APPI

What it is

The Act on the Protection of Personal Information (APPI) is Japan's main data protection law. It was enacted in 2003 and has been substantially amended, with major reforms taking effect in 2017 and again in 2022 following the 2020 and 2021 amendments. The 2021 amendments merged the rules for the private sector, national government bodies and local governments into a single act overseen by the Personal Information Protection Commission (PPC).

Who it applies to

The Act applies to "personal information handling business operators", meaning any person or organization that uses a personal information database for business, whatever its size. It has extraterritorial reach: foreign businesses that supply goods or services to people in Japan and handle their personal information are also covered, with some of the obligations applying to them. Separate chapters apply to administrative entities such as government bodies.

Core principles

Operators must specify the purpose of use as concretely as possible, use personal information only within that purpose unless the individual consents, and acquire it by proper means. When information is collected they must notify or publicly announce the purpose of use, and they must keep personal data accurate and up to date as needed. The Act also uses several tiers of data, including "personal information", "personal data" (information in a searchable database) and "retained personal data" (data the operator can disclose, correct and delete).

Individual rights

Individuals can request disclosure of their retained personal data, including in electronic form, as well as correction, addition or deletion of it. They can also request that its use stop or that it be erased where it is being handled unlawfully, is no longer needed or has been subject to a serious breach, and can request disclosure of records of provision to third parties. Operators must publish how such requests can be made.

Key obligations

Operators must take necessary and appropriate security control measures, supervise employees and trustees who handle personal data, and obtain consent before providing personal data to a third party, subject to exceptions such as outsourcing, joint use, business succession and a regulated opt-out mechanism. Stricter rules apply to "special care-required personal information", such as race, creed, medical history and criminal record, which generally requires prior consent to acquire. The Act also defines pseudonymously processed information and anonymously processed information, with eased obligations under conditions, and it regulates information related to personal information such as cookie-based identifiers when a recipient can link them to an individual.

Data breaches

Since the April 2022 amendments, operators must report certain data leaks to the PPC and notify the affected individuals. This duty applies to cases involving sensitive information, risk of property damage, unauthorized purposes or large-scale leaks. A prompt preliminary report is required, followed by a final report within a period set by the PPC's rules.

International transfers

Providing personal data to a third party in a foreign country generally requires the individual's prior consent, which must come with information about the destination country's system. Exceptions exist where the recipient is in a country the PPC has recognised as having an equivalent level of protection (the EU and UK are recognised) or where the recipient has put in place a system that meets the standards for handling personal data. Operators relying on the latter must take ongoing measures and provide information to individuals on request.

Enforcement and penalties

The PPC can require reports, inspect premises, give guidance and advice, and issue recommendations and binding orders. Failure to comply with a PPC order can lead to criminal penalties, including imprisonment with work for individuals and substantial fines for corporations, with the corporate fine for certain offences reaching a large figure in yen. Individuals may also bring civil claims for damages.

The official text

The authoritative version is the Japanese-language Act. The English translation linked here is provided by the Japanese government through the Japanese Law Translation database, is unofficial, and may not reflect the latest amendments. Use the Japanese text, not this summary, for anything that matters.