APPI

Who it applies to

Businesses handling personal information in Japan, and foreign businesses handling personal information of people in Japan in connection with supplying goods or services to them.

Key requirements

• Specify and limit the purpose of use.
• Consent for third-party provision of personal data, with opt-out and other exceptions.
• Security control measures and supervision of employees and contractors.
• Rules for cross-border transfers, including informing individuals about the recipient country's system.
• Handling rules for pseudonymously processed and anonymously processed information.
• Respond to requests for disclosure, correction and cessation of use.

Breach and incident notification

Since the 2022 amendments, certain leaks (for example involving sensitive data, risk of financial loss, wrongful purposes, or large numbers of people) must be reported to the PPC with a prompt preliminary report and a later confirmed report, and the affected individuals notified.

Penalties

PPC orders backed by criminal penalties, with higher fines for corporations after the 2022 amendments.

Go deeper