Japan's Act on the Protection of Personal Information (APPI) does not hand you a list of binders, but its articles imply what you should be able to show: stated purposes, security control measures, oversight of staff and vendors, transfer records, cross-border consent or safeguards, and a breach reporting process. This checklist turns those articles into evidence.
A note on the text
The English text we read is the Personal Information Protection Commission's June 2020 tentative translation of the amended Act. The PPC states only the original Japanese has legal effect, and article numbers and details have been updated since, including the consolidated text effective April 2023. Use this post to plan, then check the current Japanese law and PPC guidelines with counsel.
Purposes and acquisition
The Act requires that you tell people the purpose of use promptly, or publish it, after acquiring personal information (Article 18), and not acquire it by deceit (Article 17). Special care-required personal information needs prior consent in most cases.
Evidence: a data inventory with a stated purpose per data set, your published privacy notice, a change log when purposes change, and consent records for special care-required data.
Accuracy and deletion
Article 19 asks you to strive to keep data accurate and up to date and delete it without delay once unnecessary. Evidence: retention schedule, deletion job logs, and review dates.
Security control
Article 20 requires necessary and appropriate action for security control, including preventing leakage, loss or damage. The Act gives no control list, so you must justify what you chose.
Evidence: a written risk assessment, access control and encryption standards, logging, vulnerability management records, and test results. For software teams that includes dependency and code scanning reports showing issues found and fixed.
Employees and vendors
Article 21 requires supervision of employees who handle personal data. Article 22 requires supervision of entrusted parties, meaning processors. Evidence: training records, confidentiality terms, vendor due diligence files, contracts with security clauses, and periodic vendor reviews.
Third-party transfers
Article 23 restricts providing personal data to a third party without prior consent, subject to listed exceptions. Articles 25 and 26 require records when you provide data to, or receive it from, a third party, kept for a period set by PPC rules.
Evidence: a transfer register with date, recipient, data categories and legal basis, and a confirmation record for data you receive.
Cross-border transfers
Article 24 requires, in general, consent to a transfer abroad after you give the person information about the foreign country's protection system, unless the recipient is in a recognised country or maintains an equivalent system. Where equivalent measures are used, you must take steps to ensure they continue and answer requests for information.
Evidence: a map of data flows by country including cloud regions and support access, consent wording, and the contract terms used to ensure equivalent action.
Breach reporting
Article 22-2 requires reporting to the Commission, and notifying the individual, when a leakage, loss or damage with a large possibility of harming rights occurs, as set by PPC rules. A processor that has informed the controller as the rules describe can be exempt from reporting itself.
Evidence: an incident response plan, a severity test that includes the Commission's criteria, contact lists, and records of past exercises.
Individual rights
Article 27 requires making certain information about retained personal data knowable to the person, including the operator's name, purposes and the request procedure. Evidence: a published request procedure and a log with response times.
What to do
- Build the data inventory first. Every other item depends on it.
- Assign an owner for each article above.
- Collect existing evidence and mark gaps.
- Build the transfer and vendor registers.
- Run a breach tabletop and file the notes.
- Review all of it yearly and after major system changes.
- Have Japanese counsel confirm current article numbers and thresholds.
Safeguard's compliance automation can collect and organise evidence from connected systems, and its dependency scanning and SBOM output support the security control file. It does not make you APPI compliant.
Quick check
Does APPI list exact security controls?
The Article 20 text asks for necessary and appropriate action. It does not list controls, so you document your own choices and reasons.
Do you need records of third-party provision?
Yes in the text we read. Articles 25 and 26 require records on provision to and receipt from third parties, kept as PPC rules set.
Sources
- Amended Act on the Protection of Personal Information, tentative English translation, PPC Japan
- Laws and policies, PPC Japan
Last reviewed: 18 October 2026.
