source: https://www.ppc.go.jp/en/legal/
• Second source: https://www.aoshearman.com/en/insights/ao-shearman-on-data/amendments-to-the-act-on-the-protection-of-personal-information-promulgated
• Regulator: Personal Information Protection Commission (PPC)

Information only, not legal advice. Laws change; confirm with the regulator or a qualified lawyer before relying on this page. Spotted an error? Email [email protected].