Japan's Act on the Protection of Personal Information (APPI) gives a breached organisation a few days to file a preliminary report with the regulator, and in 2026 it gained an administrative surcharge for the first time. The APPI covers every business that uses personal information databases, including foreign companies serving people in Japan, and its rules on third-party provision and overseas transfers are stricter than many GDPR-trained teams expect. This guide explains the scope, the core duties, the leakage reporting regime run by the Personal Information Protection Commission (PPC), the three routes for cross-border transfer, the amendment promulgated in July 2026, and what the law means for service accounts, contractors and AI agents. It is written for security, privacy and engineering leads, and for executives who need the status as of October 2026. For a comparison with other countries, see the Global Privacy Regulatory Map.
Key takeaways
- Two reports, two clocks. A reportable leakage needs a preliminary report to the PPC promptly (the PPC says about 3 to 5 days from discovery) and a final report within 30 days, or 60 days where an unauthorised purpose such as a cyberattack may be involved.
- Four triggers, not a harm test alone. Reporting applies to sensitive (special care-required) information, data whose misuse could cause financial damage, leaks that may stem from an unauthorised purpose, and leaks affecting more than 1,000 individuals.
- Overseas transfers need a route. Article 28 requires informed consent, a recipient in a country the PPC recognises (the EU and the UK), or a recipient with a system meeting PPC standards that you keep checking.
- The 2026 amendment is law but mostly not yet in force. Act No. 56 of 2026 was promulgated on 17 July 2026; tougher criminal penalties start on 17 January 2027 and the surcharge and other main reforms by 17 July 2028 at the latest.
- Contractors and credentials are the weak point. Article 25 makes you supervise trustees, and a cyberattack-driven leak is reportable regardless of volume, so shared directories and over-privileged contractor accounts carry direct APPI risk.
Scope: who and what is covered
The APPI (Act No. 57 of 2003) is administered by the PPC. Its private sector rules apply to a "personal information handling business operator", meaning any business that uses a personal information database for its business, with no minimum size. The Act also applies to foreign businesses that handle personal information of individuals in Japan in connection with supplying goods or services to them. Since the 2021 amendment, public sector bodies are covered in the same Act under separate chapters (for example Article 68 on breach reporting and Article 71 on overseas transfers for administrative organs).
Only the Japanese text has legal effect. The PPC's English consolidated translation is dated 1 April 2023 and states that all amended Acts up to then are in force.
| Term (Article 2 and 16) | Meaning | Why it matters to security teams |
|---|---|---|
| Personal information | Information about a living individual that identifies them, including by easy matching with other data, or that contains an individual identification code | Broad test: logs and device data can qualify |
| Individual identification code | Codes derived from physical features (biometrics) or assigned identifiers such as passport or My Number | Biometric templates are personal information on their own |
| Special care-required personal information | Race, creed, social status, medical history, criminal record, having been a victim of crime and similar | Needs prior consent to acquire; any leak is reportable |
| Personal data | Personal information in a searchable personal information database | Most security and third-party rules apply here |
| Retained personal data | Personal data the business can disclose, correct, stop using or erase | Subject to individual rights requests |
| Pseudonymised and anonymised information | Processed so individuals cannot be identified without other data, or at all | Separate, lighter regimes with re-identification bans |
| Personally referable information | Information such as cookie or browsing data that is not personal information to the provider but becomes so to the recipient | Recipient consent must be confirmed before provision (Article 31) |
Key obligations
| Article | Duty | Practical evidence |
|---|---|---|
| 17-18 | Specify the purpose of use as far as possible; prior consent to go beyond it | Purpose statements mapped to systems |
| 20 | No deceptive or wrongful acquisition; prior consent to acquire special care-required information | Consent records for sensitive categories |
| 21 | Notify or publish the purpose promptly after acquisition, or state it explicitly in advance for direct written collection | Privacy notice and collection forms |
| 23 | Necessary and appropriate security control measures against leakage, loss or damage | Access control, encryption, logging, physical and organisational controls |
| 24 | Supervise employees who handle personal data | Training, least privilege, monitoring |
| 25 | Supervise trustees (contractors) handling personal data | Contract terms, audits, access reviews of contractor accounts |
| 26 | Report qualifying leakages to the PPC and notify affected individuals | Incident runbook with APPI triggers and clocks |
| 27 | Prior consent for provision to third parties; opt-out route only with PPC filing and never for sensitive data | Third-party provision register |
| 28 | Rules for provision to third parties in foreign countries | Transfer register with route per flow |
| 29-30 | Record provision to third parties; recipients confirm source and how the data was acquired | Provision and receipt logs |
| 32-35 | Publish key information; handle disclosure, correction and cessation or erasure requests | Request workflows reaching all systems |
Entrustment of processing, business succession and notified joint use are not "provision to a third party" under Article 27, which is how most outsourcing works without consent. The trade-off is that the entrusting business carries the Article 25 supervision duty.
