Japan's Act on the Protection of Personal Information, the APPI, requires a business that handles personal information to state why it uses it, protect it, supervise staff and contractors who touch it, and get consent before giving it to third parties, including in other countries. The Personal Information Protection Commission enforces it.
Which text did we read?
The Commission publishes English translations at ppc.go.jp. The PDF we fetched is the "amended Act" translation dated December 2016, marked tentative, and the site states that only the Japanese original has legal effect. The page also mentions a consolidated text as of 1 April 2023. The Act has been amended since 2016 and article numbers in later versions differ, so use the headings below as a guide and check the current text before citing a number.
How must you use personal information?
A business must specify the purpose of use "as explicitly as possible" and must not change it beyond what is reasonably related to the original purpose. It must not handle personal information beyond the scope needed for that purpose without the person's prior consent.
Engineering example, constructed: a fitness app collects a birth date for age checks. Using the same field for advertising segmentation is a new purpose, so it needs a new notice and, where required, consent.
What does security control mean in practice?
The 2016 text asks for "necessary and appropriate action for the security control of personal data including preventing the leakage, loss or damage" of the data. The law does not list technical controls. Regulators and the Commission's guidelines fill in detail, so look at those for specifics.
It then adds two supervision duties:
- Employees: "necessary and appropriate supervision" of staff handling personal data.
- Trustees: the same supervision of anyone to whom handling is entrusted in whole or part.
For a software company this makes a contractor, a hosting provider or an analytics tool part of your compliance surface. Keep a list of them, what data each receives, and how you checked them.
What about sharing with third parties?
The business must not provide personal data to a third party without the person's prior consent, except in listed cases such as those based on laws and regulations, or protecting a life or body when consent is hard to obtain.
Providing data to a third party in a foreign country has its own article. It sets conditions beyond the domestic rule, including exceptions for recipients with a system that meets standards set by Commission rules. If your service sends Japanese users' data to servers elsewhere, review it with counsel.
Does the Act reach foreign companies?
The text we read applies a set of the obligations also to a business that, in supplying goods or services to a person in Japan, has acquired personal information about that person and handles it abroad. A non Japanese SaaS company with Japanese users should check this carefully.
How to check or apply this
- List every purpose for which each personal data field is used and check the notices match.
- Write down your security measures and who is accountable for them.
- Inventory contractors and tools that process personal data, and record your supervision of each.
- Map data flows out of Japan and check what consent or mechanism covers them.
- Obtain the current consolidated English text and the Commission's guidelines.
Quick check
Does the APPI list exact technical controls?
The Act we read states the duty in general terms. The Commission's guidelines provide the detail, so read them alongside.
Are English translations legally binding?
No. The Commission says only the Japanese original has legal effect.
This is not legal advice.
Sources
- Personal Information Protection Commission, Laws and Policies
- Act on the Protection of Personal Information, English translation (PDF, December 2016)
Last reviewed: 18 October 2026.
