If you are a business that collects the personal information of Japanese data subjects to provide them with your goods and services and you transfer their data out of Japan, you will have to comply with the privacy laws applicable in Japan. In this article, we will help you understand Japan’s data protection law requirements, how you can comply with these requirements, and the potential risks you face for non-compliance.
While the guidelines by the Personal Information Protection Commission are not fully comprehensive, you should take them into account when you design your data protection law compliance program.
In addition to these guidelines, there are also sector-specific guidelines for particular data processing that may be relevant for you.
If you operate in the medical sector, for example, guidelines by the Ministry of Health, Labor and Welfare can clarify your obligations when you process sensitive data. One such guideline is the Guidance for the Appropriate Handling of Personal Information by Medical or Care-related Service Providers.
If you are based in Japan and handle the personal data of data subjects, you must comply with the APPI requirements.
If you are a foreign organization, you will be subject to the APPI if the following three criteria are met:
The APPI applies if you are a business that handles the personal information of Japanese data subjects.
If you collect the personal data of a data subject for the purpose of providing your products and services and handle the personal data of data subjects in a foreign country, you will be subject to the APPI requirements.
The APPI applies to the “handling” of personal data. Handling refers to the collection, retention, use, transfer, and otherwise handling of personal information.
A business that handles personal information is called “Personal Information Controller (“PIC”). Since there are far too many compliance requirements than we can cover in this blog post, we will focus on the most important ones and how you can comply:
The APPI does not set out specific rules for cookies, and cookies are not considered personal information. However, you may need to obtain consent for placing cookies on users’ browsers when the following condition is met:
If you transfer cookies to a third-party recipient, such as third-party vendors that place personalization and advertisement cookies on your website, and this cookie can be used to identify an individual, this cookie is “person-related information.”
For these cookies, you will need consent from data subjects because you may collect person-related information.
In the Rikunabi case, a job-seeking platform used cookies to record students’ browsing history and to profile them based on this information, then transferring personal data to third-party job advertisers. For instance, it calculated the likelihood of a student declining a job offer. The PPC ruled that these cookies were “person-related information” and the website had to ask for students’ consent.
In short, cookies are not considered “personal information” in Japan. However, certain third-party cookies may allow third parties to identify data subjects, and therefore, you may need consent from the data subjects, particularly for advertisement and personalization purposes.
The Rikunabi case shows that the regulatory authority may come after you when you fail to obtain consent from data subjects.
Earlier this year, Japan's Telecommunications Business Act (TBA) has been updated, defining 4 types of telecommunications services that are now subject to cookie regulations :
Businesses that the TBA applies to are required to take one of the following measures to transmit cookie information (or other user-specific data) to a third party:
(i) notify users about any transmission of their data or make that information readily available,
(ii) obtain consent from users,
or (iii) provide users the ability to opt out.
Under the TBA, data that is necessary for the proper functioning of a telecommunications service is exempted from the cookies requirements.
If the Personal Information Protection Commission (PPC) finds that a data controller (PIC) violated the APPI requirements, it can impose the following sanctions and penalties:
While there are certain similarities between Europe's General Data Protection Regulation (EU GDPR) and Japan's Data Protection Law, the two laws fundamentally differ from each other in various ways:
You might be wondering why so many data privacy regulations are emerging around the world for the past few years. To learn more, explore our research piece about the accelerated pace of consumer data regulation and customer preference activity:
If you want to satisfy all Japan Data Protection Law (APPI) requirements and safely handle Japanese people’s data, you must start by relying on a legal basis to justify your data processing activities. Consent is the most common legal basis, and it can justify the use of third-party advertising, personalization, and profiling cookies, alongside social media plugins.
For instance, if you use Facebook pixel, Twitter share button, or other similar technologies on your website, you are better off asking for consent before collecting any personal data.
Therefore, you must obtain consent as specified by the APPI Law and be able to prove that you obtained consent lawfully. With a Consent management platform, you can collect consent in an APPI-compliant manner and keep a record of all consent obtained.
More than ever, privacy has become a priority for brands and for businesses operating in Japan, which means complying with the APPI requirements. Talk to an expert to find out how our solutions can help you turn data privacy into a business opportunity, and how Didomi focuses on addressing regulations and assisting companies around the world:
Yes. The main data protection law in Japan is the Act on the Protection of Personal Information (APPI), Act No. 57 of 2003.
The APPI applies to businesses based in Japan that handle the personal data of data subjects. It also applies to foreign organizations under certain criteria (see details in the article)
The key APPI requirements include obtaining consent, identifying a specific purpose for data use, using legal bases for data processing, ensuring data accuracy, implementing security measures, and informing the data protection authority in case of a data breach, among others.
Non-compliance with data privacy laws in Japan can result in penalties such as submitting a report, on-site inspection, orders to remedy violations, and, in case of failure to comply, imprisonment for up to 1 year.
While there are certain similarities between Japan's data protection law and the GDPR, they differ in various ways, including the requirement for a data protection officer, notification timelines for data breaches, and the presence of specific regulations on cookies and legitimate interest.
While the APPI does not explicitly state businesses must appoint a DPO, it recommends appointing a person in charge of handling personal information, which can be perceived as a similar role.
