Japan · Compliance
Act on the Protection of Personal Information (APPI) compliance in Japan
Achieve Act on the Protection of Personal Information (APPI) compliance in Japan with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- Compliance, end to end
- Tokyo office team
- Effivity software included
- Academy training included
Who asks for Act on the Protection of Personal Information (APPI) in Japan
Clients include
Act on the Protection of Personal Information (APPI) compliance in Japan at a glance
Act on the Protection of Personal Information (Act No. 57 of 2003) is the instrument itself: it applies to the organisations within its scope, and buyers and partners in Japan ask for evidence that you meet it.
The Personal Information Protection Commission supervises the Act on the Protection of Personal Information (Act No. 57 of 2003) across private businesses, administrative agencies and local governments. For a business, the core duties are concrete: Article 23 requires necessary and appropriate measures for managing the security of personal data, Articles 24 and 25 require supervision of employees and of any person entrusted with the data, Article 26 requires leaks to be reported to the Commission in the cases its orders prescribe, and Article 28 restricts providing personal data to third parties in foreign countries. There is no APPI certificate; compliance is shown through records, internal rules, notices and vendor oversight. JIPDEC's PrivacyMark, open only to Japanese companies, and ISO/IEC 27701 certification are voluntary benchmarks some customers request. Sterling's Tokyo office maps processing, entrustment and transfers, drafts the rules and builds the evidence, with Effivity and Sterling Academy included in the engagement.
Who needs Act on the Protection of Personal Information (APPI) in Japan, and what happens without it
These are the organisations in Japan that most often need to show Act on the Protection of Personal Information (APPI).
- Businesses handling personal information in JapanAPPI duties on security measures, supervision, leak reporting and third-party provision apply.
- Companies entrusting personal data to outsourcers and cloud providersArticle 25 requires necessary and adequate supervision of entrusted persons.
- Groups transferring personal data to overseas affiliates or vendorsArticle 28 restricts provision of personal data to third parties in foreign countries.
- Employers and entities handling My NumberThe My Number Act adds specific obligations overseen by the PPC.
Not sure which of these applies to you?Answer a short set of questions and your readiness report arrives by e-mail.
Take the free readiness checkAct on the Protection of Personal Information (APPI) requirements in Japan
Strip away the vocabulary and Japan's APPI asks a business handling personal information to comply in six areas.
In Japan these six sit alongside the local laws and regulations listed under drivers below; one system can evidence both. The detail is on the global hub: Act on the Protection of Personal Information (APPI) explained →
How to achieve Act on the Protection of Personal Information (APPI) compliance in Japan
One team from the Tokyo office carries the work from scoping to sign-off. Nationwide from the Tokyo office, on-site where the scope requires; remote delivery for distributed teams.
- Discovery call and scopeEntities, locations, regulators and target date, agreed before any proposal.
- Gap assessment against Act on the Protection of Personal Information (APPI) and the Japanese requirements that apply to youControls you already run for your regulators and customers are reused, not rebuilt.
- Your system built with your team in EffivityRisks, controls, evidence, incidents and reviews in one live system the auditor can see.
- Internal audit, management review and corrective actionsYour internal auditors trained by Sterling; the evidence proven before any external review.
- Reviews by regulators, customers and auditorsSterling supports the reviews your regulators, customers and auditors run.
- End to end, from one team
- Effivity ISO & GRC software
- Preferential Sterling Academy access, with complimentary awareness training for your people
- Internal auditor training for your audit team, as applicable to your standard
- Vulnerability assessment on ISMS engagements
The Sterling Promise: 100% on-time completion, 100% success, 8,100+ client engagements.Sterling does not certify. Certification decisions stay with independent bodies.
How long does Act on the Protection of Personal Information (APPI) compliance take in Japan?
There is no standard duration: it depends on your scope and on how much of the system already runs. In Japan these are the factors that set the timeline.
- Number of processing activities and systems to map
- Number of entrusted persons and cross-border transfers to review
- Existing PrivacyMark or ISMS documentation that can be reused
Sterling agrees a dated plan with you on the discovery call, once the scope is known.
How much does Act on the Protection of Personal Information (APPI) compliance cost in Japan?
The cost has two parts: the consulting work to build and prove the system, and any external assessor’s fees, which are quoted separately. In Japan these factors move both.
