What does Japan · APPI cover?

Third-party records & leakage reporting. It applies to: Businesses handling personal info of Japanese residents.

What does the Regulayer pack for Japan · APPI prove?

Records of third-party provision/receipt, security measures, and leakage detail for PPC reporting. The record is signed and tamper-evident, and anyone can verify it free, without an account.

Regulayer / The 146 laws / Privacy law

Japan · APPI

Third-party records & leakage reporting.

Applies to: Businesses handling personal info of Japanese residents. Built · amended Act since Apr 2022

What the signed record shows

Records of third-party provision/receipt, security measures, and leakage detail for PPC reporting.

The proof is a signed, tamper-evident record. Anyone can check it, free, without an account, and nothing has to leave the building to make it. Evidence, not a promise.

Citation: APPI Arts 23/25/26/29/30

In the same family

GDPR · Article 22Safeguards on automated decisions HIPAA · Security RuleAudit controls over ePHI Illinois · BIPABiometric consent & handling

What to do about it

Seven days free, then $349 a month.

A signed record of which AI you used and what you checked, sealed to the exact file you deliver, made on your own machine and checkable free by anyone you send it to.

Start the free week Or verify a real record, free →

Part of the Regulayer proof catalogue: 146 laws and standards, one sealed engine. This page is a product description, not legal advice.

What the statute requires, section by section

Act on the Protection of Personal Information (APPI), Act No. 57 of 2003, as amended (the amended Act came into force 1 April 2022). Provisions addressed (article numbers are per the post-1-April-2022 consolidated text; pre-2022 texts use different numbering for the same duties):

Art. 26: Report of a leakage, etc. to the Personal Information Protection Commission (PPC) and notification to the data subject.
Art. 23: Security control measures.
Art. 25: Supervision of an entrusted person (processor oversight).
Art. 29: Record of provision of personal data to a third party.
Art. 30: Confirmation and record when receiving personal data from a third party. PPC rules: preliminary report promptly, final report within 30 days (60 days for wrongful-purpose breaches); mandatory triggers include >1,000 data subjects.

2026 amendment, not yet in force. The Act Partially Amending the APPI passed the Diet on 10 July 2026 and was promulgated on 17 July 2026 as Act No. 56 of 2026 (House of Councillors bill record, 221st Diet; PPC announcement). Commencement is by Cabinet Order within two years of promulgation, per the PPC, and no commencement dates have been designated yet, so the duties on this page are unchanged today. The PPC published its implementation roadmap on 31 July 2026 and is preparing the ordinances, rules and guidelines. Checked against ppc.go.jp and sangiin.go.jp on 13 August 2026; this note will carry the commencement dates when the Cabinet Order fixes them.

Taken from the Regulayer entry for this instrument, which is built against the primary text. Amendment sources: PPC, Reiwa 8 amendment page · House of Councillors, bill record.