データとプライバシー: 日本 (2026)
Japan has a comprehensive, GDPR-adjacent personal data protection regime centred on the Act on the Protection of Personal Information (APPI), supervised by the independent Personal Information Protection Commission (PPC). The APPI covers private- and public-sector handling of personal information, grants data-subject rights (access, correction, deletion, opt-out) and imposes purpose-limitation, breach-notification and cross-border transfer obligations. Japan and the EU operate a mutual adequacy arrangement in force since January 2019, and a further APPI amendment package introducing administrative fines, child-specific protections, biometric rules and an AI/statistics processing lane was promulgated on 17 July 2026, to enter into force within two years.
主要なフレームワーク
Act on the Protection of Personal Information (APPI, Act No. 57 of 2003), administered by the Personal Information Protection Commission (PPC)
要点
Comprehensive statute & regulator
The APPI (Act No. 57 of 2003, as amended) is Japan's omnibus data-protection law, applying across the private sector and, since the 2021 unification, to national and local public bodies. The Personal Information Protection Commission (PPC) is the independent supervisory authority with guideline, investigation and enforcement powers.
Data-subject rights
Individuals have rights to be informed of purposes of use, to request disclosure, correction, addition, deletion, and cessation of use/third-party provision of their personal data held by business operators, including through opt-out channels in certain cases.
Core business obligations
Operators must specify and limit purposes of use, obtain consent for sensitive 'special-care-required' data, implement security measures, keep records on third-party transfers, and notify the PPC and affected individuals of certain data breaches.
Cross-border transfer rules
Transfers of personal data to a foreign recipient require either (i) data-subject consent after being informed of the destination country's regime, (ii) the recipient implementing APPI-equivalent protections with ongoing monitoring, or (iii) transfer to a jurisdiction designated by the PPC as providing equivalent protection (currently the EEA and UK).
EU–Japan mutual adequacy (2019)
Commission Implementing Decision (EU) 2019/419 of 23 January 2019 recognises Japan as providing an adequate level of protection, allowing personal data to flow from the EEA to Japan without additional safeguards. Japan reciprocated by designating the EEA under the APPI, backed by PPC-issued Supplementary Rules.
2026 APPI amendment package
A bill approved by Cabinet on 7 April 2026 and passed by the Diet on 10 July 2026 was promulgated on 17 July 2026, taking effect within two years. It introduces administrative fines, enhanced PPC enforcement, protections for children under 16, a 'specific biometric personal information' category (e.g., facial recognition data), and a new consent exemption for statistical/AI-development processing with transparency safeguards.
このページは便宜上翻訳されたものです。英語版が正式なものであり、法的助言ではありません。