🇯🇵Act on the Protection of Personal Information
A privacy law built around purpose, proper handling and retained personal data
Japan's Act on the Protection of Personal Information, Act No. 57 of 2003, is structured around one practical question: is personal information being handled properly for a specified purpose? The APPI does not begin with a GDPR-style list of lawful bases. It begins with the purpose of utilization, the manner of acquisition, the security of personal data, restrictions on third-party provision, and the individual's ability to exercise rights over retained personal data.
This makes the APPI highly operational. A business can have consent language in its privacy policy and still fail the law if the purpose of utilization was vague, if personal information was acquired improperly, if employees or trustees were not supervised, or if retained personal data cannot be disclosed, corrected or erased through a working process. The APPI is less about abstract privacy theory and more about controlled handling across the data lifecycle.
Who the APPI covers — and the role distinctions that matter
The APPI applies to a business operator handling personal information, meaning a business operator that uses a personal information database for its business. State organs, local governments, certain administrative agencies and entities specified by Cabinet Order as presenting little likelihood of harm are excluded from this definition in the uploaded version of the Act.
The Act uses three data concepts that must not be collapsed into one. Personal information is information about a living individual that can identify that person, including information that can be easily referenced with other information to identify the person. Personal data is personal information that forms part of a personal information database. Retained personal data is personal data over which the business operator has authority to disclose, correct, add, delete, discontinue use, erase, or discontinue third-party provision, subject to exclusions specified by Cabinet Order.
This distinction affects compliance. The rules on specifying and notifying purposes apply to personal information. Security control and third-party provision rules focus on personal data. Individual disclosure, correction and discontinuance rights are framed around retained personal data. A compliance programme that treats every dataset the same way will miss the APPI's structure.
Purpose of utilization — the legal spine of the APPI
Article 15 requires a business operator to specify the purpose of utilization of personal information as much as possible. The purpose cannot later be changed beyond a scope reasonably considered related to the original purpose. This prevents organisations from collecting data under one explanation and then stretching that explanation into unrelated uses.
Article 16 then gives the purpose real force. A business operator must not handle personal information beyond the scope necessary to achieve the specified purpose without the prior consent of the person. The Act provides exceptions where handling is based on laws and regulations, necessary to protect life, body or property where consent is difficult to obtain, specially necessary for public health or child development where consent is difficult to obtain, or necessary to cooperate with a state organ or local government where seeking consent is likely to impede the relevant public function.
The practical consequence is simple: the purpose must be specific enough to control processing. Broad wording such as “service improvement” or “business purposes” may not give teams enough legal clarity to decide whether a new use remains within scope. Under the APPI, purpose wording is not just notice language. It is the boundary of permissible handling.
Collection and notice — no deception, and purpose must be shown
Article 17 prohibits acquisition of personal information by deception or other wrongful means. Article 18 requires the business operator, when it acquires personal information, to promptly notify the person of the purpose of utilization or publicly announce it unless that purpose has already been publicly announced.
Where personal information is obtained directly from the person in a written contract or other document, including electronic records, the purpose of utilization must be expressly shown in advance. This matters for forms, onboarding flows, service agreements, employment documents and application processes. A privacy policy hidden elsewhere may not be enough if the collection channel itself does not make the purpose clear when the Act requires advance express indication.
The Act recognises exceptions where notification or public announcement may harm the rights or interests of the person or a third party, harm the legitimate interests of the business operator, impede lawful public affairs, or where the purpose is clear from the circumstances of acquisition. These exceptions should be treated as specific statutory carve-outs, not as a general permission to skip notice design.
Accuracy, security control and supervision
Article 19 requires business operators to endeavour to keep personal data accurate and up to date within the scope necessary for the purpose of utilization. Article 20 requires necessary and proper measures to prevent leakage, loss or damage and to ensure security control of personal data.
Security is not limited to technical tools. Article 21 requires necessary and appropriate supervision of employees who handle personal data. Article 22 extends accountability to entrusted handling: where a business operator entrusts another person or business operator with handling personal data in whole or in part, it must supervise the trustee as necessary and appropriate to ensure security control of the entrusted personal data.
This is one of the APPI's most important outsourcing lessons. Entrusting processing to a vendor is not treated as an ordinary third-party disclosure where the vendor is acting within the purpose of utilization. But that does not make it risk-free. The controller must supervise the trustee. Vendor due diligence, contract controls, access restrictions, incident reporting and audit rights are therefore not optional governance extras; they are how Article 22 is made operational.
Third-party provision — consent first, with structured exceptions
Article 23 provides the core rule: a business operator must not provide personal data to a third party without the person's prior consent unless an exception applies. The statutory exceptions cover provision based on laws and regulations, protection of life, body or property where consent is difficult, public health or child development where consent is difficult, and cooperation with public authorities where consent would likely impede execution of their affairs.
The Act also recognises circumstances where the recipient is not treated as a third party for this rule. These include entrustment of handling within the scope necessary to achieve the purpose of utilization, business succession through merger or similar transaction, and joint use where the required information has been notified to the person or made readily accessible in advance. Joint use requires disclosure of the items of personal data jointly used, the scope of joint users, the purpose of joint use, and the name of the person or business operator responsible for managing the data.
Article 23 also contains an opt-out style route for certain third-party provision where the business operator notifies the person or makes readily accessible specific information in advance and agrees to stop provision at the person's request. This is not a casual marketing opt-out. It requires advance transparency about third-party provision as a purpose, the items of data provided, the means or method of provision, and the right to stop provision.
A platform collects customer details to create user accounts and deliver a paid service. Six months later, the product team wants to use the same customer database for an unrelated partner campaign. The campaign may look commercially harmless, but the APPI question is not whether the business has a general privacy policy. The question is whether the new use falls within the originally specified purpose of utilization. If it does not, Article 16 requires prior consent unless a statutory exception applies. Purpose wording, not internal convenience, decides the boundary.
Retained personal data — where individual rights become operational
For retained personal data, Article 24 requires the business operator to make certain information accessible to the person. This includes the name of the business operator, the purpose of utilization of retained personal data, the procedures for requests such as disclosure, correction and discontinuance, and other matters specified by Cabinet Order.
Article 25 gives the person the right to request disclosure of retained personal data that identifies them. The business operator must disclose it without delay by the prescribed method unless an exception applies, such as risk of harm to the person or a third party, serious impediment to proper business execution, or violation of other laws and regulations.
Article 26 covers correction, addition and deletion where retained personal data is contrary to fact. The business operator must investigate within the scope necessary for the purpose of utilization and correct, add or delete the data based on the results, unless another law prescribes special procedures.
Article 27 covers discontinuance of use, erasure and discontinuance of third-party provision. These rights are tied to specific legal violations: for example, handling beyond the purpose in violation of Article 16, acquisition by wrongful means in violation of Article 17, or third-party provision in violation of Article 23. Where the request has reason, the business operator must take corrective action without delay to the extent necessary to redress the violation, subject to alternative measures where direct action would be excessively difficult or costly.
Complaints, regulators and enforcement
Article 31 requires business operators to endeavour to process complaints about personal information appropriately and promptly and to establish a system necessary for that purpose. The APPI therefore expects internal complaint handling before disputes escalate.
The uploaded version of the Act gives supervisory powers to competent ministers. They may require reports, give advice, issue recommendations and, in serious or urgent cases, issue orders. The enforcement ladder is therefore progressive: report collection and advice, followed by recommendation, followed by order where the statutory conditions are met.
Orders matter because violations of certain orders carry penal consequences. Under Article 56, violation of an order issued under Article 34 may result in imprisonment with work of not more than six months or a fine of not more than 300,000 yen. Failure to make required reports, or making false reports, is also punishable by a fine of not more than 300,000 yen under Article 57.
Exclusions and protected fields
Article 50 excludes parts of Chapter 4 from applying to certain entities where the purpose of handling personal information falls within protected fields. These include press organisations for news reporting, literary business operators for literary work, academic institutions or organisations for academic studies, religious organisations for religious activities, and political organisations for political activities.
The exclusion is not a free zone. Those entities must still endeavour to take necessary and appropriate measures for security control, complaint handling and other measures to ensure proper handling, and must endeavour to publicly announce the content of those measures. The Act also restricts regulatory authority so that enforcement does not disturb freedom of expression, academic freedom, freedom of religion, or freedom of political activity.
Article 1 — Purpose: protects individual rights and interests while considering the usefulness of personal information.
Article 2 — Definitions: personal information, personal information database, business operator handling personal information, personal data and retained personal data.
Article 15 — Purpose of utilization: purpose must be specified as much as possible and cannot be changed beyond a reasonably related scope.
Article 16 — Restriction by purpose: use beyond the specified purpose requires prior consent unless a statutory exception applies.
Articles 17–18 — Proper acquisition and notice: no wrongful acquisition; purpose must be notified, publicly announced or expressly shown where required.
Articles 19–22 — Accuracy, security control, employee supervision and trustee supervision.
Article 23 — Third-party provision: prior consent required unless an exception or recognised non-third-party arrangement applies.
Articles 24–27 — Retained personal data: accessibility of key information, disclosure, correction, discontinuance of use, erasure and stopping third-party provision.
Articles 31–34 — Complaints, reports, advice, recommendations and orders by competent ministers.
Article 50 — Exclusions for news reporting, literary work, academic studies, religious activities and political activities, with continuing self-regulatory duties.
The APPI is a purpose-control law. Your first compliance task is to define why personal information is collected and used. Your second task is to ensure the actual data lifecycle stays within that purpose: proper acquisition, clear notice, accurate data, security controls, supervised employees, supervised trustees, controlled third-party provision and workable individual rights processes for retained personal data. If those systems are weak, a privacy policy alone will not save the processing.