#
A mature, PPC-enforced omnibus statute is in force with EU/UK mutual adequacy recognition; amber-adjacent risk stems only from the pending 2026 reform bill not yet enacted.
Sub-modules (5)
Regulator And AuthorityGreen
The PPC is Japan's independent data protection authority with exclusive oversight of both private- and public-sector personal information handling since the 2021 amendment.
Claims (2):
- The Personal Information Protection Commission (PPC) is Japan's independent supervisory authority responsible for oversight and enforcement of the APPI.
- Following the 2021 APPI amendment, the PPC has exclusive supervisory authority over both private-sector business operators and public-sector Administrative Organs and Incorporated Administrative Agencies.
Act And InstrumentsGreen
The APPI is complemented by its Cabinet Enforcement Order, PPC Enforcement Rules, PPC Guidelines/Q&As, and EU/UK-specific Supplementary Rules.
Claims (1):
- The APPI regime is composed of the Act itself plus a Cabinet Enforcement Order, PPC Enforcement Rules, and PPC Guidelines/Q&As that provide authoritative interpretation of the statute.
Material ScopeGreen
The APPI applies to 'personal information handling business operators' (PIHBOs) processing personal information databases in the course of business, covering personal information, retained personal data, pseudonymised information and anonymously processed information.
Claims (1):
- The APPI applies to personal information handling business operators (PIHBOs) — persons providing a personal information database for use in business — covering personal information, retained personal data, pseudonymised information and anonymously processed information.
Territorial ScopeAmber
Current law already applies extraterritorially to foreign operators acquiring data of Japan-based individuals in connection with supplying goods/services; the pending amendment would broaden this to indirectly-acquired data and add enforcement powers over overseas entities.
Claims (2):
- The APPI already applies extraterritorially to foreign business operators that acquire personal information directly from data subjects in relation to supplying goods or services to persons in Japan and handle that information abroad.
- The pending APPI amendment bill would expand extraterritorial application to foreign operators that handle personal information of Japan-based data subjects even where acquired indirectly, and would empower the PPC to compel reports from and issue orders to overseas companies.
Regulator Registration And FilingAmber
There is no general controller registration regime; the principal filing obligation is notification to the PPC when relying on the opt-out mechanism for third-party data provision.
Claims (1):
- There is no general controller registration regime under the APPI; the main filing duty is notifying the PPC when a business relies on the opt-out scheme to provide personal data to third parties without consent.
Regulator & Framework
Japan's data-protection framework is anchored, as before, in the Act on the Protection of Personal Information, overseen by the Personal Information Protection Commission, but the framework is now in a defined period of pending structural change. Act No. 56 of 2026 was passed by the Diet on 10 July 2026 and promulgated on 17 July 2026. Its main body is understood to enter into force on a date fixed by Cabinet order within two years of promulgation, placing likely commencement at approximately mid-2028. This two-year ceiling on the commencement window is a standard legislative-drafting device in Japan for substantial statutory amendments, giving the government flexibility to coordinate subordinate regulations, PPC guidelines, and industry transition arrangements before the amendment takes legal effect, while fixing an outer limit beyond which delay is not permitted.
The amendment is reported, across multiple independent law-firm sources, as a wide-ranging revision touching lawful-processing bases, breach-notification exemptions, biometric-data rules, minors' data provisions, and PPC enforcement powers, several of which are addressed in their own right elsewhere in this brief. Because the main body has not yet commenced, the current operative version of the APPI, including its existing consent, breach-notification, and enforcement provisions, remains in force unchanged in the interim, and businesses operating in Japan continue to be assessed against the pre-amendment statutory text for the time being.
The precise source document establishing promulgation and the two-year commencement ceiling is secondary law-firm commentary rather than the Official Gazette text itself, a limitation that applies across the structural facts summarised in this section; the core facts of passage, promulgation, and the two-year ceiling are nonetheless consistently reported.
