Policy Briefing — Japan’s Amended APPI Commences
Japan’s amended Act on the Protection of Personal Information takes effect with cross-border consent, pseudonymised data, and breach notification duties.
The amended Act on the Protection of Personal Information (APPI) entered into force on 1 Apr 2022, expanding Japan’s privacy regime with new cross-border, breach reporting, and pseudonymised data controls.
- 1 Apr 2022 — Enforcement begins. Controllers must obtain informed consent for overseas transfers, maintain records, and disclose foreign supervisory regimes to individuals.
- 1 Apr 2022 — Mandatory breach reporting. The Personal Information Protection Commission (PPC) now requires prompt reports and user notifications for incidents involving sensitive data or large-scale leaks.
- 2022 — Unified regime. The amendments align rules across business operators and government entities, introduce rights around pseudonymised information, and strengthen PPC corrective powers.
Zeph Tech updates client transfer assessments, vendor clauses, and incident response runbooks to reflect the amended APPI obligations.