Data & Privacy · Japan
Data protection & privacy law in Japan (2026)
Japan shaded by its data & privacy status
Data protection in Japan: comprehensive law.
FrameworkAct on the Protection of Personal Information (APPI, Act No. 57 of 2003), administered by the Personal Information Protection Commission (PPC)
Japan has a comprehensive, GDPR-adjacent personal data protection regime centred on the Act on the Protection of Personal Information (APPI), supervised by the independent Personal Information Protection Commission (PPC). The APPI covers private- and public-sector handling of personal information, grants data-subject rights (access, correction, deletion, opt-out) and imposes purpose-limitation, breach-notification and cross-border transfer obligations. Japan and the EU operate a mutual adequacy arrangement in force since January 2019, and a further APPI amendment package introducing administrative fines, child-specific protections, biometric rules and an AI/statistics processing lane was promulgated on 17 July 2026, to enter into force within two years.
Key points
The APPI (Act No. 57 of 2003, as amended) is Japan's omnibus data-protection law, applying across the private sector and, since the 2021 unification, to national and local public bodies. The Personal Information Protection Commission (PPC) is the independent supervisory authority with guideline, investigation and enforcement powers.
Individuals have rights to be informed of purposes of use, to request disclosure, correction, addition, deletion, and cessation of use/third-party provision of their personal data held by business operators, including through opt-out channels in certain cases.
Operators must specify and limit purposes of use, obtain consent for sensitive 'special-care-required' data, implement security measures, keep records on third-party transfers, and notify the PPC and affected individuals of certain data breaches.
Transfers of personal data to a foreign recipient require either (i) data-subject consent after being informed of the destination country's regime, (ii) the recipient implementing APPI-equivalent protections with ongoing monitoring, or (iii) transfer to a jurisdiction designated by the PPC as providing equivalent protection (currently the EEA and UK).
Commission Implementing Decision (EU) 2019/419 of 23 January 2019 recognises Japan as providing an adequate level of protection, allowing personal data to flow from the EEA to Japan without additional safeguards. Japan reciprocated by designating the EEA under the APPI, backed by PPC-issued Supplementary Rules.
A bill approved by Cabinet on 7 April 2026 and passed by the Diet on 10 July 2026 was promulgated on 17 July 2026, taking effect within two years. It introduces administrative fines, enhanced PPC enforcement, protections for children under 16, a 'specific biometric personal information' category (e.g., facial recognition data), and a new consent exemption for statistical/AI-development processing with transparency safeguards.
Timeline - major decisions & events
Japan's Cabinet approved and submitted to the Diet a bill that, for the first time in APPI history, would let the PPC impose direct administrative monetary penalties (surcharges) for serious violations. It marks the biggest structural change to enforcement since the law's 2003 enactment.
Fisher Phillips ↗Concluding the mandatory triennial review, the Personal Information Protection Commission set out four reform themes and confirmed plans to add direct monetary penalties and risk-tailored rules. It defined the agenda for the 2026 amendment bill.
Personal Information Protection Commission ↗The PPC issued a business improvement order to insurance agents for improperly sharing policyholder data without consent. It illustrated the regulator's growing willingness to use formal orders rather than informal guidance.
ICLG ↗The PPC published an interim report flagging gaps in enforcement powers, breach-response duties and rules on new technologies such as AI. It signalled that stronger penalties and tighter data-use rules were coming.
Global Compliance News ↗The Commission's review concluded that Japan continues to provide an adequate level of protection for personal data transferred from the EU, preserving free EU-Japan data flows. It validated the convergence of APPI with the GDPR.
European Commission (EUR-Lex) ↗Messaging app LINE was found to have let engineers at a Chinese affiliate access Japanese users' personal data and to have stored data in South Korea without adequate disclosure. The scandal triggered a government probe and intensified scrutiny of cross-border data handling.
The Japan Times ↗Japan's Diet passed a sweeping amendment strengthening individual rights, cross-border transfer controls, breach-notification duties and penalties (raising corporate fines up to ¥100 million). It set the framework that took effect in April 2022.
Japanese Law Translation (Govt of Japan) ↗The European Commission adopted an adequacy decision recognizing Japan as providing 'essentially equivalent' data protection, while Japan made a reciprocal designation. It created the world's largest area of safe, free data flows and was the first post-GDPR adequacy finding.
European Commission ↗A subcontractor engineer copied and sold the personal data of roughly 35 million Benesse customers, prompting METI administrative guidance and Japan's largest multi-plaintiff privacy lawsuit. The incident catalyzed the 2015 reform of the APPI.
Winston & Strawn ↗Japan - other topics
Data & Privacy in other countries
Last verified 10/10/2026 · Orientation, not legal advice - verify against the primary sources linked above. Methodology & how to cite · State of Technology Regulation 2026 · Explore the full world map →