apac
Japan
Japan's APPI is a mature comprehensive privacy regime with active PPC guidance and cross-border transfer requirements.
Editorial caveat
Structured values summarize official materials for research and planning. They are reviewed by humans before publication and should not be treated as legal advice.
medium confidence, Strong base, but transfer and consent nuance should be deepened.
Breach
- Breach deadline (hours)
- 0
- Breach notification required
- Yes
Marketing
- Cookie consent rule
- Cookie and tracking analysis is shaped by APPI guidance, especially around personal-related information and consent for onward use.
Transfers
- Cross-border transfer restricted
- Yes
- Data localization required
- No
Governance
- DPO required
- No
- Impact assessment required
- No
- Records of processing required
- No
Identity
- Effective date
- 2005-04-01
- Effective status
- in-force
- Last amended
- 2022-04-01
- Law status
- active
Scope
- Extraterritorial application
- Yes
- Private sector coverage
- Applies to business operators handling personal information.
- Public sector coverage
- Separate administrative and independent agency rules apply to public-sector processing.
- Territorial scope
- Applies to business operators handling personal information in Japan and, in certain circumstances, outside Japan targeting individuals in Japan.
Legal Basis
- Legal bases
- consent, statutory exception, specified purpose use
- Requires legal basis
- No
Enforcement
- Maximum fine
- Enforcement includes administrative orders and criminal sanctions, with stronger penalties after recent amendments.
- Private right of action
- Yes
- Regulator or enforcement authority summary
- PPC
Definitions
- Personal data definition
- Personal information means information about a living individual that can identify the specific individual.
- Sensitive data recognized
- Yes
Rights
- Right of access
- Yes
- Right to appeal
- Yes
- Right to deletion
- Yes
- Right to erasure or delete summary
- Conditional deletion / suspension rights
- Right to object
- Yes
- Right to portability
- No
- Right to rectification or correction summary
- Correction rights for retained personal data
Official sources
- APPI textPrimary official law • en • html
- PPC guidanceSecondary official material • en • html