- Number of legal entities and business units in scope
- Volume of vendors and overseas transfers
- Security control remediation needed
Sterling gives one customised, all-inclusive proposal after the discovery call, never before the scope is agreed.
Act on the Protection of Personal Information (APPI) consultants and assessors in Japan
Two different organisations are involved. A consultant helps you build the system and prove it works; your regulators, customers and auditors then audits or assesses it and decides. Keeping the two separate is what makes the result credible to buyers and regulators.
- Check that the body’s accreditation or approval covers Act on the Protection of Personal Information (APPI) and your sector, and that its certificates can be verified online.
- Ask the consultant how the local requirements in Japan are mapped into the same system, so nothing runs twice.
- Ask for client references in your sector; Sterling’s client letters are available on request.
- Agree who owns the evidence and the tool after the engagement; with Sterling the system stays yours, in Effivity.
Laws and regulations that drive Act on the Protection of Personal Information (APPI) in Japan (3)
| Instrument | How it treats the standard |
|---|---|
| Act on the Protection of Personal Information (Act No. 57 of 2003) | The instrument itself Compliance obligations for businesses handling personal information; supervised by the PPC. |
| Personal Information Protection Commission — roles and responsibilities | Regulator Supervision, monitoring and complaints mediation; also oversees the My Number Act with the Digital Agency. |
| PrivacyMark System (JIPDEC) | Related Assesses Japanese private enterprises that take appropriate measures to protect personal information and grants the right to display the PrivacyMark. |
Accreditation, audit language and remote audits in Japan
Compliance, not certification: the APPI has no certificate. Evidence is the business's records, notices, rules, security measures and supervision of entrusted persons. PrivacyMark (JIPDEC, Japanese companies only) and ISO/IEC 27701 certification by an accredited body are optional external benchmarks. Edition and transition details: Act on the Protection of Personal Information (APPI) hub →
Audit language
Privacy notices and internal rules are normally kept in Japanese for Japanese data subjects and staff; English versions support overseas group review.
Remote and on-site
Data-mapping workshops can be on-site or remote; no external assessment is prescribed by the Act.
Act on the Protection of Personal Information (APPI) in Japan: questions clients ask
Is there an APPI certificate?
No. The APPI has no certificate. Compliance is shown through your own records, privacy notices, internal rules, security measures and supervision of entrusted persons. PrivacyMark and ISO/IEC 27701 are voluntary external benchmarks, useful when a customer asks for one but never a substitute for meeting the Act itself.
Must data leaks be reported to the PPC?
Yes, in the cases the PPC's orders prescribe. Article 26 of the Act requires a business to report a leak to the Personal Information Protection Commission when it falls within those cases. Not every incident will qualify, so check the order against your facts and confirm with your counsel or the PPC before deciding not to report.
Does the APPI restrict transfers to overseas vendors?
Yes. Article 28 sets restrictions on providing personal data to third parties in foreign countries, which reaches overseas vendors and affiliates. List each cross-border transfer and review it against that Article before data moves. Only the Japanese text of the Act has legal effect, so rely on counsel for the exact wording.
PrivacyMark or ISO 27701 for APPI evidence?
They differ in reach. PrivacyMark is granted only to Japanese companies, whereas ISO/IEC 27701 is an international standard that builds on an ISMS. A group with overseas affiliates may prefer 27701 for that reason; a purely domestic business may find either acceptable. Neither replaces compliance with the Act itself.
More on Act on the Protection of Personal Information (APPI) for Japanese organisations
Other standards Japanese businesses ask Sterling for
Organisations in Japan often combine Act on the Protection of Personal Information (APPI) with one of these, under one management system where the scopes allow.
Start with a free discovery call from the Tokyo office
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- Act on the Protection of Personal Information (Act No. 57 of 2003) — japaneselawtranslation.go.jp (accessed 5 Oct 2026)
- Personal Information Protection Commission — roles and responsibilities — ppc.go.jp (accessed 5 Oct 2026)
- PrivacyMark System (JIPDEC) — privacymark.org (accessed 5 Oct 2026)
- Management Matters Review (経営事項審査) for public works contractors — ktr.mlit.go.jp (accessed 5 Oct 2026)
- ISMAP (Information system Security Management and Assessment Program) — ismap.go.jp (accessed 5 Oct 2026)
Talk to a consultant
Plan your certification with the Tokyo team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
japan@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice