top of page

APPI: Japan’s Data protection law

In 2015, Japan passed its Act on the Protection of Personal Information. This data protection legislation established the Personal Information Protection Commission. The PPC works with government ministries to set guidelines on how to handle personal information; data breaches; data transfers to foreign countries; and data anonymization.

Specific guidelines also regulate how personal genetic data; credit information; and healthcare records are to be protected.


Data cannot be transferred to third parties unless the person concerned consents, but there are exceptions including those to protect the public health. Data transfers can proceed if no response has been received during an opt out period and notification has been provided.


An initial exemption for businesses which handle the data of less than 5,000 people was repealed in 2017.


The APPI can apply when foreign businesses acquire the personal data of Japanese citizens in order to provide goods and services in Japan.




Sean O'Shea has more than 20 years of experience in the litigation support field with major law firms in New York and San Francisco.   He is an ACEDS Certified eDiscovery Specialist and a Relativity Certified Administrator.

The views expressed in this blog are those of the owner and do not reflect the views or opinions of the owner’s employer.

If you have a question or comment about this blog, please make a submission using the form to the right. 

Your details were sent successfully!

© 2015 by Sean O'Shea . Proudly created with Wix.com

bottom of page