Página traducida y verificada automáticamente. Prevalece la versión en inglés. Algunas partes siguen en inglés mientras se verifica su traducción. Ver en inglés · Informar un error de traducción
Regulaciones › Resto del mundo › Japón
APPI
Ley sobre la Protección de la Información Personal (Japón)
CuándoEn vigor desde el 1 de abril de 2005
Quién la aplicaComisión de Protección de la Información Personal
A quién se aplicaEmpresas que tratan información personal en Japón.
Informar al reguladorComunicar las violaciones notificables (datos sensibles, perjuicio económico, fines indebidos, más de 1,000 perso…
DPO obligatorioSin requisito de DPO
RegistroSin registro general
Transferencias al extranjeroLa transferencia al extranjero requiere consentimiento previo tras informar sobre el régimen del destino, un país adec…
Plazo de solicitudesResponder 'sin demora'; la Ley no fija un número de días
Multa máximaMulta penal para personas jurídicas de hasta JPY 100 millones por incumplir órdenes de la PPC o por suministro ilícito de bases de da…
Every requirement we score, with the rule in plain words and the section it comes from. Darker means more demanding. See every law side by side →
Alcance y base jurídica
Alcance extraterritorial
2
Applies to foreign businesses handling personal information of people in Japan in connection with supplying goods or services to them.Art. 171 · source ↗
Official English text could not be fetched this session (tool block); article number from the consolidated official translation, not re-verified.
Base jurídica
1
No list of lawful bases; purpose must be specified and notified, and consent is needed for use beyond purpose and for most third-party provision.Arts. 17, 18, 21, 27 · source ↗
Official English text could not be fetched this session (tool block); article number from the consolidated official translation, not re-verified. Scored 1: purpose-based model, closer to legitimate-interest flexibility than consent-default. Act No. 56 of 2026 (promulgated 17 Jul 2026) amends the APPI; main reforms take effect by Cabinet Order no later than 17 Jul 2028. It broadens consent exceptions (contract necessity).
Consentimiento
1
Prior consent required for out-of-purpose use, third-party provision and foreign transfers; form not prescribed, implied consent not generally accepted by PPC guidance.Arts. 18(1), 27(1), 28(1) · source ↗
Official English text could not be fetched this session (tool block); article number from the consolidated official translation, not re-verified.
Datos sensibles
2
Special care-required information (race, creed, medical history, criminal record, etc.) needs prior consent to acquire and cannot be shared by opt-out.Arts. 2(3), 20(2), 27(2) · source ↗
Official English text could not be fetched this session (tool block); article number from the consolidated official translation, not re-verified. Amendment adds 'specified biometric personal information' (Art. 16(5)) when in force.
Niños
1
No statutory age today; PPC Q&A treats roughly 12-15 as needing a guardian. Amendment sets under 16 for guardian consent once in force.Art. 40-2 (as amended by Act No. 56 of 2026, not yet in force) · secondary source · source ↗
Scored on the law in force on 18 Oct 2026 (guidance only). Will rise to level 2 when Art. 40-2 commences (by 17 Jul 2028).
Derechos de las personas
Derechos
2
Disclosure (access), correction/deletion, cessation of use or erasure, cessation of third-party provision, and disclosure of third-party provision records.Arts. 33, 34, 35 · source ↗
Official English text could not be fetched this session (tool block); article number from the consolidated official translation, not re-verified. Counted: access, correction, deletion, objection (cessation), restriction-like cessation of provision = 5. No portability or automated-decision right.
Plazo de solicitudes
0
Respond 'without delay'; no fixed number of days in the Act.Arts. 33(2), 34(2), 35(3) · source ↗
Official English text could not be fetched this session (tool block); article number from the consolidated official translation, not re-verified.
Marketing
2
Marketing email requires prior opt-in consent under the Act on Regulation of Transmission of Specified Electronic Mail.Specified Electronic Mail Act Art. 3 · secondary source · source ↗
Sector law outside APPI; article number from memory, not verified this session.
