APPI

Japan Privacy

Status

In force (last major amendment in force 1 Apr 2022). 2026 amendment (Act No. 56 of 2026) passed 10 Jul 2026, promulgated 17 Jul 2026: some criminal penalty provisions from 17 Jan 2027; main reforms on a date set by Cabinet Order, within two years of promulgation (by July 2028).✓Sources: ppc.go.jp, miyake.gr.jp, aoshearman.com

Who it applies to

Any business handling personal information in Japan, regardless of size. Foreign businesses are covered when they handle data of people in Japan in connection with supplying goods or services to people in Japan (Art. 171).✓Sources: laws.e-gov.go.jp, dlapiperdataprotection.com

Size thresholds

No size or volume threshold. Breach reporting is triggered by sensitive data, risk of financial loss, malicious intent, or more than 1,000 people affected.✓Sources: laws.e-gov.go.jp, dlapiperdataprotection.com, iapp.org

Regulator

Personal Information Protection Commission (PPC)✓Sources: ppc.go.jp, dlapiperdataprotection.com

Breach or incident reporting

Preliminary report to the PPC promptly (guidance: about 3-5 days), final report within 30 days (60 days if malicious, e.g. cyberattack). Notify affected individuals promptly; public notice if direct notice is impossible.

Deadline to answer personal data requests

the Act requires disclosure, correction and stop-use requests to be handled without delay; no fixed number of days.✓Sources: laws.e-gov.go.jp, japaneselawtranslation.go.jp

Data protection officer

No legal requirement for a DPO. PPC guidance recommends assigning a responsible person (e.g. a Chief Privacy Officer).✓Sources: dlapiperdataprotection.com, japaneselawtranslation.go.jp

Local representative

no general local-representative requirement; foreign businesses using opt-out third-party sharing must name an agent in Japan.✓Sources: laws.e-gov.go.jp, ppc.go.jp

Sending data abroad

Needs prior consent after telling people the destination country, an outline of its privacy system and the recipient's safeguards, unless the country is approved (EU, UK) or the recipient has equivalent safeguards (e.g. APEC CBPR). Monitor recipients regularly.✓Sources: japaneselawtranslation.go.jp, dlapiperdataprotection.com

Cookies and consent

No cookie law. Cookie and browsing data are 'personally referable information': get consent before sharing it with a recipient who can link it to a person. Telecommunications Business Act needs notice, consent or opt-out for third-party cookies.✓Sources: japaneselawtranslation.go.jp, soumu.go.jp, dlapiperdataprotection.com

Maximum penalty

Up to JPY 100 million fine for companies (e.g. ignoring PPC orders or improper database provision); individuals up to 1 year in prison or JPY 1 million. From the 2026 amendment: administrative surcharges equal to money gained from certain violations.✓Sources: laws.e-gov.go.jp, laws.e-gov.go.jp, dlapiperdataprotection.com, aoshearman.com

Facts marked “Being verified” are still being confirmed and are not given as answers.

What you must do✓

• Specify and publish the purpose of use; do not use data beyond it
• Get consent before sharing personal data with third parties, including overseas recipients
• Report qualifying leaks to the PPC (prelim promptly, final within 30/60 days) and notify affected people
• Keep records of third-party transfers and check recipients' safeguards
• Get consent before sharing cookie data a recipient can tie to a person
• Prepare for 2026 rules: parental consent for under-16s and notice for facial and other biometric data

Recent changes

Act No. 56 of 2026 (promulgated 17 Jul 2026): administrative surcharges (over 1,000 people, profit gained); under-16 rules; specified biometric data; AI/statistics consent exception; low-risk breach notice relief. Most parts start by Cabinet Order within two years (by July 2028).✓

Sources

• Primary source: https://www.ppc.go.jp/en/legal/
• Second source: https://www.aoshearman.com/en/insights/ao-shearman-on-data/amendments-to-the-act-on-the-protection-of-personal-information-promulgated
• Regulator: Personal Information Protection Commission (PPC)

✓ = confirmed by two independent sources, at least one official. How we verify

Information only, not legal advice. Laws change; confirm with the regulator or a qualified lawyer before relying on this page. Spotted an error? Email contact@glancedeskjurisdiction.com.