Leakage reporting in detail
Mandatory reporting under Article 26 has applied since 1 April 2022. The PPC's guidance page sets out the triggers and timing:
| Trigger (actual or suspected leakage, loss or damage) | Example |
|---|---|
| Special care-required personal information | Medical records, health check results |
| Data that could cause financial damage if misused | Credit card numbers, login credentials for payment services |
| Possible unauthorised purpose | Theft by outsiders, ransomware and other cyberattacks |
| More than 1,000 individuals | Any category (the threshold is 100 for public bodies) |
- Preliminary report (sokuho): promptly after becoming aware; the PPC indicates about 3 to 5 days from discovery. Items still unknown can be reported later.
- Final report (kakuho): within 30 days of becoming aware, or 60 days where an unauthorised purpose may be involved.
- Content: overview, data affected, number of individuals, cause, secondary damage, response to individuals, public announcement and recurrence prevention.
- Channel: the PPC online form, or the sector ministry where the PPC has delegated authority. For ransomware and other cyberattacks the PPC accepts a common Excel format by email. Cloud providers may file on a customer's behalf.
- Individuals: notify affected individuals promptly; where that is difficult, take alternative measures such as public announcement.
Because credential leaks fall under the financial damage trigger and attacks under the unauthorised purpose trigger, nearly every security incident touching personal data in Japan is reportable. For other jurisdictions in the same incident, use the Data Breach Notification Checklist and the Breach Notification Laws by Country Guide.
Cross-border transfer
| Route under Article 28 | Conditions | When to choose it |
|---|---|---|
| Informed consent | Before consent, tell the individual the recipient country, an overview of that country's personal information protection system, and the recipient's protective measures | Consumer services with a clear consent point and few destination countries |
| Recognised country | Recipient in a country the PPC designates as equivalent; so far only the EU (since 23 January 2019) and the UK | EU and UK group entities and suppliers |
| Recipient with a conforming system | Recipient takes measures equivalent to the APPI under contract or internal rules; you check periodically that it continues and that local laws do not prevent it, and give information to individuals on request | Most B2B and intra-group flows to other countries |
The EU-Japan mutual adequacy arrangement took effect on 23 January 2019, and data received from the EU or UK under adequacy is subject to the PPC's Supplementary Rules, which add protections on top of the APPI. Choose the conforming system route for B2B scale, but budget for the periodic checks: they are an ongoing control, not a one-time contract.
Timeline and current status
| Date | Event | Status as of October 2026 |
|---|---|---|
| 2003 | APPI enacted (Act No. 57 of 2003) | In force as amended |
| 23 January 2019 | EU-Japan mutual adequacy | In force |
| 1 April 2022 | 2020 amendment: mandatory leakage reporting, stricter Article 28 information duties, personally referable information, pseudonymised information | In force |
| 1 April 2023 | 2021 amendment fully in force: public sector rules unified into the APPI | In force |
| 7 April 2026 | Cabinet approves amendment bill (Bill No. 54) following the PPC's triennial review | Completed |
| 10 July 2026 | National Diet passes the amendment | Completed |
| 17 July 2026 | Promulgated as Act No. 56 of 2026 | Law, phased commencement |
| 17 January 2027 | Stronger criminal penalties for unlawful provision of databases and improper acquisition offences | Not yet in force |
| By 17 July 2028 | Surcharge, consent exceptions, children's and biometric rules, new PPC powers (date set by Cabinet Order) | Not yet in force |
What the 2026 amendment changes
- Administrative surcharge (Article 148-3): the PPC may order a surcharge only where the conduct is a specified violation, the business received money or other consideration for it, it failed to take reasonable care, the harm is significant, and more than 1,000 individuals are affected. The amount corresponds to the consideration received; a Cabinet Order will set the calculation.
- Children under 16: consent and notice generally go through the legal representative (Article 40-2), and children gain easier cessation and erasure rights.
- Specified biometric personal information: a new category for biometric data easy to collect without the person knowing, such as facial images, with advance notice, a right to request suspension and no opt-out provision.
- Data use: broader consent exceptions, including where processing is clearly necessary for a contract, and a new exception for third-party provision for creating statistics, including AI training, under PPC rules and limits.
- Breach notification: individual notification may be waived for leakages the PPC rules designate as low risk, if alternative protection is in place. Reporting to the PPC is unchanged.
Watch for the Cabinet Order and PPC rules, which will fix the commencement date, the surcharge calculation and the low-risk categories.
Enforcement and penalties
The PPC can require reports, inspect premises, give guidance and advice, issue recommendations and, where a recommendation is not followed or the matter is urgent, issue orders. Until the 2026 surcharge commences, there is no administrative fine; the sanctions are criminal, mainly for breaching a PPC order and for unlawfully providing a personal information database for illicit gain. Following the 2020 amendment, breaching a PPC order is punishable by up to one year of imprisonment or a fine of up to JPY 1 million, and companies face fines of up to JPY 100 million. The PPC also publishes its administrative responses, which carry reputational weight.
The PPC issued an administrative response to LINE Yahoo on 28 March 2024 after a 2023 leakage and published follow-up summaries of improvements in May, July and October 2024. Separately, the Ministry of Internal Affairs and Communications ordered the company to separate its technology from former parent NAVER, with which it still shared an Active Directory authentication system years after the 2021 restructuring, and in April 2024 rejected its first improvement plan as insufficient on security and subcontractor management. The lesson for Article 23 and 25: a shared identity system with a contractor or former affiliate is a personal data control.
What it means for AI agents and non-human identities
- Credentials trigger reporting: login credentials for payment services are the PPC's own example of financial damage data, so a leak of customer credentials is reportable whatever the count.
- Attacks start the 60-day track: theft via a compromised service account, API key or agent token is an unauthorised purpose case. Expect a preliminary report within days and plan forensics to support a final report in 60.
- Contractor and service accounts are Article 25 territory: review every account held by trustees, remove shared directories or trusts with third parties, and enforce MFA and least privilege. See the Service Account Security Guide.
- AI training data: today, giving personal data to a third party for model training generally needs consent or an entrustment structure. The 2026 statistics exception may ease this once in force, subject to PPC rules, so do not build on it yet. See the AI and Privacy Guide and, for Japan's AI policy law, the Japan AI Promotion Act Guide.
- Agents acting on personal data: an AI agent with broad database access widens both the 1,000-person trigger and the purpose limitation risk. Scope agent tokens to purpose, keep them in a vault, and log every data access. See the Agentic AI Identity Guide.
- Overseas model providers: sending prompts containing personal data to an API hosted outside Japan can be an Article 28 transfer unless the provider does not handle the data; document the route.
Compliance steps
- Inventory databases and access: list personal information databases, purposes, special care-required data, and every human, contractor, service account and agent with access. See the Data Mapping and ROPA Guide.
- Map flows to Article 27 and 28 routes: mark each recipient as entrustee, joint user or third party, and each overseas flow as consent, recognised country or conforming system.
- Build the reporting runbook: add the four triggers, a day-0 discovery timestamp, a preliminary report target of day 3, and final report deadlines at day 30 and day 60. Pre-fill the PPC form fields and the Excel format for cyberattacks.
- Harden security control measures: MFA, least privilege, encryption, logging and data loss monitoring for personal data stores; break shared identity systems with third parties.
- Supervise trustees: contract clauses for security, breach notice in hours, audit rights and on-site or remote checks for high-risk contractors; schedule periodic checks for conforming-system recipients.
- Test, then roll out: run a tabletop on a ransomware case with the PPC timeline, pilot the runbook in one business unit, fix gaps, then extend. If a new consent flow breaks conversion, roll back the user interface change, not the consent requirement.
- Prepare for 2027 and 2028: track the Cabinet Order, assess biometric and children's data, and review any data sales or paid provision that could fall under the surcharge.
Small and large organisations
- Small businesses: there is no size exemption. Focus on the reporting runbook, MFA and contractor access.
- Large and foreign groups: the conforming system route needs a programme of periodic checks across subsidiaries; delegated-sector reporting may route through a ministry, so confirm the channel per entity.
Detection, measurement and framework mapping
Monitor bulk exports from personal data stores, sign-ins by contractor and service accounts from new locations, changes to directory trusts with third parties, ransomware indicators, and outbound transfers to new overseas destinations. Metrics:
- Days from discovery to preliminary report, target 3 to 5.
- Percentage of final reports filed within the 30 or 60 day limit.
- Percentage of contractor and service accounts with MFA or workload authentication and a review in the last 90 days.
- Percentage of overseas flows with a documented Article 28 route.
- Number of conforming-system recipients checked in the last 12 months.
| APPI duty | NIST CSF 2.0 | NIST SP 800-53 Rev 5 | ISO/IEC 27001:2022 Annex A |
|---|---|---|---|
| Purpose specification (17-18, 21) | GV.OC-03 | PT-2, PT-3 | 5.34 |
| Security control measures (23) | PR.AA-05, PR.DS-01 | AC-2, AC-6 | 5.15, 8.5 |
| Supervision of trustees (25) and transfers (28) | GV.SC-05 | SA-9 | 5.19, 5.20 |
| Data inventory and records (29-30) | ID.AM-07 | SI-12 | 5.12 |
| Leakage reporting (26) | RS.CO-02 | IR-6 | 5.24, 5.26 |
Common failure patterns
- Waiting for the full picture: the preliminary report is meant to be partial; delaying it to finish forensics misses the PPC's expectation.
- Treating outsourcing as transfer-free: entrustment avoids consent but not supervision, and an overseas entrustee still needs an Article 28 route.
- Shared identity with third parties: a directory or authentication system shared with a contractor or former affiliate, as in the LINE Yahoo case, lets one compromise cross company lines.
- Applying GDPR legitimate interests: the APPI has no equivalent basis for third-party provision, so GDPR compliance alone does not satisfy Article 27.
- One-off conforming system checks: contracts are signed but recipient measures and local laws are never rechecked.
Practitioner checklist
- Record the purpose of use for every personal information database.
- Identify special care-required and biometric data and the consent held for it.
- Add the four reporting triggers and the 3-5, 30 and 60 day clocks to the incident runbook.
- Pre-register the PPC reporting channel or sector ministry for each Japanese entity.
- Enforce MFA and least privilege on contractor, service and agent accounts with personal data access.
- Remove directory trusts or shared authentication with third parties.
- Document an Article 28 route for every overseas flow, including AI API providers.
- Recheck conforming-system recipients at least annually.
- Track the Cabinet Order that will commence the 2026 amendment.
Standards and references
- Japanese Law Translation: Act on the Protection of Personal Information
- Personal Information Protection Commission: Laws and Policies
- Personal Information Protection Commission: Leakage Reporting (Japanese)
- Personal Information Protection Commission: EU-Japan Mutual Adequacy
- A&O Shearman: Amendments to the APPI Promulgated
- PwC Japan: Amendments to Japan's Act on the Protection of Personal Information
- Baker McKenzie: Japan Overseas Hosting
- The Register: Japan Rejects LINE Yahoo Security Plan
Related NHI Mgmt Group resources: Global Privacy Regulatory Map · Data Breach Notification Checklist · Singapore PDPA Guide · China PIPL Guide · Global AI Regulation Map. This guide summarises Japan's Act on the Protection of Personal Information and PPC guidance as of October 2026 and is not legal advice.