Rights
APPI with EU adequacy in both directions
The Act on the Protection of Personal Information is enforced by the Personal Information Protection Commission. Japan and the EU recognise each other as adequate, easing transfers.
Key rules
- Leakage incidents likely to harm individual rights must be reported to the PPC.
- Third-party transfers generally require consent, with an opt-out route for some business operators.
- Pseudonymously processed information has a relaxed regime for internal analysis.
Governing law
- Act on the Protection of Personal Information (Act No. 57 of 2003)
Penalties and consequences
- Up to ¥100 million for corporations failing to comply with a PPC order
In practice
The PPC prefers guidance and corrective orders over fines, but the 2022 amendments materially raised corporate exposure.