Act on the Protection of Personal Information
Japan's core data protection law, overseen by the independent Personal Information Protection Commission. It combines administrative corrective orders with criminal penalties for serious or repeated non-compliance.
Who it applies to
- Business operators handling personal information in Japan
- Organisations outside Japan handling data of individuals in Japan for goods or services
- Both private businesses and certain public-sector bodies
Key requirements
- Clear notification or publication of the purpose of use
- Restrictions on cross-border transfers absent equivalent protection
- Breach reporting to the PPC for reportable incidents
- Anonymisation and pseudonymisation rules for secondary use
- Individual rights to disclosure, correction and suspension of use
Maximum penaltyCriminal penalties for individuals plus corporate fines of up to ¥100 million for serious violations
Official resources
Praeferre's summary is a starting point, not legal advice. For the authoritative text and current guidance, go directly to the governing body.
Questions we get asked
APPI applies to: Business operators handling personal information in Japan; Organisations outside Japan handling data of individuals in Japan for goods or services; Both private businesses and certain public-sector bodies.
The core obligations are: Clear notification or publication of the purpose of use; Restrictions on cross-border transfers absent equivalent protection; Breach reporting to the PPC for reportable incidents; Anonymisation and pseudonymisation rules for secondary use; Individual rights to disclosure, correction and suspension of use. Each is summarised in plain English above, with a link to the official text.
Effective: 2003, substantially amended 2022. Regulator: Personal Information Protection Commission (PPC).
Criminal penalties for individuals plus corporate fines of up to ¥100 million for serious violations.
Praeferre's GRC Automation engine monitors the policies, document repositories and web pages that carry your risk under APPI, on a cadence you set, and turns every scan into an audit trail you can put in front of an auditor or regulator.
See how Praeferre automates APPI compliance
Continuous monitoring, evidence and reporting for APPI — alongside every other framework you need to satisfy.