JapanAct on the Protection of Personal Information, comprehensive regime and lawful basis
Act No. 57 of 2003, as amended by Act No. 37 of 2021, Arts. 17, 20, 21, 25
In force since .
A comprehensive regime rule binding public and private bodies.
- Audit expectation
- none
What it requires
- An app that collects, uses, or discloses the personal data of an individual in Japan must give notice of, or publicly disclose, its purpose of use before or promptly after collection, must not acquire the data by wrongful or deceptive means, and must confine use to the stated purpose unless a statutory exception or the data subject's consent applies.
These lines are LexLint's reading of the law's text. Also read by: Personal Information Protection Commission (PPC), Japan (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- GV.PO-P1Organizational privacy values and policies (e.g., conditions on data processing such as data uses or retention periods, individuals’ prerogatives with respect to data processing) are established and communicated.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://www.ppc.go.jp/personalinfo/legal/guidelines_tsusoku/
- Guidance body
- Personal Information Protection Commission (PPC), Japan
- Open questions
- Does the requirement to "specify as much as possible the purpose for which it uses that information" in Article 17(1) of the Act on the Protection of Personal Information allow a purpose of use stated only as training machine-learning models?
What it makes you log
Logging duty
This row's provisions (Articles 17, 20, 21 and 25) specify the purpose of use, bar improper acquisition, require notice or public disclosure of the purpose of use on acquisition, and require supervision of an entrusted person. None requires a business to make, keep or produce a log or record. The Act's record duties sit in Article 29 (a record of each provision of personal data to a third party, with the date and the third party's name, kept for the period a Commission order sets) and Article 30 (confirmation and a record on receiving personal data from a third party); neither article is among the provisions this row cites, so the row does not borrow them.
- Kind
- None
- As of
What this law does
The Act on the Protection of Personal Information (APPI) is Japan's single comprehensive personal-data statute, covering private businesses (Chapter IV), administrative organs (Chapter V), and independent administrative agencies since the 2021 merger amendment folded the former separate acts into one text.
Lawful basis is purpose-of-use notice under Arts. 17 and 21 (specification of purpose of use, and notice or public disclosure of purpose of use at the time of acquisition) plus a general prohibition on wrongful acquisition under Art. 20(1); there is no General Data Protection Regulation (GDPR)-style enumerated legal-basis list. APPI regulates businesses handling personal information directly rather than a controller and processor split, and Art. 25 imposes supervision duties over any entrusted processor.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .