What Is APPI? Act on the Protection of Personal Information
The Act on the Protection of Personal Information (APPI, Law No. 57 of 2003) is Japan's national data protection law. Originally enacted in 2003, it was comprehensively amended effective April 2022 to strengthen data subject rights, introduce mandatory breach notifications for specified incidents, create cross-border data transfer rules, and establish significant penalties. APPI is enforced by the Personal Information Protection Commission (PPC), an independent agency established by the 2015 amendments that centralized previously sectoral enforcement. Japan and the EU mutually recognized each other's adequacy decisions in January 2019, facilitating bilateral data flows without additional safeguards. The 2022 amendments introduced mandatory reporting and notification for specified personal-data breaches, expanded rights to request cessation of use or deletion, created a 'pseudonymized information' category with lighter obligations, and expanded cross-border transfer requirements. PPC materials describe prompt initial and later detailed reporting stages; the applicable timing depends on the incident category and current guidance, rather than a universal 72-hour rule.
At a glance
- Full name
- Act on the Protection of Personal Information
- Short code
- APPI
- Jurisdiction
- Japan
- Enacted
- 2003
- Last major update
- Major amendment effective April 2022; PPC triennial-review system-reform outline published January 2026
- Regulator
- Personal Information Protection Commission (PPC)
- Private right of action
- Limited
- Statutory citation
- Act No. 57 of 2003 (as amended)
International privacy-law explainer timeline
Enacted years are counted by decade from the published explainer dataset; the table lists the laws in each decade.
- Decade containing a highlighted explainer
- Other decades
195
Planning jurisdictions
167
Published law explainers
92
Partial official reviews
The ledger coverage split is 195 planning jurisdictions, 167 published law explainers, and 92 partial official reviews. 4 of 167 explainers lack an enacted year, so they are omitted from the decade counts.
Show the data as a table
| Decade | Explainers with an enacted year | Laws (short codes) |
|---|---|---|
| 1970s | 1 | Loi Informatique et Libertés |
| 1980s | 2 | Privacy Act 1988, Privacy Law 5741-1981 |
| 1990s | 2 | DSG, Constitution Article 28 |
| 2000s | 15 | PIPEDA, APPI (highlighted), Law 25.326, Law on Personal Data Protection, Law 09-08, 152-FZ, Law No. 2008-12, Organic Law No. 2004-63, PDPA, DPA 2003, Art. 21(2), 25, 130–131 + Law 254, Lei n.º 133/V/2001, Uruguay Ley 18.331, Iran Electronic Commerce Act 2003, Saint Vincent and the Grenadines Privacy Act No. 18 of 2003 |
| 2010s | 81 | UK GDPR, LGPD, BDSG, RA 10173, POPIA, Malaysia PDPA, Korea PIPA, UAVG, PECA + Art. 14, Law 29733, Thai PDPA, KVKK, Poland GDPR + UODO Act, Portugal GDPR + Lei 58/2019, Romania GDPR + Law 190/2018, Law 1581, Law No. 94-V, HO-49-N, Law 998-IIIQ, Info tv. + GDPR, Act No. 90/2018 + GDPR, Data Protection Act 2019, PDL, Law of 1 August 2018, Chapter 586, IKS, Act 843, Law 4624/2019, Law 87/2018, Act No. 18/2018 Coll., Law No. 2297-VI, Act on the Implementation of the GDPR, Law 125(I)/2018, Act No. 110/2019 Coll., Belgian Data Protection Act, Databeskyttelsesloven, Data Protection Act 1050/2018, Personal Data Act, Sectoral Privacy Protections, Law No. 18-07 + Law No. 25-11, Law No. 22/11, Data Protection Act 2013, Law No. 30 of 2018, Data Protection Act 2019-29, Code du numérique, Book V, ICM Act 2018 + NDGF 2025, Fragmented privacy framework, Ley 8968, Ley 172-13, GDPR + Data Protection Act, Mali Law 2013-015, Mauritania Law 2017-020, Mauritius DPA 2017, Nepal Privacy Act 2075, Panama Ley 81/2019, Qatar Law No. 13 of 2016, Saint Lucia DPA 2011, Togo Law 2019-014, Turkmenistan Law 519-V, Chad Law 007/PR/2015, Congo Law 29-2019, Côte d'Ivoire Law 2013-450, Equatorial Guinea Law 1/2016, Fiji Privacy Framework, Guinea Law L/2016/037/AN, Haiti 2018 Data Privacy Order, Lao Law 25/NA, Lebanon Law 81/2018, Lesotho Data Protection Act 2011, Madagascar Law 2014-038, Myanmar Privacy and Security Law, Nicaragua Law No. 787, Saint Kitts and Nevis DPA No. 5 of 2018, San Marino Law No. 171/2018, Lei n.º 03/2016, Law No. 1537, Trinidad and Tobago DPA 2011, Uganda DPA 2019, U.S. Privacy Law, Law No. O‘RQ-547, Law No. 13 of 2012 |
| 2020s | 62 | DPDP Act, PIPL, UAE PDPL, NDPA, PDPL, Law No. 91/2025, Act No. 63 of 2026, Law 21.719, Law No. 151 of 2020, UU PDP, LFPDPPP (2025), Law 124/2024, Law 12/25, Data Protection Act 2020, Digital Code, Law no. 195/2024, Law on Personal Data Protection, Law No. 3144, Law 42/2020, ZVOP-2, PDPA, LQPD, Law No. 99-Z, Data Protection Act 2021, Data Protection Act 2024, PDPO 2025, Loi n°001-2021/AN, Law No. 1/03 of 2026, Law No. 2024/017, Law No. 24.001, LOPDP, LPDP, Malawi DPA 2024, Monaco Law 1.565, Oman PDPL, Paraguay Law 7593/2025, Rwanda Law 058/2021, Tanzania PDPA 2022, Vanuatu DPPA 2024, Zimbabwe Cyber and Data Protection Act, Cuba Law 149/2022, DPRK Information Law materials, DRC Digital Code 2023, Djibouti Digital Code 2025, Eswatini Data Protection Act 2022, Ethiopia Proclamation No. 1321/2024, Gabon Law 025/2023, Grenada Data Protection Act 2023, Guyana Data Protection Act 2023, Jordan Personal Data Protection Law No. 24 of 2023, Kiribati Data Protection Act 2025, Kuwait CITRA Decision 2024/26, Libya Law No. 6 of 2022, Liechtenstein DSG 2026, Marshall Islands PDPA 2025, Niger Law No. 2022-59, Seychelles Data Protection Act 2023, Somalia Data Protection Act 2023, Law No. 12 of 2024, Privacy Act 2025, Zambia Data Protection Act 2021, Decree DCLVII |
Sources: APPI statutory citation · OfflistMe jurisdiction research ledger · Checked international explainers 2026-10-12; coverage ledger 2026-10-12
Scope, who APPI covers
Protected data
Data subject rights
Right of disclosure, request the business operator disclose what personal information is held
Right of correction, addition, or deletion of incorrect personal information
Right to request cessation of use or deletion when handling has been unlawful (2022 amendment expanded this)
Right to request cessation of third-party provision
Right to request disclosure of provision records (who the data was shared with)
Right to receive data in a digital format for portability-type use cases (not a formal portability right)
Right to file a complaint with the PPC
Notable features
APPI's distinctive features include the 'opt-out' provision for third-party data sales (Article 27(2)), a legacy provision that allows certain data sales without consent if the operator provides notice to the PPC and data subjects can opt out. This differs markedly from GDPR's consent-based framework. Japan also has a unique 'pseudonymized information' category (2022 amendment) that allows limited processing without individual consent for research and product development. EU-Japan mutual adequacy is the first such mutual recognition post-GDPR.
Enforcement & penalties
Regulator: Personal Information Protection Commission (PPC)
Penalties: The 2022 amendments raised corporate penalties to up to ¥100 million for specified violations, including unlawful provision or use of personal-information databases and violation of a PPC order. For individuals, the maximum for violating a PPC order is imprisonment for up to one year or a fine of up to ¥1 million; unlawful provision or use of a personal-information database for illegal profit carries imprisonment for up to one year or a fine of up to ¥500,000. The PPC can also issue orders and publish certain enforcement information under the Act.
Private right of action: APPI does not create a specific statutory private right of action with set damages, but individuals can bring tort claims under the Civil Code for harm arising from APPI violations, courts have consistently recognized privacy-rights torts. Class actions are unusual in Japan but collective consumer redress is available via qualified consumer organizations.
Relevance to data brokers
Japanese data brokers (called 'meibo-gyosha' for list-brokers) have operated under APPI's opt-out provision (Article 27(2)) for decades, though 2022 amendments added notification requirements. Foreign data brokers handling data of Japanese residents face APPI obligations, particularly the PPC's cross-border transfer rules, which require the recipient to provide equivalent protection. PPC enforcement has been notably active on cross-border transfers and breach handling since 2022.
Generate requests in under 60 seconds
Explore 1,034 US/global data brokers
FAQ
Is there an adequacy decision between the EU and Japan?+
Yes, the EU and Japan mutually recognized each other's data protection as 'adequate' in January 2019. This allows personal data to flow between the EU and Japan without the additional safeguards normally required under GDPR Article 46. Japan was the first country to receive mutual adequacy with the EU.
How do I file a complaint under APPI?+
Complaints can be submitted to the PPC Call Center via ppc.go.jp/en/aboutus/submissions_inquiries/. Most individuals are encouraged to first approach the business operator's personal information complaint desk. Local consumer centers (shouhi seikatsu senta) also handle privacy inquiries.
What is the 'opt-out' provision in APPI?+
Article 27(2) allows business operators to provide personal information to third parties without obtaining consent, if they (1) notify the PPC, (2) notify data subjects or make the notice readily available, and (3) stop providing the information of any data subject who opts out. This is narrower than it once was, 2022 amendments excluded certain sensitive data and tightened notification requirements.
Official sources & citations
Other international privacy regimes
APPI sits in a global ecosystem of data-protection laws. Start with these comparative frameworks, or visit the privacy research hub for the complete jurisdiction index: