{ "jurisdiction_id": "JP", "jurisdiction": "Japan", "url": "https://dataprotection.gi/jurisdictions/japan/", "generator": "render_jid v13-gdpri-1.0.0", "date_modified": "2026-08-05", "schema_version": "gdpri-v2", "counts": { "categories": 10, "claims": 70, "sub_modules": 57, "source_register": 24 }, "categories": [ { "code": "regulator_and_framework", "name": "Regulator & Framework", "traffic_light": "green", "sub_modules": [ "act_and_instruments", "material_scope", "regulator_and_authority", "regulator_registration_and_filing", "territorial_scope" ], "url": "https://dataprotection.gi/jurisdictions/japan/#regulator-and-framework-regulator-framework", "traffic_light_rationale": "A mature, PPC-enforced omnibus statute is in force with EU/UK mutual adequacy recognition; amber-adjacent risk stems only from the pending 2026 reform bill not yet enacted.", "claims": [ { "statement": "The Personal Information Protection Commission (PPC) is Japan's independent supervisory authority responsible for oversight and enforcement of the APPI.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "PPC", "source_url": "https://www.ppc.go.jp/en/", "source_tier": null, "observed_at": null }, { "statement": "Following the 2021 APPI amendment, the PPC has exclusive supervisory authority over both private-sector business operators and public-sector Administrative Organs and Incorporated Administrative Agencies.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "EUR-Lex", "source_url": "https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:52023DC0275", "source_tier": null, "observed_at": null }, { "statement": "The APPI regime is composed of the Act itself plus a Cabinet Enforcement Order, PPC Enforcement Rules, and PPC Guidelines/Q&As that provide authoritative interpretation of the statute.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "EUR-Lex", "source_url": "https://eur-lex.europa.eu/eli/dec_impl/2019/419/oj/eng", "source_tier": null, "observed_at": null }, { "statement": "The APPI applies to personal information handling business operators (PIHBOs) — persons providing a personal information database for use in business — covering personal information, retained personal data, pseudonymised information and anonymously processed information.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "OneTrust DataGuidance", "source_url": "https://www.dataguidance.com/notes/japan-data-protection-financial-sector-0", "source_tier": null, "observed_at": null }, { "statement": "The APPI already applies extraterritorially to foreign business operators that acquire personal information directly from data subjects in relation to supplying goods or services to persons in Japan and handle that information abroad.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/practical-notes-for-japans-important-updates-of-the-appi-guidelines-and-qas", "source_tier": null, "observed_at": null }, { "statement": "The pending APPI amendment bill would expand extraterritorial application to foreign operators that handle personal information of Japan-based data subjects even where acquired indirectly, and would empower the PPC to compel reports from and issue orders to overseas companies.", "regulatory_stage": "proposed", "is_binding": true, "confidence": "Probable", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/practical-notes-for-japans-important-updates-of-the-appi-guidelines-and-qas", "source_tier": null, "observed_at": null }, { "statement": "There is no general controller registration regime under the APPI; the main filing duty is notifying the PPC when a business relies on the opt-out scheme to provide personal data to third parties without consent.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/analysis-of-japans-approved-bill-to-amend-the-appi", "source_tier": null, "observed_at": null } ] }, { "code": "lawful_processing_and_special_data", "name": "Lawful Processing & Special Data", "traffic_light": "amber", "sub_modules": [ "consent_thresholds", "lawful_bases", "pseudonymisation_and_anonymisation", "special_categories" ], "url": "https://dataprotection.gi/jurisdictions/japan/#lawful-processing-and-special-data-lawful-processing-special-data", "traffic_light_rationale": "Core consent/sensitive-data rules are settled and in force, but the absence of a GDPR Art 6-style lawful-basis architecture and the unresolved biometric/AI carve-outs create interpretive gaps pending the 2026 reform.", "claims": [ { "statement": "Unlike the GDPR, the APPI does not require a legal basis for all processing of personal information, relying instead on purpose specification and consent only at specific junctures.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/japan-s-dpa-publishes-interim-summary-of-amendments-to-data-protection-regulations", "source_tier": null, "observed_at": null }, { "statement": "Operators handling personal information are in principle required to obtain data subjects' prior consent before providing personal data to third parties, subject to opt-out and joint-use exceptions.