← Global Privacy Laws Research Library
Act on the Protection of Personal Information
Act on the Protection of Personal Information: Japan (APPI)
Prepared by Shubhank Suman · Last reviewed
Current and operative
- Legal character
- National Act
- Region
- Asia-Pacific
What it covers
The APPI is Japan's principal comprehensive personal-information law. It regulates the handling of personal information by business operators and establishes rules covering purpose specification, use, acquisition, security, third-party provision, overseas transfers, rights of individuals and enforcement.
The current framework also contains Japan-specific rules for information that has been anonymised, pseudonymised, or otherwise handled differently from ordinary personal data.
AI, privacy and cybersecurity relevance
- AI: High
- Privacy: Very High
- Cyber: Very High
AI
High / indirect
The APPI is not an AI Act.
It becomes important to AI because AI systems can:
- train on personal information
- generate profiles
- infer information about individuals
- use personal data for model development
- transfer personal data to AI providers
- process data through automated systems.
Japan's 2026 triennial-review process is examining further reforms to the APPI, but that reform policy should not be confused with enacted amendments. (PPC Japan)
Privacy
Very High
Important provisions include:
Article 15: specification of purpose of use Article 16: restriction on use beyond the purpose Article 17: proper acquisition Article 19: maintenance of accuracy Article 20: security-control measures Articles 21–22: supervision of employees and entrusted parties Article 23 onward: third-party provision and related controls Article 25: records relating to third-party provision Article 26: confirmation/records relating to received third-party data Article 28: provision to third parties in foreign countries.
The PPC's official material expressly confirms Article 15's purpose specification and Article 16's purpose limitation. (PPC Japan)
Cybersecurity
Very High
Article 20 requires necessary and appropriate security-control measures to prevent leakage, loss or damage and otherwise ensure security. (EUR-Lex)
This is supplemented by PPC guidelines addressing organisational, human, physical and technical security controls.
Applicability
Applies principally to entities handling personal information under the APPI framework, subject to statutory exclusions and sector-specific rules.
Current validity
CURRENT
Read first
Articles 15–17 → Articles 19–23 → Articles 25–28 → PPC security and international-transfer guidelines.
Provisions / sections covered
Cross-border relevance
Article 28 governs provision of personal data to third parties in foreign countries. Japan also has an adequacy relationship with the EU and UK, and the PPC has specific supplementary rules for EU/UK transfers. (PPC Japan)
Subject-matter tags
- Consent
- Sensitive data
- Profiling
- Data breach
- Cross-border transfers
- Data protection officer
- Employment data
- Enforcement and penalties
- Anonymisation
- Accountability
Subject-matter tags describe what the indexed text discusses. They are not legal conclusions.
Related instruments in this library
Document page in the Knowledge Base - full text or PDF where it is available for this record.
This library locates primary and official sources. It does not interpret the law and it is not legal advice.