JapanAct on the Protection of Personal Information, penal provisions and corporate fines
Act No. 57 of 2003, as amended by Act No. 56 of 2026, Arts. 176 and 178 to 186
An enforcement supervision rule binding public and private bodies.
- Obligation class
- Prohibition
What it requires
- An app that handles a personal information database in the course of its business must not provide it to others, or misappropriate it, to seek illegal profit for itself or a third party or to harm the data subject or another person; from , an officer, employee or former employee who does so faces up to two years' imprisonment with work or a fine of up to JPY 1,000,000, and a business that is a corporation answers with a fine of up to JPY 100,000,000.
- An app, and anyone acting for it, must not obtain personal information by deceiving, assaulting or threatening a person, by theft or destruction of property, intrusion into a facility, interception of wire communications, unauthorized access or another act that harms the control of the person holding the information, to seek illegal profit or to harm the data subject, the holder or another person; from this is punishable by up to two years' imprisonment with work or a fine of up to JPY 1,000,000, and a corporation takes the same fine.
These lines are LexLint's reading of the law's text.
If you get it wrong
Criminal exposureYes
Criminal exposure note
From Article 178 (providing or misappropriating a personal information database for illegal profit or to harm someone) and the added Article 180 (obtaining personal information by deceit, violence, threats, theft, intrusion or unauthorized access) are each punishable by imprisonment with work for not more than two years or a fine of not more than 1,000,000 yen; violating a measure order under Article 181 by imprisonment with work for not more than one year or a fine of not more than 1,000,000 yen; and a public-body employee's unjustified provision of a personal information file under Article 176 by imprisonment with work for not more than three years or a fine of not more than 1,500,000 yen.
Penalty structure
Article 185, paragraph (1), item (i), as in the revision effective , subjects a corporation to a fine of not more than 100 million yen where its representative, agent, employee or other worker commits an offence under Article 178 (providing or misappropriating a personal information database for illegal profit or to harm someone) or Article 181 (violating a measure order) in relation to its business. Under item (ii) the corporation takes the fine set in Article 180 or Article 183 itself. The individual offender's imprisonment and fines are in the criminal exposure note.
- Rule
- Fixed only
- As of
- Currency
- JPY
- Fixed cap
- 100,000,000
What record it asks for
Logging duty
Arts. 176 and 178 to 186 set offences, a corporate fine and a civil fine. They impose no duty to make or keep a log or record. The Act's record duties sit in Arts. 29 and 30, which this row does not cite.
- Kind
- None
- As of
What this law does
The amendments to Arts. 176 and 178 to 186 of the Act, with those to Arts. 125(1) and (2) and 163(2) and (3), take effect on the day six months after the day of promulgation. The e-Gov law database marks the revision of the Act made by Act No. 56 of Reiwa 8, promulgated on , as taking effect on and not yet enforced.
Under Art. 178, a business handling personal information (or, for a corporation, its officer, representative or administrator), its employee, or a former one, who provides or misappropriates a personal information database or the equivalent handled in the course of the business, to seek illegal profit for itself or a third party or to harm the data subject or another person, faces up to two years' imprisonment with work or a fine of up to JPY 1,000,000.
Art. 178 is the former Art. 179, amended to replace one year with two years, JPY 500,000 with JPY 1,000,000, and to add harming the data subject or another person to the purpose of seeking illegal profit.
Art. 180 punishes a person who obtains personal information by deceiving, assaulting or threatening a person, by theft or destruction of property, intrusion into a facility, interception of wire communications, unauthorized access or another act that harms the control of the person holding the information, to seek illegal profit for themselves or a third party or to harm the data subject, the holder or another person, with up to two years' imprisonment with work or a fine of up to JPY 1,000,000.
Art. 180 is added by the amending Act, after the former Art. 180 is renumbered Art. 179. Art. 181 punishes violating a measure order with up to one year's imprisonment with work or a fine of up to JPY 1,000,000. Until the amendment's other provisions take effect, the measure order in Art. 181 means an order under Art. 148(2) or (3).
Under Art. 176, an employee or former employee of an administrative entity, and certain others who handle personal information for one, who without justifiable grounds provides a personal information file containing confidential information on individuals faces up to three years' imprisonment with work or a fine of up to JPY 1,500,000. Art. 176 is amended to replace two years with three years and JPY 1,000,000 with JPY 1,500,000.
Under Art. 179, a person described in Art. 176 who provides or misappropriates retained personal information learned in the course of that work, to seek illegal profit for themselves or a third party or to harm the data subject or another person, faces up to two years' imprisonment with work or a fine of up to JPY 1,000,000. Under Art. 184, the offences in Arts. 176 to 180 and 182 are punished also when committed outside Japan, except Art. 180(2).
For an offence under Art. 178 or Art. 181 committed by its representative, agent, employee or other worker in relation to its business, a corporation is fined up to JPY 100,000,000 under Art. 185(1). For an offence under Art. 180 or Art. 183 committed in the same way, the corporation takes the fine set in each of those articles under Art. 185(1), item (ii).
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .