How does Japan's APPI affect your software supply chain and SBOM?

Japan's APPI does not mention software bills of materials. Its duties do reach your supply chain, though. A business must take security control action and supervise trustees who handle personal data. An inventory of components, hosts and vendors is how you show that you know who and what touches the data.

Where does the supply chain enter the law?

Three duties in the English translation we read (a 2016 version, so check current numbering) bear on software:

• Security control: "necessary and appropriate action" to prevent leakage, loss or damage of personal data it handles.
• Supervision over employees who handle the data.
• Supervision over a trustee: when handling is entrusted in whole or in part, the business must exercise "necessary and appropriate supervision" over the entrusted person to seek security control of that data.

The Act itself does not define technical measures. The Personal Information Protection Commission publishes guidelines for that, which you should read for the detail. Nothing we fetched says an SBOM is required.

Is a library a trustee?

Usually not. An open source library running inside your own process is code you ship, not a party you hand data to. A vendor's hosted API that receives personal data is closer to a trustee. The split matters because the supervision duty is clearest for the second kind.

A constructed example: a Japanese ecommerce app uses a rendering library (code in your build) and a hosted review moderation service (receives customer names and comments). For the library you need to know its version, its known vulnerabilities and who maintains it. For the service you need a contract, a data list and a record of how you checked its safeguards.

Why do components still matter?

A vulnerability in a library can cause the leakage that the security control duty is about. If a flaw in a web framework exposes customer records, the regulator's question is not whether the framework was yours. It is whether you took necessary and appropriate action. A current inventory lets you answer in an hour which services run the vulnerable version.

What does a useful inventory hold?

• Components per release: name, version, source, licence, and a hash if you have one.
• Hosted services that receive personal data: vendor, data fields, location, contract date.
• Data flows out of Japan, because the Act has a separate rule on provision to a third party in a foreign country.
• Owners: a named person for each service and each application.

You can keep this in a spreadsheet and generate the component part with a scanner. Safeguard supports SBOM generation and dependency scanning, and its free in-browser scan at gold.safeguard.sh/scan covers up to 100 dependencies if you want to try the idea on one project.

What should you avoid claiming?

Do not tell a customer or a regulator that an inventory means you comply. The Act asks for necessary and appropriate action, and that is a judgement about your data, your size and your risks. The inventory shows what you know. The patching, access limits and contract checks show what you did about it. Keep both, and keep dates on both, so that an account of your actions after a vulnerability is a matter of reading records instead of recalling events.

How to check or apply this

1. List every vendor that receives personal data and mark each as trustee or not.
2. For each trustee, keep the contract, data list and review notes.
3. Generate a component inventory for each application release.
4. Subscribe to advisories for your main frameworks and match them against the inventory.
5. Record data flows abroad and the basis for each.
6. Read the Commission's guidelines for the technical measures expected, then compare.

Quick check

This is not legal advice.

Sources

• Personal Information Protection Commission, Laws and Policies
• Act on the Protection of Personal Information, English translation (PDF, December 2016)
• NIST SP 800-161 Rev. 1

Last reviewed: 18 October 2026.