Outlook
The principal outstanding item for this module is the specific Cabinet order date fixing the main body's commencement within the two-year window running from 17 July 2026. Until that order is issued, the operative APPI framework remains the pre-amendment text, and firms assessing their compliance posture against Act No. 56/2026's various new provisions are necessarily doing so on a forward-looking, not-yet-binding basis. Subsequent cycles may surface the specific Cabinet order date, or interim PPC guidance clarifying the implementation timetable for particular provisions, including those reported as commencing earlier than the main body.
2 earlier distinct update(s)
Regulator & Framework
The Personal Information Protection Commission (PPC) is Japan's single national data-protection supervisory authority under the APPI, holding investigatory, guidance, recommendation, and order powers, and gaining administrative-fine powers once Act No. 56 of 2026 commences. Act No. 56 of 2026 was passed by the Diet on 10 July 2026 and promulgated on 17 July 2026. It is not yet in force; implementation is expected by Cabinet Order within two years of promulgation, no later than July 2028. On 7 September 2026 the PPC discussed its basic concept for developing the implementing rules for the amended APPI, with a stated focus on data-utilisation rulemaking and youth-data protection, giving an early indication of how the PPC intends to approach the rulemaking process ahead of the statutory deadline.
This is Japan's most significant data-protection reform since the 2020 and 2022 APPI amendments, introducing the PPC's first administrative-fine power, the APPI's first minors-specific provision, and heightened biometric-data governance, all on a multi-year implementation runway extending to no later than July 2028.
Outlook
The exact Cabinet Order commencement date or dates for Act No. 56/2026's various provisions have not yet been published. The PPC's September 2026 discussion of its implementing-rules basic concept is the clearest early signal of direction, but the specific rulemaking timetable, and whether the administrative-fine, biometric, and minors provisions will commence together or in phases, remains to be determined ahead of the July 2028 outer deadline.
Regulator & Framework
The Personal Information Protection Commission (PPC) is Japan's independent data-protection authority enforcing the Act on the Protection of Personal Information (APPI). The APPI Amendment Act was Cabinet-approved on 7 April 2026, passed the Diet on 10 July 2026, and promulgated on 17 July 2026, with commencement by Cabinet order due no later than July 2028; until then, the current APPI framework continues to govern day-to-day compliance obligations. The APPI applies to any Personal Information Handling Business Operator processing the data of individuals in Japan, with no size threshold and extraterritorial reach to foreign operators.
Outlook
The defining variable for this module over the next two years is the timing of the Cabinet order that will actually commence the amendment. No exact date has been fixed within the July 2028 outer limit, and the PPC's institutional role as enforcer is set to expand materially once that order takes effect.
Sources and claims (7)
- ConfirmedPPC — The Personal Information Protection Commission (PPC) is Japan's independent supervisory authority responsible for oversight and enforcement of the APPI.observed
- ConfirmedEUR-Lex — Following the 2021 APPI amendment, the PPC has exclusive supervisory authority over both private-sector business operators and public-sector Administrative Organs and Incorporated Administrative Agencies.observed
- ConfirmedEUR-Lex — The APPI regime is composed of the Act itself plus a Cabinet Enforcement Order, PPC Enforcement Rules, and PPC Guidelines/Q&As that provide authoritative interpretation of the statute.observed
- ConfirmedOneTrust DataGuidance — The APPI applies to personal information handling business operators (PIHBOs) — persons providing a personal information database for use in business — covering personal information, retained personal data, pseudonymised information and anonymously processed information.observed
- ConfirmedIAPP — The APPI already applies extraterritorially to foreign business operators that acquire personal information directly from data subjects in relation to supplying goods or services to persons in Japan and handle that information abroad.observed
- ProbableIAPP — The pending APPI amendment bill would expand extraterritorial application to foreign operators that handle personal information of Japan-based data subjects even where acquired indirectly, and would empower the PPC to compel reports from and issue orders to overseas companies.observed
- ConfirmedIAPP — There is no general controller registration regime under the APPI; the main filing duty is notifying the PPC when a business relies on the opt-out scheme to provide personal data to third parties without consent.observed