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/japan-s-dpa-publishes-interim-summary-of-amendments-to-data-protection-regulations", "source_tier": null, "observed_at": null }, { "statement": "The current APPI generally requires data subjects' consent for the collection of special care-required (sensitive) personal information such as race and medical history.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/japan-enacts-the-act-on-the-protection-of-personal-information", "source_tier": null, "observed_at": null }, { "statement": "Biometric data is not currently categorised as sensitive personal information under Japanese law, and no dedicated biometric-handling rules yet exist.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/japan-s-dpa-publishes-interim-summary-of-amendments-to-data-protection-regulations", "source_tier": null, "observed_at": null }, { "statement": "The pending APPI amendment bill would introduce a 'Specific Biometric Personal Information' category (facial recognition data) requiring notice to data subjects and granting an unconditional right to demand suspension of use.", "regulatory_stage": "proposed", "is_binding": true, "confidence": "Probable", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/navigating-japan-s-proposed-appi-amendments-key-timelines-open-issues-and-action-points", "source_tier": null, "observed_at": null }, { "statement": "The 2020 APPI amendment introduced 'pseudonymised information,' a category limited to internal statistical use, exempting operators from certain obligations such as responding to disclosure or cessation-of-use demands for retained personal data.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/japan-updates-enforcement-rules-for-amended-appi", "source_tier": null, "observed_at": null } ] }, { "code": "data_subject_rights", "name": "Data Subject Rights", "traffic_light": "green", "sub_modules": [ "access_right", "data_portability", "deadlines_and_response_windows", "rectification_and_erasure", "restriction_and_objection" ], "url": "https://dataprotection.gi/jurisdictions/japan/#data-subject-rights-data-subject-rights", "traffic_light_rationale": "Core access/rectification/erasure/objection rights are codified and were substantially strengthened by the 2020/2022 amendments; residual amber factor is the absence of a fixed response-time statute and of an explicit portability right.", "claims": [ { "statement": "Data subjects have the right to demand disclosure of retained personal data held by a business operator.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "PPC", "source_url": "https://www.ppc.go.jp/files/pdf/APPI_english.pdf", "source_tier": null, "observed_at": null }, { "statement": "A business operator must disclose retained personal data to a data subject without delay, subject to statutory exceptions such as risk of harm to life or improper interference with business operations.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "PPC", "source_url": "https://www.ppc.go.jp/files/pdf/APPI_english.pdf", "source_tier": null, "observed_at": null }, { "statement": "Data subjects may demand correction, addition or deletion of the content of retained personal data.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/japan-enacts-the-act-on-the-protection-of-personal-information", "source_tier": null, "observed_at": null }, { "statement": "The 2020/2022 amendment expanded data subjects' rights to demand cessation of use, deletion, or cessation of third-party provision of retained personal data to cases where a data subject's rights or legitimate interests are likely to be infringed, beyond the prior narrow grounds of purpose-violation, improper collection, or unlawful third-party provision.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/analysis-of-japans-approved-bill-to-amend-the-appi", "source_tier": null, "observed_at": null }, { "statement": "The 2020/2022 amendment allows data subjects to require that their retained personal data be disclosed to them electronically, whereas the prior law did not expressly permit electronic-format disclosure demands.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/analysis-of-japans-approved-bill-to-amend-the-appi", "source_tier": null, "observed_at": null }, { "statement": "The APPI does not contain a distinct data-portability right equivalent to GDPR Article 20; electronic disclosure of retained personal data is the closest functional analogue.", "regulatory_stage": null, "is_binding": false, "confidence": "Probable", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/analysis-of-japans-approved-bill-to-amend-the-appi", "source_tier": null, "observed_at": null } ] }, { "code": "controller_processor_duties", "name": "Controller/Processor Duties", "traffic_light": "amber", "sub_modules": [ "accountability_and_dpia", "breach_notification", "dpo_requirements", "joint_controller_arrangements", "retention_and_disposal", "ropa_requirements", "security_measures" ], "url": "https://dataprotection.gi/jurisdictions/japan/#controller-processor-duties-controller-processor-duties", "traffic_light_rationale": "Breach-notification and security-measure duties are robust and in force, but the absence of DPO, formal DPIA, and general ROPA requirements — core GDPR-analogue accountability tools — represents a structural gap relative to omnibus peers.", "claims": [ { "statement": "The APPI does not impose a mandatory Data Protection Impact Assessment process equivalent to GDPR Article 35.