If you discover a personal data leak or a ransomware attack, first contain the damage and preserve evidence, then decide whether you must report to Japan's Personal Information Protection Commission (PPC) and notify the affected individuals. Reporting and notification are mandatory, even when a leak is only suspected, if the incident involves sensitive ("special care-required") personal information, a risk of financial harm, a suspected malicious act such as unauthorized access, or more than 1,000 individuals (Act on the Protection of Personal Information (APPI), Art. 26). As a guide, the preliminary report is due within roughly 3 to 5 days of becoming aware, and the final report within 30 days (60 days for incidents suspected to be malicious).
The company may face damages claims from affected individuals, and directors who failed to build adequate controls may be liable to the company.
When This Becomes an Issue
- Ransomware has encrypted your servers, and you cannot yet tell whether customer data was exfiltrated.
- Your cloud vendor reports "traces of unauthorized access" in systems that hold your data.
- An employee sent a customer list of several hundred people to the wrong email address.
- Your overseas headquarters runs a service for Japanese users, and their data may have been exposed.
Reporting to the PPC and Notifying Individuals
The four reportable situations
A leak, loss, or damage of personal data (a "leak, etc.") must be reported to the PPC if it falls into any of the following categories (APPI Art. 26(1); Enforcement Rules Art. 7).
- A leak, etc. involving special care-required personal information, such as medical history or criminal records
- A leak, etc. that could cause financial harm if misused, such as credit card numbers
- A leak, etc. that may have been caused by a malicious act, such as unauthorized access or theft by an insider
- A leak, etc. affecting more than 1,000 individuals
Each category covers suspected incidents as well as confirmed ones. Whether a leak is "suspected" is judged on the facts known at the time. Incidents are excluded if the data was protected by measures such as advanced encryption.
When ransomware encrypts data so that it can no longer be used, the PPC treats this as "damage" to personal data. Even if exfiltration is not confirmed, a ransomware attack ordinarily falls within the reportable categories because a malicious act is suspected.
Deadlines for the preliminary and final reports
Reporting happens in two stages. The preliminary report must be made "promptly" after the company becomes aware of the incident, generally within 3 to 5 days (Enforcement Rules Art. 8(1)). For a corporation, the clock starts when any department of the company becomes aware.
The final report is due within 30 days of becoming aware. For incidents suspected to be malicious, the deadline is 60 days (Enforcement Rules Art. 8(2)). If some facts remain unknown, you report what you know and supplement it later.
Reports are filed through the online form linked from the PPC's page on responding to leaks. In some industries, the report goes to the ministry to which the PPC has delegated its authority.
Notifying individuals and public announcements
Whenever a report is required, the affected individuals must also be notified (APPI Art. 26(2)). Notice must be given "promptly, according to the circumstances" (Enforcement Rules Art. 10). Immediate notice is not required where, for example, it would worsen the damage while an attack is still being contained.
The notice covers an outline of the incident, the data items involved, the cause, whether secondary harm has occurred, and steps individuals can take. If notice is impracticable, for example because contact details are unknown, the company must take alternative measures such as a public announcement and an inquiry hotline (Art. 26(2), proviso).
A public announcement is not itself a legal requirement. However, the PPC guidelines say that promptly publishing the facts and preventive measures is desirable to prevent secondary harm and similar incidents.
Free Tool Related to This Article
Contract Risk Checker
Try our free simulator related to this topic.
Try for free →Leaks at Vendors and Cloud Providers
When a leak occurs at a vendor, both the entrusting company and the vendor are, in principle, obliged to report. If the vendor promptly notifies the entrusting company, the vendor is released from its own reporting duty and the entrusting company files the report (APPI Art. 26(1), proviso; Enforcement Rules Art. 9).
Key point
Civil Liability for Damages
Legal grounds
Affected individuals may seek damages from the company on the following grounds.
- Tort (Civil Code Art. 709): negligence in the company's own data management
- Employer liability (Civil Code Art. 715): a leak caused by an employee in the course of business
- Joint tort (Civil Code Art. 719): a leak involving both the company and its vendor
- Breach of contract (Civil Code Art. 415): failure to meet security commitments in a contract or terms of service
If you hold personal data on behalf of a business customer, that customer may also bring a contract claim.
How courts assess emotional distress damages
In one case, customer data held by a correspondence education company was taken by an employee of a subcontractor and sold to list brokers. The Supreme Court held that names, addresses, and telephone numbers are privacy-related information protected by law, and that the leak infringed the plaintiff's privacy (Supreme Court, October 23, 2017).
The Court overturned the lower court, which had dismissed the claim solely because the plaintiff had not proven harm beyond "discomfort or anxiety," and sent the case back. In other words, damages for emotional distress may be available even where concrete harm is hard to see.
On remand, the Osaka High Court held the company liable in tort for failing to supervise its vendor and awarded 1,000 yen in damages (Osaka High Court, November 20, 2019). Amounts per person vary by case, but the total can become large when many people are affected.
Administrative Measures and Penalties
The PPC may require reports, conduct on-site inspections, and issue recommendations and orders when it finds a violation (APPI Art. 148). Violating an order is punishable by imprisonment of up to one year or a fine of up to 1 million yen (Art. 178). A corporation can be fined up to 100 million yen (Art. 184(1)).
Caution
Directors' Liability and Internal Controls
In a company with a board of directors, the board decides on systems for legal compliance and risk management, commonly called internal control systems (Companies Act Art. 362(4)(vi)). For large companies, making this decision is mandatory (Art. 362(5)).
If information security arrangements do not match the company's size and risks, directors may be liable to the company for losses caused by their failure to perform their duties (Companies Act Art. 423(1)). Directors acting with bad faith or gross negligence may also be liable to third parties, such as affected individuals (Art. 429(1)).
Management is not expected to reduce incidents to zero. What is expected is a system that identifies risks, assigns budget and responsible staff, receives reports, reviews measures, and keeps records. For directors' duties in general, see Director Liability in Japan.
What the 2026 Amendment Is Expected to Change
An amendment to the APPI was promulgated on July 17, 2026. It will in principle take effect within two years of promulgation, with detailed standards to be set by Cabinet Order and PPC rules.
According to PPC materials, notice to individuals will be relaxed, with alternative measures allowed, where the lack of notice is unlikely to harm their rights and interests. The PPC is also considering allowing exemptions from the preliminary report in certain cases and adding unlawful third-party provision to the reportable categories. Until the amendment takes effect, follow the current rules.
For Companies with Overseas Operations or Users
A foreign business that handles the personal information of people in Japan in connection with supplying goods or services to them is subject to the APPI (Art. 171). If data on Japanese users is leaked, the Japanese reporting and notification rules apply. For issues specific to foreign companies, see Japan APPI Data Breach Reporting: A Guide for Foreign Companies.
If you also handle EU personal data, GDPR reporting obligations may apply in parallel. The main differences are as follows.
| Item | Japan (APPI) | EU (GDPR) |
|---|---|---|
| Deadline for reporting to the authority | Preliminary: roughly 3–5 days; final: 30 days (60 days if malicious) | Without undue delay and, where feasible, within 72 hours of becoming aware (Art. 33(1)) |
| When reporting is required | The four categories set by the Enforcement Rules | Unless the breach is unlikely to result in a risk to individuals' rights and freedoms |
| Contacting individuals | Required in principle for all reportable incidents | Required where there is a high risk (Art. 34) |
| Vendors and processors | Released from reporting by notifying the entrusting company | Must notify the controller without undue delay (Art. 33(2)) |
Important
Checking Your Cyber Insurance
Cyber insurance may cover costs such as forensic investigation, notification and call centers, and damages. Coverage and conditions differ by policy, so review the policy wording immediately after an incident.
Check the deadline for notifying the insurer and whether the insurer must approve your choice of forensic firm or lawyers. Whether a ransom payment would be covered, and whether to pay at all, should be decided only after consulting the insurer and specialists.
What You Can Do Now: An Incident Response Timeline
- 1
Isolate
Disconnect infected devices from the network and suspend suspicious accounts. Powering down can destroy evidence, so follow specialists' instructions on how to do it.
- 2
Preserve evidence
Keep logs, ransom notes, suspicious emails, and records of system activity. Start a timeline of who did what and when.
- 3
Assess the scope
Identify the types of data involved, the number of individuals, and whether sensitive data or card numbers are included. Decide at this stage whether the incident is reportable (Enforcement Rules Art. 7).
- 4
File the preliminary report
If reportable, file within roughly 3 to 5 days (Enforcement Rules Art. 8(1)). Also coordinate contacting the police, your insurer, and business partners.
- 5
Notify and announce
Prepare the notice and an inquiry hotline, and notify individuals promptly according to the circumstances (APPI Art. 26(2)). Decide the scope and timing of any public announcement.
- 6
Final report and prevention
Investigate the cause and file the final report within 30 days (60 days if malicious) (Enforcement Rules Art. 8(2)). Adopt preventive measures and report them to the board.
Preparing in Peacetime
- Set an incident contact chain and designate who decides whether to report.
- Keep an inventory of the types, volume, and locations of personal data you hold.
- Include incident notification deadlines, investigation cooperation, and subcontracting limits in vendor contracts.
- Store backups so they cannot be encrypted in the same attack.
- Run a ransomware tabletop exercise at least once a year.
When to Consult a Lawyer
We recommend consulting a lawyer early in situations like these.
- You cannot tell whether the incident is reportable, and the preliminary report deadline is approaching.
- The attacker has demanded a ransom or threatened to publish your data.
- You and your vendor disagree about the cause or the allocation of responsibility.
- Affected individuals or business partners have demanded damages or explanations in writing.
- Overseas operations or users are involved, and reporting deadlines in several countries overlap.
Our firm focuses on data protection and IT, and advises in Japanese and English from the initial response through regulatory reporting and negotiations with affected individuals and business partners. Please contact us through our inquiry page.
FREE CONSULTATION
Corporate Law: your first 30 minutes are free
- ・Handled by Yusuke Abe, admitted in Japan and New York
- ・Online (Zoom etc.) or at our office in Otemachi, Tokyo
- ・In English or Japanese
Frequently Asked Questions
Do we have to report even if a leak is not confirmed?
Yes. The four reportable categories cover cases where a leak is only suspected. You judge this on the facts known at the time, and the preliminary report only needs to include what you know. If you later find there was no leak, you report that.
Is ransomware that only encrypted our data reportable?
Data encrypted so that it can no longer be used counts as "damage" to personal data. Because the attack is presumably malicious, it is ordinarily reportable. The final report deadline is then 60 days, as for other incidents suspected to be malicious.
If the leak happened at our vendor, do we have to report it?
In principle, both your company and the vendor must report. If the vendor promptly notifies you, your company files the report. You also have a duty to supervise your vendors, so treat the incident as your own.
How much compensation might each affected person receive?
There is no fixed amount; it depends on the data involved, any secondary harm, and how the company responded. The Supreme Court held that emotional distress damages may be at issue as a privacy infringement even where concrete harm is hard to see. On remand in that case, the court awarded the plaintiff 1,000 yen.
Does the GDPR's 72-hour rule matter to Japanese companies?
If you handle EU personal data, the GDPR may apply to you. In that case, the authority must generally be notified within 72 hours of becoming aware of a breach, where feasible. Because this is shorter than Japan's preliminary report window of roughly 3 to 5 days, use 72 hours as your benchmark when both regimes apply.