Japan APPI
Amended Japan · In force Apr 1, 2005 · no upcoming deadlines
Deadlines
| Date | What happens | When |
|---|---|---|
| Apr 1, 2022 | 2020 amendments in force4.5 years ago | 4.5 years ago |
| Jul 17, 2026 | 2026 APPI amendment act promulgated2 months ago | 2 months ago |
Summaries for reference, not legal advice. Check the official text.
What it does
Japan's general privacy law covering purpose specification, security, third-party transfer consent (with an opt-out scheme), cross-border transfer rules, mandatory breach reporting, and pseudonymized data. The 2026 amendment (promulgated 17 July 2026) adds Japan's first administrative fine (disgorgement of gains from serious violations), guardian consent for children under 16, stricter rules on facial-feature data, relaxed breach notification to individuals, and a consent exemption for statistics and AI development.
- Who it applies to
- All business operators handling personal information in Japan, with no size threshold, and foreign operators handling data of people in Japan in connection with supplying goods or services. Under the 2026 amendment, fines target serious violations involving large-scale misuse for economic gain; reported exclusions cover negligence or fewer than 1,000 affected people.
- Penalties
- Current: PPC orders; criminal penalties for violating orders up to 1 year imprisonment or JPY 1 million, and corporate fines up to JPY 100 million for order violations and unlawful database provision. 2026 amendment: administrative fine equal to the economic benefit from the violation (reported 1.5x uplift for repeat offenders within 10 years and a 50% cut for self-reporting), plus higher criminal penalties for unlawful database provision and new penalties for obtaining PI by fraud.
- Enforced by
- Personal Information Protection Commission (PPC)
- Official name
- Act on the Protection of Personal Information (Act No. 57 of 2003), as amended including the 2026 amendment act
- Citation
- Act No. 57 of 2003; 2026 amendment act promulgated 17 July 2026
- Topics
- privacy, children, biometrics, breach-notification, ai
Research notes
Main body of the 2026 amendment commences by cabinet order within 2 years of promulgation (by about July 2028); the PPC roadmap of 31 July 2026 gives a rough outlook of spring to July 2028, so no exact date is listed. One narrow provision (digitised service by public notice) takes effect 6 months after promulgation. The 1,000-person exclusion and the 1.5x and 50% fine adjustments come from law-firm summaries, not re-verified in the official text. Earlier dates (2003 enactment, 2005 full effect, 2022 amendments) are from the PPC legal page and general knowledge. Full English consolidation as of 1 Apr 2023 is at japaneselawtranslation.go.jp.
Related
Australia Cyber Security Act (ransomware reporting)Questions about Japan APPI
- What are the Japan APPI compliance deadlines?
- Apr 1, 2022: 2020 amendments in force. Jul 17, 2026: 2026 APPI amendment act promulgated.
- When does Japan APPI take effect?
- Japan APPI took effect on Apr 1, 2005.
- Who does Japan APPI apply to?
- All business operators handling personal information in Japan, with no size threshold, and foreign operators handling data of people in Japan in connection with supplying goods or services. Under the 2026 amendment, fines target serious violations involving large-scale misuse for economic gain; reported exclusions cover negligence or fewer than 1,000 affected people.
- What are the penalties under Japan APPI?
- Current: PPC orders; criminal penalties for violating orders up to 1 year imprisonment or JPY 1 million, and corporate fines up to JPY 100 million for order violations and unlawful database provision. 2026 amendment: administrative fine equal to the economic benefit from the violation (reported 1.5x uplift for repeat offenders within 10 years and a 50% cut for self-reporting), plus higher criminal penalties for unlawful database provision and new penalties for obtaining PI by fraud.