What is the maximum APPI penalty?

Corporations: up to ¥100 million for failure to comply with a PPC order; up to ¥50 million for false reports or refusal of inspection. Individuals: up to ¥1 million and/or 1 year imprisonment.

How does APPI treat cross-border data transfers?

Transfers outside Japan require either explicit consent that discloses the third country, an equivalent-protection mechanism approved by PPC, or transfer to a country with PPC-recognised adequate protection (e.g., the EEA).

What is sensitive personal information under APPI?

要配慮個人情報 (yō-hairyo kojin jōhō) - race, creed, social status, medical history, criminal record, criminal victimisation, and other categories prescribed by ordinance. Explicit prior consent is required to collect it.

Japan APPI Compliance & PPC Representation

LatestEU AI ActMay 2026High-risk AI system classification guidance published - check your tier

What is the APPI?

The Act on the Protection of Personal Information (個人情報の保護に関する法律, APPI) is Japan's omnibus data protection law. It was originally enacted in 2003 and significantly strengthened in 2015, 2020, and 2022 — culminating in extraterritorial scope, mandatory breach notification, and enhanced cross-border transfer rules.

Enforcement is led by the Personal Information Protection Commission (PPC, 個人情報保護委員会). Japan holds a mutual EU adequacy decision, enabling seamless EU↔Japan data flow.

Maximum Penalty

¥100M

corporate fine for non-compliance with PPC order

Operators outside Japan are in scope under Article 166.

Six Core APPI Obligations

Notification of Use

Specify the purpose of use as concretely as possible and notify or publish before collection (Art. 17, 21).

Consent for Sensitive Data

Obtain prior consent for sensitive personal information (要配慮個人情報) — health, race, criminal history (Art. 20).

Proper Acquisition

Personal information must be acquired by lawful and fair means (Art. 20).

Accuracy

Keep personal data accurate and up to date within the scope necessary for the purpose of use (Art. 22).

Security Control Measures

Implement appropriate security control measures — physical, organisational, human, and technical (Art. 23).

Breach Notification

Report serious breaches to the Personal Information Protection Commission (PPC) and notify data subjects (Art. 26).

Rights of Data Subjects

Right to request disclosure (kaiji) of retained personal information
Right to request correction (teisei) of inaccurate information
Right to request cessation (riyō teishi) of use or erasure
Right to request cessation of third-party provision
Right to request electronic disclosure of records of third-party provision
Right to request disclosure of cross-border transfer details

Penalty Matrix

Failure to comply with PPC order — corporation (Art. 178)Up to ¥100 million

Failure to comply with PPC order — individualUp to ¥1 million or 1 year imprisonment

False reports or refusal of inspection — corporationUp to ¥50 million

Notable: Recruit (PPC, 2019 administrative guidance)Risksta service shutdown — university student data

Notable: NTT Docomo subsidiary (PPC, 2023)Administrative guidance — 5.2M records

Who Needs APPI Representation

Foreign Operators

Operators outside Japan that handle personal data of individuals in Japan are subject to APPI (Art. 166).

Cross-Border Transfers

Transferring data outside Japan requires explicit consent or equivalent-protection mechanisms.

EdTech & Children's Apps

Heightened expectations around consent and security for minors' data.

Sensitive-Data Operators

Healthcare, biometrics, and criminal-history processors face explicit-consent gating.

RegulatoryBridge Japan

Our Six-Pillar APPI Programme

Personal Information Manager

Pillar 01

Designated manager (kojin jōhō hogo kanrisha) as a single point of contact for the PPC and data subjects.

PPC Liaison

Pillar 02

Notification, investigation, and inspection response with the Personal Information Protection Commission of Japan.

Cross-Border Transfer Programme

Pillar 03

Equivalent-protection assessments, consent flows, and contractual mechanisms under Art. 28.

Sensitive Data Controls

Pillar 04

Workflow and tagging to enforce explicit-consent gating for sensitive personal information.

Breach Response

Pillar 05

PPC notification within prescribed timeframes plus data-subject communication where required by Art. 26.

Anonymously Processed Information

Pillar 06

Compliance framework for anonymously processed (匿名加工情報) and pseudonymously processed information.

Need a Personal Information Manager in Japan?

We provide bilingual APPI representation — Japanese-fluent compliance leads, PPC liaison, and cross-border transfer workflows.

Run an APPI Assessment Talk to a Japan Expert

Loading…