Before you read
This site is NOT legal advice, and using it creates no lawyer and client relationship. It is a set of findings, checked against published sources and dated, that may help software developers and other individuals. For a decision that matters, ask a qualified lawyer in the country concerned.
Japan
Sources last checked:
Japan’s Act on the Protection of Personal Information, the APPI, is enforced by the Personal Information Protection Commission.1
Source note: the official English translation reflects the Act as of 2021, so later changes may be missing from the sections below.
Who it covers
Businesses handling personal information in Japan, and businesses abroad that handle the information of people in Japan in connection with supplying them a good or service.2
Your rights
You can ask a business to disclose your data,3 correct, add to or delete it if it is not factual,4 and stop using or delete it if it is being handled in breach of certain rules.5
When data leaks
A business must report leaks, loss or damage likely to harm people’s rights to the Commission.6
Sending data abroad
Before providing data to a third party abroad, a business generally needs the person’s consent, with exceptions.7
The 2026 amendment
An amendment passed the Diet on 10 July 2026 and was promulgated on 17 July as Act No. 56 of 2026. It adds a surcharge taking away gains from serious violations, and stronger criminal penalties.89
Source note: this rests on search results from the Diet and the Commission; their documents are in Japanese and the amendment itself was not read, so its start dates are left out.
Penalties today
Breaking a Commission order can bring up to one year’s imprisonment or a fine of up to ¥1,000,000.10 Companies face separate fines.11