JapanAct on the Protection of Personal Information, breach notification
Act No. 57 of 2003, as amended by Act No. 37 of 2021, Art. 26
In force since .
A breach notification rule binding public and private bodies.
- Audit expectation
- none
What it requires
- An app that suffers a leak, loss, or damage of personal data belonging to a person in Japan must report the incident to the Personal Information Protection Commission where it is likely to harm the data subject's rights and interests, following PPC-prescribed procedure and timing.
These lines are LexLint's reading of the law's text. Also read by: Personal Information Protection Commission (PPC), Japan (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://www.ppc.go.jp/personalinfo/legal/guidelines_tsusoku/
- Guidance body
- Personal Information Protection Commission (PPC), Japan
- Open questions
- What makes it "difficult to notify the identifiable person of that occurrence" under Article 26(2) of the Act on the Protection of Personal Information, so that alternative measures can replace individual notice of a leak?
What it makes you log
Logging duty
Article 26 requires a business to report to the Personal Information Protection Commission, and to notify the identifiable person of, a leak, loss or damage of personal data that is likely to harm individual rights, in the manner a Commission order sets. It is a duty to notify, and the article does not tell the business to document the incident or keep a record of it. The Act's record duties sit in Article 29 (a record of each provision of personal data to a third party, with the date and the third party's name, kept for the period a Commission order sets) and Article 30 (confirmation and a record on receiving personal data from a third party); neither article is among the provisions this row cites, so the row does not borrow them.
- Kind
- None
- As of
What this law does
Art. 26(1) requires a business to report to the Personal Information Protection Commission any leak, loss, or damage of personal data that PPC order identifies as likely to harm individual rights and interests, following PPC-set procedure and timing; no duplicate report is needed where an entrusting business has already been notified. The administrative-entity mirror duty sits at Art. 68.
The PPC's own order or rules set the specific report-timing thresholds and the individual-notification trigger; the Art. 26 duty is summarised without that procedural detail.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .