Japan APPI Data Breach Reporting for Foreign Companies: Extraterritorial Reach, Deadlines and Notifying Individuals

A foreign company with no office in Japan can still be subject to Japan's Act on the Protection of Personal Information (APPI) if it supplies goods or services to people in Japan (Article 171). If so, certain leaks and similar incidents must be reported to the Personal Information Protection Commission (PPC) and notified to the individuals concerned. Reporting has two stages: a preliminary report roughly within 3 to 5 days of becoming aware, and a final report within 30 days (60 days where the incident results from an act with a wrongful purpose, such as unauthorised access). An amending act promulgated in July 2026 will relax individual notification in some cases and introduce an administrative surcharge.

• You run an e-commerce site or SaaS outside Japan and hold Japanese users' names, email addresses and payment details on servers in your home country.
• Your head-office systems are hit by ransomware and you do not yet know whether Japanese users' data was affected.
• You operate an app for the Japanese market, but your incident-response plan only covers your home jurisdiction or the GDPR.
• You receive customer data from a Japanese subsidiary or distributor and use it for marketing at head office.

The APPI applies where a business located outside Japan handles, outside Japan, personal information about people in Japan in connection with supplying goods or services to people in Japan (Article 171). This is the Act's extraterritorial reach.

The key element is the link to supplying goods or services to people in Japan. Merely holding data about Japanese residents does not always trigger the Act. Covered businesses are not limited to those based only outside Japan; they include, for example, the foreign head office of a business with a branch in Japan. It also does not matter whether the service is paid (PPC, General Guidelines on the APPI).

The guidelines give these examples of covered cases:

• A foreign online retailer handling Japanese consumers' personal information in connection with selling and delivering goods to them
• A foreign email service provider handling Japanese consumers' personal information in connection with providing its service to them
• A foreign hotel using Japanese consumers' personal information received from a Japanese travel agency to send them tourist information

Information received from a Japanese company is covered, not only information collected directly from individuals.

By contrast, a foreign parent company handling the personal information of its Japanese subsidiary's employees for group HR purposes is given as an example of a case not covered. Even then, the Japanese subsidiary must comply with the rules on transfers to third parties in foreign countries (Article 28) when it sends the data.

A business must report to the PPC when a leak, loss or damage of personal data (together, a "leak or similar incident") occurs that is likely to cause serious harm to individuals' rights and interests (Article 26(1)). The PPC Rules list four situations; any one is enough (Rules, Article 7). A situation where such an incident may have occurred is also covered.

A leak affecting a single person must still be reported if it falls into one of the first three situations. Data protected by measures such as strong encryption is excluded (Rules, Article 7(i)).

On becoming aware of a reportable situation, the business must promptly report what it knows at that point (Rules, Article 8(1)). The guidelines give roughly 3 to 5 days from becoming aware as the benchmark for "promptly". Reports are in principle filed through the reporting form on the PPC website.

The report covers nine items: an overview, the categories of personal data involved, the number of individuals, the cause, any secondary harm or risk of it, the response to individuals, the status of any public announcement, measures to prevent recurrence, and other relevant matters. At the preliminary stage, what is known so far is enough.

In addition, all nine items must be reported within 30 days of becoming aware (Rules, Article 8(2)). Where the situation results from an act that may have had a wrongful purpose, the deadline is 60 days. This also applies where such an act overlaps with another category, such as more than 1,000 individuals.

The clock starts when any department of the company becomes aware, and that day counts as day one. For multinational groups, the date head-office security learns of an incident and the date the Japanese entity learns of it can differ, so this needs care.

Where data processing is outsourced and the incident occurs at the service provider, both the client and the provider are in principle obliged to report. If the provider notifies the client of the required items, the provider is released from its own reporting and notification duties (Article 26(1) proviso; Rules, Article 9).

On becoming aware of a reportable situation, the business must also notify the individuals concerned (Article 26(2)). Notice must be given promptly in light of the circumstances, covering the overview, the categories of data, the cause, any secondary harm and other relevant matters (Rules, Article 10).

The guidelines accept that immediate notice is not required where it could make matters worse, for example while requests to remove leaked data from an online forum are still under way. Notice must still be given promptly.

Alternative measures such as a public announcement are permitted only where notifying individuals is difficult (Article 26(2) proviso). Unless, for example, the business has no contact details, notice is the rule.

For breaches such as failing to report or notify, the PPC may issue recommendations and orders (Article 148). Foreign businesses covered by Article 171 are also subject to guidance, recommendations and orders.

Violating an order is punishable by imprisonment of up to one year or a fine of up to JPY 1 million for the person responsible (Article 178), and a company may be fined up to JPY 100 million (Article 184(1)(i)). The PPC may also publicly announce that an order has been violated (Article 148(4)). Note that Article 183, which lists the offences that also apply to acts committed outside Japan, does not include the offence of violating an order (Article 178).

The Act Partially Amending the Act on the Protection of Personal Information and Other Acts was passed on 10 July 2026 and promulgated on 17 July 2026. It will take effect, in principle, on a date set by Cabinet Order within two years of promulgation (Supplementary Provisions, Article 1).

The main points relevant to breaches are:

• Alternative measures will also be allowed where the PPC Rules specify that the lack of notice is unlikely to harm individuals' rights and interests (amended Article 26(2)). The PPC's explanatory material mentions, for example, a leak of internal user IDs that mean little on their own.
• The explanatory material also indicates that preliminary reports may be waived within a certain scope where the business's systems have been checked by a third party, that final reports for misdeliveries affecting one person may be filed in batches, and that unlawful provision of data to third parties will become reportable. Details will be set as the related Cabinet Orders, PPC Rules and guidelines are developed.
• An administrative surcharge equal to the financial gain from a violation will be introduced for serious violations that harm individuals' rights and interests (amended Articles 148-3 to 148-17).

Until the amendments take effect, the current rules continue to apply.

1. List the goods and services you supply to people in Japan and the personal data you handle for them.
2. Add Japan's four reportable situations and the deadlines (preliminary report roughly 3–5 days; final report 30 or 60 days) to your incident-response plan.
3. Decide who records the date of becoming aware, and share it between head office and the Japanese side.
4. Check the fields of the PPC's reporting form and assign people to gather the nine items.
5. Put notification deadlines and content for incidents into your contracts with service providers.
6. Prepare a Japanese-language template notice to individuals and a public announcement for cases where notice is not possible.
7. Track the PPC Rules under the 2026 amendments and plan when to update your procedures.

• An incident has occurred that may involve Japanese users' data. Deciding whether one of the four situations applies has to happen in the first few days.
• You cannot tell whether your service counts as supplying goods or services to people in Japan.
• The PPC has asked you for a report or contacted you with guidance.
• You want to align your home-country procedures, such as the GDPR's 72-hour rule, with Japan's rules.
• You need to settle who reports and who notifies among your service providers and group companies.

We can advise in English.

Yes, if it handles personal information about people in Japan in connection with supplying goods or services to people in Japan (Article 171). Having a local presence or being paid is irrelevant. Holding data about Japanese residents with no link to supplying goods or services in Japan may fall outside the Act.

The rules say "promptly", and the guidelines give roughly 3 to 5 days from becoming aware as the benchmark. The preliminary report only needs to contain what is known at that point.

No. The 60-day deadline applies where the situation results from an act that may have had a wrongful purpose, such as unauthorised access (Rules, Article 8(2)). A leak of sensitive personal information alone has a 30-day final report deadline.

Under the current Act, alternative measures such as a public announcement are allowed only where notifying individuals is difficult (Article 26(2) proviso). Once the 2026 amendments take effect, they will also be allowed in cases the PPC Rules specify as unlikely to harm individuals' rights and interests.

The timeframes are similar, but the reportable situations, the items to report and the final report deadline are specific to Japan. Your procedures need to cover Japan's four situations and nine reporting items.