What are the Japan APPI compliance deadlines?

Apr 1, 2022: 2020 amendments in force. Jul 17, 2026: 2026 APPI amendment act promulgated.

When does Japan APPI take effect?

Japan APPI took effect on Apr 1, 2005.

Who does Japan APPI apply to?

All business operators handling personal information in Japan, with no size threshold, and foreign operators handling data of people in Japan in connection with supplying goods or services. Under the 2026 amendment, fines target serious violations involving large-scale misuse for economic gain; reported exclusions cover negligence or fewer than 1,000 affected people.

What are the penalties under Japan APPI?

Current: PPC orders; criminal penalties for violating orders up to 1 year imprisonment or JPY 1 million, and corporate fines up to JPY 100 million for order violations and unlawful database provision. 2026 amendment: administrative fine equal to the economic benefit from the violation (reported 1.5x uplift for repeat offenders within 10 years and a 50% cut for self-reporting), plus higher criminal penalties for unlawful database provision and new penalties for obtaining PI by fraud.

Japan APPI

Amended Japan · In force Apr 1, 2005 · no upcoming deadlines

Official text

Add to calendar

Apple Calendar or Outlook Google Calendar Download .ics

Deadlines

MilestoneJul 17 · 3 months ago · Source

2026 APPI amendment act promulgatedAmendment enacted by the Diet on 10 July 2026 and promulgated; main provisions take effect by cabinet order within two years of promulgation.

Takes effectApr 1, 2022 · 4.6 years ago · Source

2020 amendments in forceMandatory breach reporting, pseudonymized information and stricter cross-border rules apply.

Summaries for reference, not legal advice. Check the official text.

What it does

Japan's general privacy law covering purpose specification, security, third-party transfer consent (with an opt-out scheme), cross-border transfer rules, mandatory breach reporting, and pseudonymized data. The 2026 amendment (promulgated 17 July 2026) adds Japan's first administrative fine (disgorgement of gains from serious violations), guardian consent for children under 16, stricter rules on facial-feature data, relaxed breach notification to individuals, and a consent exemption for statistics and AI development.

Who it applies to: All business operators handling personal information in Japan, with no size threshold, and foreign operators handling data of people in Japan in connection with supplying goods or services. Under the 2026 amendment, fines target serious violations involving large-scale misuse for economic gain; reported exclusions cover negligence or fewer than 1,000 affected people.
Penalties: Current: PPC orders; criminal penalties for violating orders up to 1 year imprisonment or JPY 1 million, and corporate fines up to JPY 100 million for order violations and unlawful database provision. 2026 amendment: administrative fine equal to the economic benefit from the violation (reported 1.5x uplift for repeat offenders within 10 years and a 50% cut for self-reporting), plus higher criminal penalties for unlawful database provision and new penalties for obtaining PI by fraud.
Enforced by: Personal Information Protection Commission (PPC)
Official name: Act on the Protection of Personal Information (Act No. 57 of 2003), as amended including the 2026 amendment act
Citation: Act No. 57 of 2003; 2026 amendment act promulgated 17 July 2026
Topics: Privacy, Children, Biometrics, Breach notification, AI

Verified 2026-09-22 ppc.go.jp ppc.go.jp ppc.go.jp bakermckenzie.com

Research notes

Main body of the 2026 amendment commences by cabinet order within 2 years of promulgation (by about July 2028); the PPC roadmap of 31 July 2026 gives a rough outlook of spring to July 2028, so no exact date is listed. One narrow provision (digitised service by public notice) takes effect 6 months after promulgation. The 1,000-person exclusion and the 1.5x and 50% fine adjustments come from law-firm summaries, not re-verified in the official text. Earlier dates (2003 enactment, 2005 full effect, 2022 amendments) are from the PPC legal page and general knowledge. Full English consolidation as of 1 Apr 2023 is at japaneselawtranslation.go.jp.

In forceAustralia

Australia Cyber Security Act (ransomware reporting)Australia's first standalone cyber law: mandatory reporting of ransomware or cyber-extortion payments within 72 hours, security standards for consumer smart devices, 'limited use' protections for information shared with ASD and the National Cyber Security Coordinator, and a Cyber Incident Review Board. Ransomware payment reporting has applied since 30 May 2025.In effect since Nov 30, 2024

AmendedAustralia

Australia Online Safety ActSets up the eSafety Commissioner and removal schemes for cyber-bullying of children, adult cyber-abuse, non-consensual intimate images and abhorrent violent material. It also sets Basic Online Safety Expectations with reporting duties, and binding industry codes and standards. The Unlawful Material codes and standards cover class 1A and 1B material such as child sexual exploitation and pro-terror content. The Age-Restricted Material codes cover class 1C and class 2 material such as online pornography, and require age assurance and other measures to protect children.In effect since Jan 23, 2022

AmendedAustralia

Australia Privacy ActAustralia's federal privacy law (13 Australian Privacy Principles, Notifiable Data Breaches scheme). The 2024 amendment adds a statutory tort for serious invasions of privacy, tiered civil penalties and infringement notices, a mandate for a Children's Online Privacy Code, clearer security duties, and privacy-policy transparency for substantially automated decisions from 10 December 2026. It also adds criminal doxxing offences.Next: Dec 10 Children's Online Privacy Code must be registered · in 44 days

AmendedAustralia

Australia SOCI ActAustralia's critical infrastructure security law. Owners and operators of critical infrastructure assets must register ownership and operational information, and many must report cyber security incidents to the Australian Signals Directorate. Responsible entities for many asset classes must also keep a critical infrastructure risk management program. Systems of national significance face enhanced cyber security obligations, and the government has step-in and assistance powers.In effect since Jul 11, 2018

In forceAustralia

Australia Social Media Minimum AgeRequires providers of age-restricted social media platforms to take reasonable steps to stop Australians under 16 from having accounts. Platforms may not rely only on government ID for age assurance, and must protect data collected for age checks and destroy it after use. eSafety has named platforms including Facebook, Instagram, Snapchat, TikTok, X, YouTube, Reddit, Threads, Twitch and Kick.In effect since Dec 10, 2025

In forceChina

China AI Content Labeling MeasuresRequires generative AI service providers to add explicit (visible) labels to AI-generated text, images, audio, video and virtual scenes, and implicit labels (metadata) to generated files. Content distribution platforms must detect and label AI-generated content, and app stores must check labeling functions when apps are listed. A mandatory national standard (GB 45438-2025) takes effect on the same date.In effect since Sep 1, 2025

In forceChina

China Algorithmic Recommendation ProvisionsRegulates recommendation, ranking, personalization, generation and dispatch algorithms used in internet services in China. Users must be able to switch off personalized recommendations and manage tags, and providers may not use algorithms for price discrimination or to induce addiction. Providers with public opinion attributes or social mobilization capacity must file their algorithms with the CAC within 10 working days of launching a service.In effect since Mar 1, 2022

In forceChina

China Anthropomorphic AI MeasuresRegulates AI companion and emotional interaction services that simulate human personality. Providers must tell users they are talking to AI, remind users after every 2 hours of use, intervene in crises such as self-harm, offer easy exit, and may not offer virtual partner or relative services to minors. Users' interaction data may not be shared or used for training on sensitive data without consent, and services with 1 million registered or 100,000 monthly active users need a security assessment filed with the provincial CAC.In effect since Jul 15, 2026

Questions about Japan APPI

What are the Japan APPI compliance deadlines?: Apr 1, 2022: 2020 amendments in force. Jul 17, 2026: 2026 APPI amendment act promulgated.
When does Japan APPI take effect?: Japan APPI took effect on Apr 1, 2005.
Who does Japan APPI apply to?: All business operators handling personal information in Japan, with no size threshold, and foreign operators handling data of people in Japan in connection with supplying goods or services. Under the 2026 amendment, fines target serious violations involving large-scale misuse for economic gain; reported exclusions cover negligence or fewer than 1,000 affected people.
What are the penalties under Japan APPI?: Current: PPC orders; criminal penalties for violating orders up to 1 year imprisonment or JPY 1 million, and corporate fines up to JPY 100 million for order violations and unlawful database provision. 2026 amendment: administrative fine equal to the economic benefit from the violation (reported 1.5x uplift for repeat offenders within 10 years and a 50% cut for self-reporting), plus higher criminal penalties for unlawful database provision and new penalties for obtaining PI by fraud.

Deadlines

What it does

Related