Gobernanza
DPO obligatorio
0
No DPO requirement; controllers must take necessary security control measures, including organizational measures.Art. 23 · source ↗
Official English text could not be fetched this session (tool block); article number from the consolidated official translation, not re-verified.
Requisitos del DPO
–
Not addressedNone · source ↗
Official English text could not be fetched this session (tool block); article number from the consolidated official translation, not re-verified.
Registro
1
No general registration; businesses using the opt-out route for third-party provision must notify the PPC in advance.Art. 27(2) · source ↗
Official English text could not be fetched this session (tool block); article number from the consolidated official translation, not re-verified.
DPIA
1
Not required by statute; PPC encourages PIAs. Amendment discussions covered PIAs but the in-force law has no duty.None (PPC guidance) · secondary source · source ↗
No statutory DPIA duty confirmed in the Act in force.
Registros
1
Records required only for providing personal data to, or receiving it from, third parties.Arts. 29, 30 · source ↗
Official English text could not be fetched this session (tool block); article number from the consolidated official translation, not re-verified.
Conservación
1
Businesses must endeavor to delete personal data without delay once it is no longer needed.Art. 22 · source ↗
Official English text could not be fetched this session (tool block); article number from the consolidated official translation, not re-verified. Effort obligation only.
Violaciones de datos
Informar al regulador
2
Report reportable breaches (sensitive data, financial harm, improper purpose, over 1,000 persons) promptly (3-5 days guidance), final report within 30 days, 60 if malicious.Art. 26(1); PPC Enforcement Rules Arts. 7-8 · secondary source · source ↗
Article numbers from official text not re-verified this session. Deadlines confirmed via IAPP summary of PPC guidelines.
Informar a las personas
3
Notify affected individuals of reportable breaches, unless notification is difficult and alternative measures are taken.Art. 26(2) · secondary source · source ↗
Scored 3 because notice is mandatory for all reportable breaches. Amendment will allow PPC low-risk exemptions.
Transferencias
Transferencias al extranjero
2
Transfer abroad needs prior consent after information on the destination regime, an adequate country (EU/UK), or a recipient with equivalent systems.Art. 28 · source ↗
Official English text could not be fetched this session (tool block); article number from the consolidated official translation, not re-verified.
Aplicación de la ley
Multa máxima
2
Criminal corporate fine up to JPY 100 million for violating PPC orders or unlawful database provision. Amendment adds revenue-linked administrative surcharges.Arts. 178, 179, 184 · source ↗
Official English text could not be fetched this session (tool block); article number from the consolidated official translation, not re-verified. JPY 100m is about USD 0.7m. Surcharge (Art. 148-3, amended) not yet in force; amount equals consideration received.
Responsabilidad penal
2
Imprisonment up to 1 year for violating PPC orders or providing databases for illicit gain; corporate fines up to JPY 100 million.Arts. 178, 179, 184 · source ↗
Official English text could not be fetched this session (tool block); article number from the consolidated official translation, not re-verified. Amendment adds improper-acquisition offenses effective 17 Jan 2027.
Acción privada
2
Individuals may sue to compel disclosure, correction or cessation, and claim tort damages under the Civil Code.Art. 39; Civil Code Art. 709 · source ↗
Official English text could not be fetched this session (tool block); article number from the consolidated official translation, not re-verified.
Scores are our reading on the published rubric, checked 18 October 2026. Not legal advice.
Biblioteca de regulaciones
Todas las leyes estatales de privacidad de EE. UU., en un mapa
24 estados tienen una ley integral de privacidad en la biblioteca, junto con las leyes de la UE, del Reino Unido, federales de EE. UU. y globales: 102 en total, cada una explicada en palabras sencillas con sus fuentes. Seleccione un estado para ver qué se aplica allí.
- En vigor
- Entrada en vigor
- Leyes sectoriales