Instruments
Each one links to its
LexLint note, which carries what it requires and what it flags on.
Biometric privacy
cite Act No. 57 of 2003 as amended by Act No. 37 of 2021, Art. 2(2)(i); Cabinet Order to Enforce the Act (Cabinet Order No. 507 of 2003, as amended), Art. 1
stage IN FORCE in force since 2022-04-01
binds public and private bodies
source official statute and Cabinet Order text, Japanese Law Translation portal
What it requires →
APPI reaches biometric identifiers through the concept of an individual identification code (Art. 2(2)(i)): a code converted to identify a specific individual by a distinguishing physical feature. Cabinet Order Art. 1 enumerates the covered features and names both facial appearance and vocal characteristics expressly, alongside DNA base sequence, iris pattern, gait, and palm or hand vein pattern.
Personal information containing an individual identification code is personal information in itself, without needing to be combined with other data, but it sits outside the Art. 2(3) sensitive personal information category, so its capture does not trigger the Art. 20(2) prior-consent requirement that applies to race, health data, and similar categories; disclosure to a third party instead requires the data subject's consent under the general third-party-provision rule, since data containing an individual identification code is excluded from the opt-out mechanism.
Breach notification
What it requires →
Art. 26(1) requires a business to report to the Personal Information Protection Commission any leak, loss, or damage of personal data that PPC order identifies as likely to harm individual rights and interests, following PPC-set procedure and timing; no duplicate report is needed where an entrusting business has already been notified. The administrative-entity mirror duty sits at Art. 68.
The PPC's own order or rules setting the specific report-timing thresholds and the individual-notification trigger were not independently read this pass, so this document records only the Art. 26 duty itself, not its procedural detail.
Comprehensive regime
What it requires →
The Act on the Protection of Personal Information (APPI) is Japan's single comprehensive personal-data statute, covering private businesses (Chapter IV), administrative organs (Chapter V), and independent administrative agencies since the 2021 merger amendment folded the former separate acts into one text. Lawful basis is purpose-of-use notice under Art. 15 plus a general prohibition on wrongful acquisition under Art. 20(1); there is no General Data Protection Regulation (GDPR)-style enumerated legal-basis list.
APPI regulates businesses handling personal information directly rather than a controller and processor split, and Art. 25 imposes supervision duties over any entrusted processor.
Cross border transfer
What it requires →
Art. 28 requires a data subject's prior consent before a business transfers personal data to a third party in a foreign country, unless the destination country is one the Personal Information Protection Commission (PPC) has recognized as having an equivalent personal-information protection system, or the recipient has established a system that continuously ensures measures equivalent to APPI's own Section 4 duties.
Before seeking consent, the business must disclose the destination country's protection system and the recipient's own measures. This is a real consent-or-adequacy restriction, correcting the derivation seed's earlier no-restriction record to moderate; there is no general data-localization mandate in APPI itself.
Enforcement supervision
What it requires →
The Personal Information Protection Commission (PPC) is Japan's independent supervisory authority, holding recommendation and order powers under Chapter VI. Violating a PPC order under Art. 148(2) or (3) is a criminal offense under Art. 178, punishable for an individual by imprisonment with work for not more than one year or a fine of not more than JPY 1,000,000.
APPI carries no dedicated statutory private right of action; a data subject's civil remedy runs through general tort law under Civil Code Art. 709, outside APPI itself, so enforcement of the statute is PPC-only.
