JapanAct on the Protection of Personal Information, administrative surcharge order
Act No. 57 of 2003, as amended by Act No. 56 of 2026, Arts. 148-3 to 148-17
An enforcement supervision rule binding private bodies.
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- An app that, in circumstances where it is expected a recipient will use personal information for an illegal act or unjust discriminatory treatment, provides personal information to that recipient and receives money or another benefit as consideration for doing so or for stopping doing so, must pay a surcharge equal to that benefit to the national treasury when the Personal Information Protection Commission orders it, unless the affected data subjects number 1,000 or fewer, the app exercised reasonable care to prevent the conduct throughout the period, or another Cabinet Order exception applies.
These lines are LexLint's reading of the law's text.
What it makes you log
Logging duty
Articles 148-3 to 148-17, in force only from a day a Cabinet Order sets within two years of promulgation, let the Personal Information Protection Commission order a business that received money or another benefit for an unlawful provision of personal information to pay a surcharge equal to it, with an opportunity to explain, a deadline and enforcement. They impose no duty to make or keep a log or record. Article 148-4 lets the Commission estimate the benefit when the business did not answer a request for reports or material under Article 146(1), and Article 148-6 halves the surcharge for a business that reports the facts, which is a voluntary report. The Act's record duties sit in Article 29 (a record of each provision of personal data to a third party, with the date and the third party's name, kept for the period a Commission order sets) and Article 30 (confirmation and a record on receiving personal data from a third party); neither article is among the provisions this row cites, so the row does not borrow them.
- Kind
- None
- As of
What this law does
A new Chapter VI power (Arts. 148-3 through 148-17) requires the Personal Information Protection Commission to order a personal-information handling business to pay a surcharge, to the national treasury, equal to money or another benefit the business received as consideration for providing personal information to a third party under circumstances where it was expected the recipient would use it for an illegal act or unjust discriminatory treatment, or for ceasing that conduct.
The Commission may not order payment where the business exercised reasonable care to prevent the conduct throughout the relevant period, where the data subjects affected number 1,000 or fewer, or in another case a Cabinet Order designates as not significantly harming individual rights and interests. The surcharge amount can be increased for a repeat violation or reduced for voluntary pre-investigation disclosure under Arts. 148-4 through 148-17. The Act comes into force on a day a Cabinet Order sets within two years of its promulgation.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .