APPI
Act on the Protection of Personal Information
Personal Information Protection Commission
Personal Information Protection Commission
Japan's personal data protection regime is anchored by the Act on the Protection of Personal Information, commonly referred to as the APPI. The Act protects the rights and interests of individuals while recognising the usefulness of personal information in an advanced information and communications society. That balance is important: Japan's framework is not written as an absolute prohibition on data use. It is written as a system for proper handling, clear purposes, security control and individual control over retained personal data.
The APPI applies to business operators that use a personal information database for business. It distinguishes between personal information, personal data and retained personal data. That distinction drives the compliance model. Personal information is information about a living individual that can identify that person. Personal data is personal information forming part of a searchable personal information database. Retained personal data is personal data over which the business operator has authority to disclose, correct, delete, erase, stop use, or stop third-party provision.
Purpose of utilization is the centre of the APPI. A business operator must specify the purpose of using personal information as clearly as possible. Once that purpose is specified, the operator cannot use the information beyond the scope necessary to achieve that purpose without the person's prior consent, unless a statutory exception applies. This makes purpose design one of the most important operational tasks under Japanese privacy law.
Proper acquisition and transparency form the second pillar. Personal information must not be acquired by deception or other wrongful means. When personal information is acquired, the business operator must notify the individual of the purpose of utilization or publicly announce it, unless the purpose has already been announced or an exception applies. Where personal information is obtained directly from the person in a written document or contract, the purpose must be expressly shown in advance.
Security control and supervision form the third pillar. A business operator must take necessary and proper security measures to prevent leakage, loss or damage of personal data. It must supervise employees who handle personal data and supervise trustees or processors where handling is entrusted to another person or entity. The APPI therefore treats outsourcing as a continuing accountability issue, not as a transfer of responsibility away from the original business operator.
The APPI does not operate only through consent. Consent is critical where data is used beyond the specified purpose or where personal data is provided to a third party. But the first compliance question is usually narrower: has the business clearly specified, notified or announced the purpose for which the data is being collected and used?
Once the purpose is fixed, the data lifecycle has to follow it. Collection must be proper. Data must be kept accurate and up to date within the scope necessary for the purpose. Security measures must be implemented. Employees and trustees must be supervised. Third-party provision requires prior consent unless a statutory exception applies, or unless the arrangement falls within recognised cases such as entrusted processing, business succession, or properly notified joint use.
For retained personal data, the individual has practical control rights. The business operator must make certain information available, including its name, the purpose of utilization of retained personal data, and procedures for disclosure and other requests. Individuals may request notification of purpose, disclosure, correction, addition, deletion, discontinuance of use, erasure, and discontinuance of third-party provision, depending on the ground invoked.
Start with a clear map of personal information databases. Identify what personal information is collected, where it becomes personal data, and which datasets qualify as retained personal data. Then document the purpose of utilization for each processing activity. The APPI's compliance structure works only when purposes are specific enough to guide collection, use, sharing and retention.
Next, review the transparency layer. Privacy notices, forms, contracts and onboarding screens should clearly show the purpose of utilization before or at collection. Where data is collected directly in writing, the purpose should be expressly shown in advance. Third-party sharing should be checked separately because prior consent is the default rule unless the case falls within a statutory exception or a non-third-party category such as entrustment or joint use.
Finally, test whether the rights workflow actually works. If a person requests disclosure or correction of retained personal data, the organisation should know where the data is, who controls it, what exceptions may apply, how quickly the response must be made, and how reasons will be explained if the request is refused or handled differently.
Act on the Protection of Personal Information, Act No. 57 of 2003 - the central Japanese privacy law governing business operators handling personal information databases, built around purpose specification, proper acquisition, security control, supervision, third-party transfer restrictions, and individual rights over retained personal data.
Japan compliance begins with purpose discipline. If your organisation collects personal information, you need to know why it is collected, whether that purpose has been properly notified or announced, whether the data is being used within that purpose, whether third-party provision is properly controlled, and whether retained personal data can be disclosed, corrected or erased when an individual makes a valid request. The law analysis explains the APPI's operating requirements in detail.