Página traduzida e verificada automaticamente. Prevalece a versão em inglês. Algumas partes ainda estão em inglês enquanto a tradução é verificada. Ver em inglês · Informar um erro de tradução
Regulamentações › Resto do mundo › Japão
APPI
Lei de Proteção de Informações Pessoais (Japão)
QuandoEm vigor desde 1º de abril de 2005
Quem fiscalizaComissão de Proteção de Informações Pessoais
A quem se aplicaEmpresas que tratam informações pessoais no Japão.
Avisar o reguladorComunicar as violações sujeitas a comunicação (dados sensíveis, dano financeiro, finalidade indevida, mais de 1,000 pesso…
DPO obrigatórioSem requisito de DPO
RegistroSem registro geral
Transferências para o exteriorA transferência para o exterior exige consentimento prévio após informação sobre o regime do destino, um país ade…
Prazo para solicitaçõesResponder 'sem demora'; a Lei não fixa um número de dias
Multa máximaMulta penal para pessoas jurídicas de até JPY 100 milhões por violar ordens da PPC ou por fornecimento ilícito de bancos de dad…
Every requirement we score, with the rule in plain words and the section it comes from. Darker means more demanding. See every law side by side →
Alcance e base legal
Alcance extraterritorial
2
Applies to foreign businesses handling personal information of people in Japan in connection with supplying goods or services to them.Art. 171 · source ↗
Official English text could not be fetched this session (tool block); article number from the consolidated official translation, not re-verified.
Base legal
1
No list of lawful bases; purpose must be specified and notified, and consent is needed for use beyond purpose and for most third-party provision.Arts. 17, 18, 21, 27 · source ↗
Official English text could not be fetched this session (tool block); article number from the consolidated official translation, not re-verified. Scored 1: purpose-based model, closer to legitimate-interest flexibility than consent-default. Act No. 56 of 2026 (promulgated 17 Jul 2026) amends the APPI; main reforms take effect by Cabinet Order no later than 17 Jul 2028. It broadens consent exceptions (contract necessity).
Consentimento
1
Prior consent required for out-of-purpose use, third-party provision and foreign transfers; form not prescribed, implied consent not generally accepted by PPC guidance.Arts. 18(1), 27(1), 28(1) · source ↗
Official English text could not be fetched this session (tool block); article number from the consolidated official translation, not re-verified.
Dados sensíveis
2
Special care-required information (race, creed, medical history, criminal record, etc.) needs prior consent to acquire and cannot be shared by opt-out.Arts. 2(3), 20(2), 27(2) · source ↗
Official English text could not be fetched this session (tool block); article number from the consolidated official translation, not re-verified. Amendment adds 'specified biometric personal information' (Art. 16(5)) when in force.
Crianças
1
No statutory age today; PPC Q&A treats roughly 12-15 as needing a guardian. Amendment sets under 16 for guardian consent once in force.Art. 40-2 (as amended by Act No. 56 of 2026, not yet in force) · secondary source · source ↗
Scored on the law in force on 18 Oct 2026 (guidance only). Will rise to level 2 when Art. 40-2 commences (by 17 Jul 2028).
Direitos das pessoas
Direitos
2
Disclosure (access), correction/deletion, cessation of use or erasure, cessation of third-party provision, and disclosure of third-party provision records.Arts. 33, 34, 35 · source ↗
Official English text could not be fetched this session (tool block); article number from the consolidated official translation, not re-verified. Counted: access, correction, deletion, objection (cessation), restriction-like cessation of provision = 5. No portability or automated-decision right.
Prazo para solicitações
0
Respond 'without delay'; no fixed number of days in the Act.Arts. 33(2), 34(2), 35(3) · source ↗
Official English text could not be fetched this session (tool block); article number from the consolidated official translation, not re-verified.
Marketing
2
Marketing email requires prior opt-in consent under the Act on Regulation of Transmission of Specified Electronic Mail.Specified Electronic Mail Act Art. 3 · secondary source · source ↗
Sector law outside APPI; article number from memory, not verified this session.
Governança
DPO obrigatório
0
No DPO requirement; controllers must take necessary security control measures, including organizational measures.Art. 23 · source ↗
Official English text could not be fetched this session (tool block); article number from the consolidated official translation, not re-verified.
Qualificações do DPO
–
Not addressedNone · source ↗
Official English text could not be fetched this session (tool block); article number from the consolidated official translation, not re-verified.
Registro
1
No general registration; businesses using the opt-out route for third-party provision must notify the PPC in advance.Art. 27(2) · source ↗
Official English text could not be fetched this session (tool block); article number from the consolidated official translation, not re-verified.
DPIA
1
Not required by statute; PPC encourages PIAs. Amendment discussions covered PIAs but the in-force law has no duty.None (PPC guidance) · secondary source · source ↗
No statutory DPIA duty confirmed in the Act in force.
Registros
1
Records required only for providing personal data to, or receiving it from, third parties.Arts. 29, 30 · source ↗
Official English text could not be fetched this session (tool block); article number from the consolidated official translation, not re-verified.
Retenção
1
Businesses must endeavor to delete personal data without delay once it is no longer needed.Art. 22 · source ↗
Official English text could not be fetched this session (tool block); article number from the consolidated official translation, not re-verified. Effort obligation only.
Violações
Avisar o regulador
2
Report reportable breaches (sensitive data, financial harm, improper purpose, over 1,000 persons) promptly (3-5 days guidance), final report within 30 days, 60 if malicious.Art. 26(1); PPC Enforcement Rules Arts. 7-8 · secondary source · source ↗
Article numbers from official text not re-verified this session. Deadlines confirmed via IAPP summary of PPC guidelines.
Informar as pessoas
3
Notify affected individuals of reportable breaches, unless notification is difficult and alternative measures are taken.Art. 26(2) · secondary source · source ↗
Scored 3 because notice is mandatory for all reportable breaches. Amendment will allow PPC low-risk exemptions.
Transferências
Transferências para o exterior
2
Transfer abroad needs prior consent after information on the destination regime, an adequate country (EU/UK), or a recipient with equivalent systems.Art. 28 · source ↗
Official English text could not be fetched this session (tool block); article number from the consolidated official translation, not re-verified.
Fiscalização
Multa máxima
2
Criminal corporate fine up to JPY 100 million for violating PPC orders or unlawful database provision. Amendment adds revenue-linked administrative surcharges.Arts. 178, 179, 184 · source ↗
Official English text could not be fetched this session (tool block); article number from the consolidated official translation, not re-verified. JPY 100m is about USD 0.7m. Surcharge (Art. 148-3, amended) not yet in force; amount equals consideration received.
Responsabilidade criminal
2
Imprisonment up to 1 year for violating PPC orders or providing databases for illicit gain; corporate fines up to JPY 100 million.Arts. 178, 179, 184 · source ↗
Official English text could not be fetched this session (tool block); article number from the consolidated official translation, not re-verified. Amendment adds improper-acquisition offenses effective 17 Jan 2027.
Ação privada
2
Individuals may sue to compel disclosure, correction or cessation, and claim tort damages under the Civil Code.Art. 39; Civil Code Art. 709 · source ↗
Official English text could not be fetched this session (tool block); article number from the consolidated official translation, not re-verified.
Scores are our reading on the published rubric, checked 18 October 2026. Not legal advice.
Biblioteca de regulamentações
Todas as leis estaduais de privacidade dos EUA em um só mapa
24 estados têm uma lei abrangente de privacidade na biblioteca, ao lado das leis da UE, do Reino Unido, federais dos EUA e globais: 102 no total, cada uma explicada em linguagem simples com suas fontes. Selecione um estado para ver o que se aplica lá.
- Em vigor
- Entrando em vigor
- Leis setoriais