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "OneTrust DataGuidance", "source_url": "https://www.dataguidance.com/sites/default/files/gdpr_v_appi.pdf", "source_tier": null, "observed_at": null }, { "statement": "The APPI does not include a requirement to appoint a Data Protection Officer.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "OneTrust DataGuidance", "source_url": "https://www.dataguidance.com/sites/default/files/gdpr_v_appi_june_2021_update_.pdf", "source_tier": null, "observed_at": null }, { "statement": "The amended Cabinet Order and Enforcement Rules impose record-keeping obligations on providers of personal data to third parties, covering confirmation of consent, date of provision, recipient details and data categories, generally retained for three years.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/japan-updates-enforcement-rules-for-amended-appi", "source_tier": null, "observed_at": null }, { "statement": "Where a business relies on a 'joint use' mechanism to share personal data with others, the APPI requires disclosure of the address of the business managing the jointly used data and the name of its representative.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/practical-notes-for-the-amended-appi-how-to-amend-privacy-notices", "source_tier": null, "observed_at": null }, { "statement": "Businesses must implement organisational, personnel, physical and technical security-control measures over personal data, and the amended guidelines additionally require 'understanding of the external environment' when personal data is processed in a foreign country.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/practical-notes-for-the-amended-appi-how-to-amend-privacy-notices", "source_tier": null, "observed_at": null }, { "statement": "The amended APPI implements a legal obligation to report to the PPC and notify affected data subjects when a data breach (leakage, loss or damage) occurs or is likely to have occurred, replacing the prior mere 'duty to make an effort.'", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/japan-updates-enforcement-rules-for-amended-appi", "source_tier": null, "observed_at": null }, { "statement": "Breach reporting follows a two-stage process: a preliminary report filed promptly (generally within three to five days for corporations) after recognition of a potential breach, and a final report within 30 days (60 days for cyberattack-related breaches).", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/practical-notes-for-japans-important-updates-of-the-appi-guidelines-and-qas", "source_tier": null, "observed_at": null }, { "statement": "Business operators must delete personal data without delay once its utilisation is no longer necessary for the specified purpose, though the APPI does not fix a general maximum retention period.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "OneTrust DataGuidance", "source_url": "https://www.dataguidance.com/sites/default/files/gdpr_v_appi_june_2021_update_.pdf", "source_tier": null, "observed_at": null } ] }, { "code": "cross_border_and_adequacy", "name": "Cross-Border & Adequacy", "traffic_light": "green", "sub_modules": [ "adequacy_granted", "adequacy_received", "data_localisation", "sccs_and_bcrs", "transfer_impact_assessment", "transfer_mechanisms" ], "url": "https://dataprotection.gi/jurisdictions/japan/#cross-border-and-adequacy-cross-border-adequacy", "traffic_light_rationale": "A functioning, reviewed mutual adequacy arrangement with the EU/UK and codified transfer mechanisms place this module on solid footing; amber-adjacent nuance is the still-evolving TIA/monitoring guidance under the pending 2026 reform.", "claims": [ { "statement": "A cross-border transfer of personal data from Japan can be permitted based on either the data subject's consent or the establishment of an equivalent personal information protection system at the recipient.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/practical-notes-for-japans-important-updates-of-the-appi-guidelines-and-qas", "source_tier": null, "observed_at": null }, { "statement": "The EU-Japan arrangement adopted in January 2019 was the first-ever mutual (two-way) adequacy finding, with the PPC recognising the EU as a jurisdiction with an equivalent data-protection system alongside the Commission's reciprocal finding.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "EUR-Lex", "source_url": "https://eur-lex.europa.eu/eli/dec_impl/2019/419/oj/eng", "source_tier": null, "observed_at": null }, { "statement": "The European Commission's Implementing Decision (EU) 2019/419 found that Japan ensures an adequate level of protection for personal data transferred from the EU to APPI-regulated business operators.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "EUR-Lex", "source_url": "https://eur-lex.europa.eu/eli/dec_impl/2019/419/oj/eng", "source_tier": null, "observed_at": null }, { "statement": "The European Commission's first periodic review, concluded in 2023, found that Japan continues to ensure an adequate level of protection for EU-origin personal data and moved the review cycle from two to four years.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "EUR-Lex", "source_url": "https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:52023DC0275", "source_tier": null, "observed_at": null }, { "statement": "The PPC has adopted binding Supplementary Rules under the APPI for the handling of personal data transferred from the EU and the United Kingdom based on an adequacy decision, enforceable by the PPC and directly by individuals in Japanese courts.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "PPC", "source_url": "https://www.ppc.go.jp/en/legal/", "source_tier": null, "observed_at": null }, { "statement": "Where a cross-border transfer relies on the recipient's established protection system, the operator must regularly monitor that system (guidelines clarify a frequency of at least once a year) and explain the monitoring frequency and method to data subjects upon request.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Probable", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/practical-notes-for-japans-important-updates-of-the-appi-guidelines-and-qas", "source_tier": null, "observed_at": null }, { "statement": "No general data-localisation requirement applies to ordinary personal information handled by APPI-regulated business operators.", "regulatory_stage": null, "is_binding": false, "confidence": "Probable", "source_publisher": "OneTrust DataGuidance", "source_url": "https://free.dataguidance.com/laws/japan-act-on-the-protection-of-personal-information-2/", "source_tier": null, "observed_at": null } ] }, { "code": "sectoral_watch", "name": "Sectoral Watch", "traffic_light": "amber", "sub_modules": [ "credit_and_scoring", "education", "employment_data", "financial_sector_overlay", "health_sector_overlay", "insurance", "telecoms_and_eprivacy" ], "url": "https://dataprotection.gi/jurisdictions/japan/#sectoral-watch-sectoral-watch", "traffic_light_rationale": "Financial-sector and My Number overlays are well-documented and in force; telecoms/ePrivacy, education and insurance sector-specific DP overlays are not clearly codified, producing residual coverage gaps.", "claims": [ { "statement": "The Financial Services Agency (FSA) has issued guidelines for personal-information protection in the financial industries, supplementing the general APPI regime for financial-sector operators other than credit-card businesses.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "OneTrust DataGuidance", "source_url": "https://free.dataguidance.com/laws/japan-act-on-the-protection-of-personal-information-2/", "source_tier": null, "observed_at": null }, { "statement": "No comprehensive health-sector-specific statute analogous to HIPAA was identified; medical history is treated as special care-required personal information under the general APPI consent rule.", "regulatory_stage": null, "is_binding": false, "confidence": "Uncertain", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/japan-enacts-the-act-on-the-protection-of-personal-information", "source_tier": null, "observed_at": null }, { "statement": "No dedicated telecoms/ePrivacy-style statute governing cookies or electronic-communications metadata distinct from the general APPI regime was identified as currently in force.", "regulatory_stage": null, "is_binding": false, "confidence": "Uncertain", "source_publisher": "OneTrust DataGuidance", "source_url": "https://free.dataguidance.com/laws/japan-act-on-the-protection-of-personal-information-2/", "source_tier": null, "observed_at": null }, { "statement": "The My Number Act and related guidelines require employers to establish appropriate secure-storage and handling systems for employees' 'specific personal information,' which are generally stricter than an employer's other APPI-based obligations.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "OneTrust DataGuidance", "source_url": "https://free.dataguidance.com/laws/japan-act-on-the-protection-of-personal-information-2/", "source_tier": null, "observed_at": null }, { "statement": "The Ministry of Economy, Trade and Industry (METI) has issued dedicated guidelines for personal-information protection in the credit-card industry.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "OneTrust DataGuidance", "source_url": "https://free.dataguidance.com/laws/japan-act-on-the-protection-of-personal-information-2/", "source_tier": null, "observed_at": null }, { "statement": "No education-sector-specific data-protection statute was identified; the PPC's ongoing children's-data reform explicitly weighs the usefulness of student education/learning data against protective considerations.", "regulatory_stage": null, "is_binding": false, "confidence": "Uncertain", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/japan-s-dpa-publishes-interim-summary-of-amendments-to-data-protection-regulations", "source_tier": null, "observed_at": null }, { "statement": "No insurance-sector-specific personal-information statute distinct from the FSA's general financial-industry guidance was identified.", "regulatory_stage": null, "is_binding": false, "confidence": "Uncertain", "source_publisher": "OneTrust DataGuidance", "source_url": "https://free.dataguidance.com/laws/japan-act-on-the-protection-of-personal-information-2/", "source_tier": null, "observed_at": null } ] }, { "code": "adtech_and_commercial_privacy", "name": "AdTech & Commercial Privacy", "traffic_light": "amber", "sub_modules": [ "clean_rooms_and_dcr", "cookies_and_trackers", "cross_context_advertising", "dark_patterns", "direct_marketing", "opt_out_signals" ], "url": "https://dataprotection.gi/jurisdictions/japan/#adtech-and-commercial-privacy-adtech-commercial-privacy", "traffic_light_rationale": "Opt-out and third-party data-provision rules are codified and enforceable, but dark-patterns, standardised opt-out signals, and clean-room-specific rules are absent, and reform of the opt-out scheme itself remains pending.", "claims": [ { "statement": "Where a business provides information about a living individual that is not itself personal information (e.g., website browsing history via cookies), and the recipient is likely to receive it in a form that becomes personal data, the provider must confirm the recipient has obtained the data subject's consent.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/japan-updates-enforcement-rules-for-amended-appi", "source_tier": null, "observed_at": null }, { "statement": "No dedicated statutory prohibition on dark patterns in consent or data-collection interfaces was identified under current Japanese data-protection law.", "regulatory_stage": null, "is_binding": false, "confidence": "Uncertain", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/japan-s-dpa-publishes-interim-summary-of-amendments-to-data-protection-regulations", "source_tier": null, "observed_at": null }, { "statement": "No legally-recognised, standardised browser/device opt-out signal mechanism analogous to the Global Privacy Control was identified under the APPI.", "regulatory_stage": null, "is_binding": false, "confidence": "Uncertain", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/japan-s-dpa-publishes-interim-summary-of-amendments-to-data-protection-regulations", "source_tier": null, "observed_at": null }, { "statement": "No rules specific to data clean rooms or data-collaboration platforms distinct from general third-party-provision and joint-use requirements were identified.", "regulatory_stage": null, "is_binding": false, "confidence": "Uncertain", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/practical-notes-for-the-amended-appi-how-to-amend-privacy-notices", "source_tier": null, "observed_at": null }, { "statement": "Personal data may be provided to third parties for purposes such as marketing without consent if the operator notifies data subjects of opt-out matters (or makes them easily accessible) and files with the PPC.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/analysis-of-japans-approved-bill-to-amend-the-appi", "source_tier": null, "observed_at": null }, { "statement": "The pending amendment would bar use of the opt-out scheme to provide personal data collected by deceit or improper means, or data that was itself received via another party's opt-out scheme, in response to observed abuse for fraud-adjacent list trading.", "regulatory_stage": "proposed", "is_binding": true, "confidence": "Probable", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/analysis-of-japans-approved-bill-to-amend-the-appi", "source_tier": null, "observed_at": null } ] }, { "code": "algorithmic_biometric_and_surveillance_governance", "name": "Algorithmic, Biometric & Surveillance Governance", "traffic_light": "amber", "sub_modules": [ "ai_risk_assessments", "automated_decision_making_transparency", "biometric_regime", "genetic_data", "profiling_restrictions", "state_surveillance_carveouts" ], "url": "https://dataprotection.gi/jurisdictions/japan/#algorithmic-biometric-and-surveillance-governance-algorithmic-biometric-surveill", "traffic_light_rationale": "AI-specific promotional legislation and sectoral biometric/genetic guidance exist, but core ADM/profiling and binding biometric protections remain in the proposal stage, and state-surveillance carve-outs limit PPC coercive reach over public bodies.", "claims": [ { "statement": "The PPC's triennial-review Interim Summary flags continued consideration of profiling regulation as an open policy issue for the APPI reform.", "regulatory_stage": "proposed", "is_binding": true, "confidence": "Probable", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/japan-s-dpa-publishes-interim-summary-of-amendments-to-data-protection-regulations", "source_tier": null, "observed_at": null }, { "statement": "The pending APPI amendment bill would create a 'Specific Biometric Personal Information' category for facial-recognition data, requiring notice/accessibility to data subjects and an unconditional right to demand suspension of use.", "regulatory_stage": "proposed", "is_binding": true, "confidence": "Probable", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/navigating-japan-s-proposed-appi-amendments-key-timelines-open-issues-and-action-points", "source_tier": null, "observed_at": null }, { "statement": "Neither the APPI nor PPC Guidelines contain comprehensive legal provisions on automated decision-making and profiling; only limited sectoral rules address the matter without an overarching protective framework.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "EUR-Lex", "source_url": "https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:52018IP0529", "source_tier": null, "observed_at": null }, { "statement": "Japan enacted the Act on Promotion of Research and Development, and Utilization of AI-related Technology (AI Promotion Act) in May 2025, which came into full effect in September 2025.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/resources/article/global-ai-governance-japan", "source_tier": null, "observed_at": null }, { "statement": "Japan's AI Business Operator Guidelines consolidate AI-governance principles and best practices but constitute non-binding soft guidance rather than a mandatory AI-specific risk-assessment regime.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/resources/article/global-ai-governance-japan", "source_tier": null, "observed_at": null }, { "statement": "METI has issued non-binding sectoral guidelines for the protection of personal information in industries using genetic information of individuals.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "OneTrust DataGuidance", "source_url": "https://free.dataguidance.com/laws/japan-act-on-the-protection-of-personal-information-2/", "source_tier": null, "observed_at": null }, { "statement": "The PPC's triennial-review Interim Summary lists regulation of genomic data among issues requiring continued consideration.", "regulatory_stage": "proposed", "is_binding": true, "confidence": "Probable", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/japan-s-dpa-publishes-interim-summary-of-amendments-to-data-protection-regulations", "source_tier": null, "observed_at": null }, { "statement": "Although the PPC oversees Administrative Organs' collection and processing of personal information, including law-enforcement and national-security data collection, it has not been empowered to issue binding orders to, or impose fines on, these public authorities; its tools are limited to reporting requests, on-site inspections, guidance, advice and recommendations.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "EUR-Lex", "source_url": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=SWD:2023:75:FIN&qid=1680566066374", "source_tier": null, "observed_at": null } ] }, { "code": "children_and_vulnerable_groups", "name": "Children & Vulnerable Groups", "traffic_light": "red", "sub_modules": [ "age_verification", "dependent_adults", "education_settings", "minor_profiling_bans", "parental_consent" ], "url": "https://dataprotection.gi/jurisdictions/japan/#children-and-vulnerable-groups-children-vulnerable-groups", "traffic_light_rationale": "No codified statutory age-of-consent, parental-consent mechanism, minor-profiling ban, or dependent-adults regime currently exists; all children's-data protections are at the proposal stage pending the 2026/2027 reform.", "claims": [ { "statement": "Under current law there are basically no explicit statutory provisions regarding the handling of children's personal information, and the APPI does not define the age of a child; PPC Q&A guidance indicates the applicable age can vary by data type and business nature, generally referencing ages 12-15 and under.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/japan-s-dpa-publishes-interim-summary-of-amendments-to-data-protection-regulations", "source_tier": null, "observed_at": null }, { "statement": "The PPC's triennial-review reform proposes formally defining those under 16 years old as children for APPI purposes.", "regulatory_stage": "proposed", "is_binding": true, "confidence": "Probable", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/japan-s-dpa-publishes-interim-summary-of-amendments-to-data-protection-regulations", "source_tier": null, "observed_at": null }, { "statement": "The reform proposes strengthening safety-control-measure obligations specific to children's personal data, including a requirement that operators prioritise and give special consideration to the best interests of children.", "regulatory_stage": "proposed", "is_binding": true, "confidence": "Probable", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/japan-s-dpa-publishes-interim-summary-of-amendments-to-data-protection-regulations", "source_tier": null, "observed_at": null }, { "statement": "The PPC's reform discussion explicitly weighs the vulnerability and need for protection of children's data against the usefulness of student education and learning data, without proposing a dedicated education-sector statute.", "regulatory_stage": null, "is_binding": false, "confidence": "Uncertain", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/japan-s-dpa-publishes-interim-summary-of-amendments-to-data-protection-regulations", "source_tier": null, "observed_at": null }, { "statement": "No dedicated dependent-adults data-protection regime exists; the PPC has instead flagged demand to regulate malicious personal-information list providers as a countermeasure against criminal groups using elderly individuals' financial information to commit fraud.