What is APPI?
The APPI is Japan’s main data protection law. It applies to businesses that handle personal information, and since 2022 it also covers the public sector under a unified framework. The amendments that took effect in April 2022 strengthened individual rights, made breach reporting mandatory and tightened cross-border transfer rules.
Who does it apply to?
Business operators handling personal information databases in Japan, regardless of size. It also applies to foreign businesses that handle personal information of people in Japan in connection with supplying goods or services to them.
Key duties
- Purpose: specify the purpose of use and do not use data beyond it without consent.
- Proper acquisition: obtain data fairly. Special care-required personal information, such as race, creed, medical history and criminal records, generally needs prior consent.
- Security control measures: appropriate organisational, human, physical and technical safeguards, plus supervision of employees and contractors.
- Third-party provision: generally requires consent, with opt-out and other exceptions, and record-keeping of provision and receipt.
- Rights: disclosure (including in electronic form), correction, suspension of use and deletion, including where the individual’s rights may be harmed.
- Breach reporting: for breaches involving sensitive data, data at risk of financial loss, malicious acts, or more than 1,000 people, make a prompt preliminary report to the PPC and a final report within 30 days (60 days for malicious acts), and notify the individuals.
- Cross-border transfers: consent after giving information about the destination country’s system, or transfer to a recipient with equivalent measures, or to an adequate country, such as EU and UK destinations.
Useful concepts
The APPI distinguishes pseudonymously processed information, useful for internal analysis with lighter rules, from anonymously processed information, which can be shared under conditions.
How does it relate to other frameworks?
Japan and the EU recognise each other as adequate. The PPC’s guidelines and Q&As give practical detail.
Sources and official references
- Personal Information Protection Commission — PPC Japan (official source)
Links go to the publisher's own site. Where a standard is sold or copyrighted, MajorCyber™ summarises it in original words and links to the official listing instead of reproducing its text.
Listen to this page
Read aloud in UK English by your own device. Nothing is sent anywhere, and the voice is whichever one your browser provides.
This page is general educational information, not legal, audit or certification advice. Requirements depend on your organisation's circumstances and the current official text. MajorCyber™ is not affiliated with Japan; administered by the Personal Information Protection Commission (PPC).
