Processes personal data, in Japan

Act No. 57 of 2003, as amended by Act No. 37 of 2021, Art. 26 · Read the law's page

• An app that suffers a leak, loss, or damage of personal data belonging to a person in Japan must report the incident to the Personal Information Protection Commission where it is likely to harm the data subject's rights and interests, following PPC-prescribed procedure and timing.

Act No. 57 of 2003, as amended by Act No. 37 of 2021, Art. 28 · Read the law's page

• An app transferring the personal data of a person in Japan to a recipient in a foreign country must obtain the data subject's prior consent after disclosing the destination country's protection system and the recipient's own measures, unless the destination is a PPC-recognized equivalent jurisdiction or the recipient maintains APPI-equivalent measures.

Act No. 57 of 2003, as amended by Act No. 37 of 2021, Arts. 17, 20, 21, 25 · Read the law's page

• An app that collects, uses, or discloses the personal data of an individual in Japan must give notice of, or publicly disclose, its purpose of use before or promptly after collection, must not acquire the data by wrongful or deceptive means, and must confine use to the stated purpose unless a statutory exception or the data subject's consent applies.

Act No. 57 of 2003, as amended by Act No. 37 of 2021, Arts. 29, 30 · Read the law's page

• An app that provides the personal data of a person in Japan to a third party must prepare a record of the date of provision, the third party's name and the other matters the Personal Information Protection Commission's rules require, and keep it for the period those rules set (one to three years).
• An app that receives the personal data of a person in Japan from a third party must first confirm the third party's name and address and how it acquired the data, then prepare a record of the date of receipt and the matters confirmed and keep it for the period the Commission's rules set (one to three years).

Act No. 57 of 2003, as amended by Act No. 37 of 2021, Arts. 41-46 · Read the law's page

• Process personal information into pseudonymized personal information only to the standards the Personal Information Protection Commission sets, secure the deleted information and the means of processing against leaking, and keep the pseudonymized personal information to the specified purpose of use (Article 41(1) to (3)).
• Do not collate pseudonymized personal information with other information in order to identify the person it came from, whether you prepared it or received it, and, where the information is not personal information, do not acquire the deleted information either (Articles 41(7) and 42(3)).
• Do not provide pseudonymized personal information to a third party, whether or not it is personal information, except in cases based on laws and regulations (Articles 41(6) and 42(1)).
• Process personal information into anonymized personal information only to the standards the Commission sets so that a specific individual cannot be identified and the information cannot be restored, secure the deleted identifiers and the processing method against leaking, and disclose the categories of individual information it contains (Article 43(1) to (3)).
• Before you provide anonymized personal information to a third party, disclose the categories of individual information it contains and the means of providing it, and state explicitly to the third party that the information is anonymized personal information (Articles 43(4) and 44).
• Do not collate anonymized personal information with other information in order to identify a person, and, if you received it and did not prepare it, do not acquire the deleted identifiers or the processing method (Articles 43(5) and 45).

Act No. 57 of 2003, as amended by Act No. 37 of 2021, Chapters VI, VIII · Read the law's page

• An app processing the personal data of a person in Japan must be prepared to answer to the Personal Information Protection Commission's investigative, recommendation, and order powers, and a responsible individual risks criminal liability for violating a PPC order. A person can also sue to enforce a disclosure, correction or cessation request, and can claim compensation under general tort law.

Act No. 57 of 2003, as amended by Act No. 56 of 2026, Arts. 148-3 to 148-17 · Read the law's page

• An app that, in circumstances where it is expected a recipient will use personal information for an illegal act or unjust discriminatory treatment, provides personal information to that recipient and receives money or another benefit as consideration for doing so or for stopping doing so, must pay a surcharge equal to that benefit to the national treasury when the Personal Information Protection Commission orders it, unless the affected data subjects number 1,000 or fewer, the app exercised reasonable care to prevent the conduct throughout the period, or another Cabinet Order exception applies.

Act No. 57 of 2003, as amended by Act No. 56 of 2026, Arts. 30-2, 31-3 · Read the law's page

• An app may acquire sensitive personal information that is already publicly available, without the data subject's consent, for the purpose of creating statistics or other large-scale trend analysis, or of providing it to a third party for that purpose, if it publishes the details of the statistics-creation activity over the internet.
• An app may provide personal information or personal-related information to a third party that needs it for statistics creation, without the data subject's consent, if both parties publish the statistics-creation details over the internet and a written agreement with the third party states the provision is made under this provision; the recipient may not use it beyond that stated purpose or pass it on to a further third party.

Act No. 57 of 2003, as amended by Act No. 56 of 2026, Arts. 42(4), 46-2 · Read the law's page

• If you handle pseudonymized personal information or anonymized personal information that contains a description Article 2(8) lists, such as the location of a person's residence or workplace, do not use it by a method likely to encourage or induce an illegal or unjust act and do not acquire it by deceit or other wrongful means (Articles 42(4), 46-2 and 31-2).

Act No. 57 of 2003, as amended by Act No. 56 of 2026, Arts. 176 and 178 to 186 · Read the law's page

• An app that handles a personal information database in the course of its business must not provide it to others, or misappropriate it, to seek illegal profit for itself or a third party or to harm the data subject or another person; from 17 January 2027, an officer, employee or former employee who does so faces up to two years' imprisonment with work or a fine of up to JPY 1,000,000, and a business that is a corporation answers with a fine of up to JPY 100,000,000.
• An app, and anyone acting for it, must not obtain personal information by deceiving, assaulting or threatening a person, by theft or destruction of property, intrusion into a facility, interception of wire communications, unauthorized access or another act that harms the control of the person holding the information, to seek illegal profit or to harm the data subject, the holder or another person; from 17 January 2027 this is punishable by up to two years' imprisonment with work or a fine of up to JPY 1,000,000, and a corporation takes the same fine.