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/japan-s-dpa-publishes-interim-summary-of-amendments-to-data-protection-regulations", "source_tier": null, "observed_at": null } ] }, { "code": "enforcement_and_redress", "name": "Enforcement & Redress", "traffic_light": "amber", "sub_modules": [ "collective_redress_and_class_actions", "enforcement_activity_index", "private_right_of_action", "recent_developments_180d", "regulator_funding_and_capacity", "regulator_powers_and_penalties" ], "url": "https://dataprotection.gi/jurisdictions/japan/#enforcement-and-redress-enforcement-redress", "traffic_light_rationale": "Criminal-penalty enforcement architecture and civil tort redress are settled and in force, but the absence of PPC administrative fining power and of a codified collective-redress mechanism — both under active reform — constrain current enforcement intensity.", "claims": [ { "statement": "The PPC has made greater use of non-coercive powers of guidance and advice than of coercive powers such as binding orders under Article 148 of the APPI.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "EUR-Lex", "source_url": "https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:52023DC0275", "source_tier": null, "observed_at": null }, { "statement": "Violating a binding PPC order carries imprisonment with labour of up to one year or a fine of up to JPY 1,000,000 for individuals, and a fine of up to JPY 100 million for corporate entities.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/analysis-of-japans-approved-bill-to-amend-the-appi", "source_tier": null, "observed_at": null }, { "statement": "Submitting a false report to the PPC carries a fine of up to JPY 500,000.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/analysis-of-japans-approved-bill-to-amend-the-appi", "source_tier": null, "observed_at": null }, { "statement": "The PPC does not have the power to impose administrative monetary fines directly, unlike GDPR supervisory authorities; sanctions for APPI violations are criminal and imposed by courts.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "OneTrust DataGuidance", "source_url": "https://www.dataguidance.com/sites/default/files/gdpr_v_appi.pdf", "source_tier": null, "observed_at": null }, { "statement": "Between 1 April 2019 and 30 September 2020, the PPC reported issuing five recommendations and two binding orders, with no business operator sanctioned by fine or imprisonment for violating a binding order in that period.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "EUR-Lex", "source_url": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=SWD:2023:75:FIN&qid=1680566066374", "source_tier": null, "observed_at": null }, { "statement": "The 2021 APPI amendment expanded the PPC's enforcement powers and led to an increase in its resources.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "EUR-Lex", "source_url": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=SWD:2023:75:FIN&qid=1680566066374", "source_tier": null, "observed_at": null }, { "statement": "The PPC is considering establishing a new system of injunctive relief and restoration of damages operated by qualified organisations, as part of its four-pronged enforcement-strengthening review.", "regulatory_stage": "proposed", "is_binding": true, "confidence": "Probable", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/japan-s-dpa-publishes-interim-summary-of-amendments-to-data-protection-regulations", "source_tier": null, "observed_at": null }, { "statement": "Civil Code Article 709 provides the main general ground for civil litigation for damages arising from privacy or data-protection infringements in Japan.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "EUR-Lex", "source_url": "https://eur-lex.europa.eu/eli/dec_impl/2019/419/oj/eng", "source_tier": null, "observed_at": null }, { "statement": "On 9 January 2026, the PPC decided its System Reform Policy under the triennial review of the Act on the Protection of Personal Information.", "regulatory_stage": "proposed", "is_binding": true, "confidence": "Confirmed", "source_publisher": "PPC", "source_url": "https://www.ppc.go.jp/en/", "source_tier": null, "observed_at": null }, { "statement": "Japan's Cabinet approved a bill to amend the Act on the Protection of Personal Information on 7 April 2026 and submitted it to the Diet, where it was expected to be enacted during that session.", "regulatory_stage": "proposed", "is_binding": true, "confidence": "Probable", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/navigating-japan-s-proposed-appi-amendments-key-timelines-open-issues-and-action-points", "source_tier": null, "observed_at": null } ] } ] }