Act on the Protection of Personal Information (Japan)
The Act on the Protection of Personal Information (APPI), known in Japanese as 個人情報保護法 (Kojin Jōhō Hogo Hō), is Japan's comprehensive data privacy law. Originally enacted in 2003 and substantially revised in 2015, 2020, and most recently in 2022, APPI regulates how businesses and public bodies handle personal information.
The 2020 amendments (effective April 2022) significantly strengthened APPI, bringing it closer to international standards like GDPR and expanding individual rights. The 2022 amendments further refined enforcement provisions and cross-border data transfer rules.
APPI applies to "business operators handling personal information" (個人情報取扱事業者), which includes:
Important Change: Prior to the 2015 amendments, APPI only applied to businesses handling personal data of more than 5,000 individuals. This threshold was removed - now APPI applies to virtually all businesses, regardless of size.
Extraterritorial Application: The 2020 amendments clarified that APPI has extraterritorial reach. Even if your company is based outside Japan, APPI applies if you:
If you operate a website accessible to Japanese users and use cookies to collect their data, APPI likely applies to you.
Under APPI, "personal information" is information about a living individual that can identify the specific individual, including:
For Cookies: Cookie identifiers linked to other data that can identify an individual qualify as personal information. Most analytics and marketing cookies fall under this definition when they create user profiles.
"Personal data" is personal information that is part of an organized database. This is a subset of personal information subject to stricter requirements regarding:
APPI specifically protects "sensitive personal information" which includes:
Sensitive personal information requires special handling and cannot be obtained without opt-in consent (except in specific circumstances defined by law).
Business operators must:
For Cookies: You must clearly state WHY you're using cookies (e.g., "to analyze website traffic," "to deliver targeted advertising") before placing them.
Business operators must:
Business operators must take necessary and appropriate measures to:
This includes implementing organizational, personnel, physical, and technical security measures appropriate to the risk.
Business operators must endeavor to keep personal data accurate and up-to-date within the scope necessary for achieving the purpose of use.
Business operators must make the following information publicly available:
This is typically done through a privacy policy accessible from your website.
Personal data cannot be provided to third parties without the individual's opt-in consent, UNLESS:
The 2020 amendments restricted the opt-out procedure. You can provide personal data to third parties with an opt-out mechanism ONLY if:
Important: Third-party sharing of cookie data typically requires opt-in consent, especially for advertising and analytics platforms.
The 2020 amendments introduced new requirements for transferring personal data outside Japan. You must obtain opt-in consent UNLESS:
For Cookies: If you use third-party services (Google Analytics, Facebook Pixel, etc.) that transfer data to servers outside Japan, you need to comply with cross-border transfer rules.
Individuals have the right to request:
2020 Amendment Enhancement: Individuals can now request suspension of use or deletion not only for improper use but also when they believe the data is no longer necessary.
The 2015 amendments introduced rules for "anonymously processed information" (匿名加工情報) - data processed to prevent identification of individuals. If properly anonymized, this data can be used more freely for analysis and sharing.
Requirements for creating and using anonymously processed information include:
When providing personal data to or receiving it from third parties, business operators must create and retain records including:
Records must be kept for a prescribed period (typically 1 to 3 years depending on transaction volume).
While APPI doesn't have specific "cookie law" provisions like the EU's ePrivacy Directive, cookies fall under APPI's general personal information handling requirements. The Personal Information Protection Commission (PPC) has provided guidance on cookies and tracking technologies.
According to PPC guidance:
Cookies essential for the website to function don't require consent, though notification of their use is recommended. Examples include:
Cookies that enhance functionality but aren't strictly necessary should be disclosed with an opportunity to opt out:
Analytics cookies typically require consent or a robust opt-out mechanism because:
Best Practice: Obtain opt-in consent for analytics cookies, especially when data is shared with third parties outside Japan.
Marketing and advertising cookies require opt-in consent because:
When cookies result in sharing personal data with third parties (analytics providers, ad networks), you must:
Many popular cookie and analytics services (Google Analytics, Facebook Pixel, Adobe Analytics) transfer data outside Japan. For these services, you must either:
CookieConfig is designed to help you meet APPI's consent, transparency, and data protection requirements:
Identify all cookies and tracking technologies on your website. Document:
Categorize cookies based on APPI requirements:
For each cookie that transfers data outside Japan:
Place the CookieConfig script in your website's <head> section BEFORE any tracking scripts to ensure cookies are blocked until consent is obtained.
Set up your cookie categories in the CookieConfig dashboard. Customize descriptions to clearly explain purposes in compliance with APPI's purpose specification requirement.
Ensure your privacy policy is APPI-compliant. If you have Japanese users, provide a Japanese-language version. Include:
Update the banner to:
Create processes to handle requests from Japanese users to:
Respond to requests without delay (APPI doesn't specify a exact timeframe, but promptness is expected).
If cookies result in sharing personal data with third parties, maintain records including:
Ensure appropriate security safeguards:
Verify that:
Ensure your team understands APPI requirements, especially regarding:
Periodically review your cookie usage, privacy policy, and consent mechanisms. Update documentation as your practices evolve or as APPI guidance is updated.
The 2020 APPI amendments introduced mandatory data breach notification requirements (effective April 2022).
You must report a breach to the Personal Information Protection Commission (PPC) if:
The Personal Information Protection Commission (PPC) is Japan's data protection authority responsible for enforcing APPI.
The PPC can:
The 2020 amendments introduced administrative monetary penalties for APPI violations:
Factors considered when determining penalties:
In addition to administrative fines, certain APPI violations can result in criminal penalties:
Recent amendments have significantly strengthened APPI, bringing it closer to GDPR standards:
These changes reflect global trends in privacy regulation and increase compliance obligations significantly.
Mistake: Not having a privacy policy, or having one that doesn't adequately explain cookie usage, third-party sharing, or cross-border transfers.
Why It's Wrong: Violates APPI's transparency and publication requirements.
Solution: Create a comprehensive privacy policy that clearly describes all cookie types, purposes, third-party recipients, and cross-border transfers. Provide a Japanese-language version for Japanese users.
Mistake: Placing cookies and collecting data without clearly specifying and disclosing the purpose of use.
Why It's Wrong: Violates APPI's purpose specification requirement.
Solution: Before placing cookies, clearly specify and disclose the purpose (e.g., "to analyze website traffic and improve user experience," "to deliver targeted advertising").
Mistake: Using third-party services (Google Analytics, Facebook, etc.) that transfer data outside Japan without obtaining consent or implementing appropriate safeguards.
Why It's Wrong: Violates APPI's cross-border transfer restrictions introduced in the 2020 amendments.
Solution: For each service that transfers data outside Japan, either obtain explicit opt-in consent OR verify that the service has appropriate data protection measures (SCCs, BCRs) and disclose this to users.
Mistake: Sharing cookie data with third parties (analytics providers, ad networks) without obtaining opt-in consent.
Why It's Wrong: Violates APPI's restrictions on third-party provision of personal data.
Solution: Obtain explicit opt-in consent before sharing personal data with third parties. Clearly disclose which third parties will receive data and for what purposes.
Mistake: Not maintaining records of when and to whom personal data was provided.
Why It's Wrong: Violates APPI's record-keeping requirements for third-party data provision.
Solution: Maintain detailed records of all third-party data sharing, including dates, recipients, types of data, and legal basis for sharing.
Mistake: Not implementing appropriate technical and organizational security measures to protect personal data collected through cookies.
Why It's Wrong: Violates APPI's security management obligation.
Solution: Implement comprehensive security measures including HTTPS encryption, access controls, employee training, vendor supervision, and incident response procedures.
Mistake: Ignoring or significantly delaying responses to requests for disclosure, correction, or suspension of use of personal data.
Why It's Wrong: Violates APPI's individual rights provisions.
Solution: Establish clear procedures for handling individual rights requests. Respond promptly (APPI expects response "without delay," typically interpreted as within 2-4 weeks).
Mistake: Collecting cookies for one purpose (e.g., website analytics) but using the data for another purpose (e.g., targeted advertising) without obtaining new consent.
Why It's Wrong: Violates APPI's purpose limitation requirement.
Solution: Only use cookie data for disclosed purposes. If you want to use data for new purposes, specify the new purpose and obtain consent before doing so.
Mistake: Keeping cookie data and personal information indefinitely without defined retention periods.
Why It's Wrong: Best practice under APPI is to delete data when it's no longer necessary for the specified purpose.
Solution: Set appropriate cookie expiration dates and retention periods. Regularly delete or anonymize data that's no longer needed for the stated purpose.
CookieConfig is a tool to help implement cookie consent requirements under APPI and other privacy regulations. However, it is not legal advice. Your specific compliance obligations depend on your business activities, the types of data you process, and how you use that data. We strongly recommend consulting with legal counsel familiar with Japan's APPI for your specific situation, especially given the significant recent amendments that have substantially changed requirements.