Corporate LawLast updated: 2026-10-235 min readPublic-source summary

Personal Information Protection Commission Seeks Public Comment on Draft Rule Amendment: Online Method for Service by Publication (21 October 2026)

This article compiles what Japanese government bodies have published, together with the statutory text. Links to the primary sources are included. For a specific matter, pleasecontact us.

Key Takeaways

  • ✓On 21 October 2026 the Secretariat of the Personal Information Protection Commission (PPC) opened public comment on a draft rule amending the APPI Enforcement Rules and a related rule (case no. 240000131)
  • ✓Comments are due by 17:00 on 20 November 2026; comments sent by post must arrive by that day
  • ✓The rules concerned are the Enforcement Rules of the Act on the Protection of Personal Information (PPC Rule No. 3 of 2016) and the rule on reporting leaks of specific personal information under Article 29-4 of the My Number Act (Rule No. 5 of 2015)
  • ✓Article 163(2) of the APPI, as amended by Act No. 56 of 2026, provides that service by publication is made by making the notice viewable by the general public by a method set by PPC rule, together with posting on the PPC notice board or making it viewable on a computer at the PPC office
  • ✓The draft defines that method as displaying the notice, recorded in a PPC file, on the viewer's screen using an automatic public transmission server connected to the internet
  • ✓Promulgation and entry into force are planned for mid-January 2027
Share this article

On 21 October 2026 the Secretariat of Japan's Personal Information Protection Commission (PPC) opened public comment on a draft rule partially amending the Enforcement Rules of the Act on the Protection of Personal Information (APPI) and the rule on reporting leaks of specific personal information under Article 29-4(1) and (2) of the My Number Act.

This page sets out the content of the case page on e-Gov Public Comment, the guidelines for submitting comments, and the outline of the amendment (including the referenced provisions).

Overview

ItemDetail
Date the draft was published21 October 2026
Responsible bodySecretariat of the Personal Information Protection Commission (Office for the Personal Information Protection System)
Case number240000131
Legal basisArticle 163(2) of the APPI as amended by the Act Partially Amending the Act on the Protection of Personal Information, etc. (Act No. 56 of 2026); Article 29-4(1) and (2) of the My Number Act
Deadline17:00 on 20 November 2026 (comments sent by post must arrive by that day)
Rules concernedEnforcement Rules of the APPI (PPC Rule No. 3 of 2016); rule on reporting leaks of specific personal information under Article 29-4(1) and (2) of the My Number Act (Specific Personal Information Protection Commission Rule No. 5 of 2015)
Planned schedulePublic comment from late October to mid/late November 2026; promulgation and entry into force in mid-January 2027 (planned)

Current rules on service by publication

Service by publication is a method of service the PPC may use where, for example, the address of the person to be served is unknown (APPI, Article 163(1)). That paragraph lists the following cases:

  • Where the domicile, residence or other place for service of the person to be served is unknown
  • Where, for service to be made in a foreign country, the procedure under Article 108 of the Code of Civil Procedure cannot be used, or service is considered impossible even by that procedure
  • Where no document certifying service has been sent within six months after a request was made to the competent foreign authority under Article 108 of the Code of Civil Procedure

The current Article 163(2) provides that service by publication is made by posting, on the PPC notice board, a statement that the documents to be served will be delivered to the person at any time. It takes effect two weeks after the posting begins, and six weeks for service to be made in a foreign country (Article 163(3) and (4)).

Free Tool Related to This Article

Contract Risk Checker

Try our free simulator related to this topic.

Try for free →

Article 163(2) as amended

According to the outline, Article 163(2) as amended by Act No. 56 of 2026 provides that service by publication is made by making that statement (the "public notice") viewable by the general public by a method set by PPC rule, and, together with this, either posting a document stating it on the PPC notice board or making it viewable on a computer screen installed at the PPC office.

The outline explains that internet-based methods for service by publication have already been introduced by the Act Partially Amending the Code of Civil Procedure, etc. (Act No. 48 of 2022) and by the Act Partially Amending the Basic Act on the Formation of a Digital Society, etc. (Act No. 63 of 2023), and that the APPI is being brought into line with them.

Content of the draft rule

Article 69 of the Enforcement Rules (method of service by publication)

According to the outline, the draft defines the "method set by PPC rule" under the amended Article 163(2) as a method including the following: a method using an electronic data processing system connecting, through a telecommunications line, a computer used by the PPC (including input and output devices) and a computer used by the viewer (limited to one that can connect to the PPC's computer through a telecommunications line and communicate normally), which meets both of the following:

  1. It displays the public notice, recorded in a file on the PPC's computer, on the screen of the viewer's computer
  2. It uses an automatic public transmission server connected to the internet

The current Article 69 of the Enforcement Rules provides that the PPC may publish the fact of service by publication in the Official Gazette or a newspaper, and, for service to be made in a foreign country, may give notice of it instead. The outline states that the new method does not replace or exclude this, and that the current text will become Article 69(2).

Express inclusion of input and output devices

Other provisions of the Enforcement Rules that use the word "computer" are to be amended to state expressly, where appropriate, that it includes input and output devices, in line with Article 23(ii) of the APPI Enforcement Order. Article 3(3) of the My Number Act leak-reporting rule is to be amended in the same way.

How to submit comments

According to the guidelines, comments may be submitted by one of the following:

  • The comment form on the e-Gov page for this case
  • Post (must arrive by the deadline)
  • Email

Comments by telephone are not accepted. Comments must be written in Japanese, and must relate to the amendments set out in the draft.

Sources

  • e-Gov Public Comment, case no. 240000131 (with PDFs of the guidelines, the draft rule and the outline; Japanese): https://public-comment.e-gov.go.jp/servlet/Public?CLASSNAME=PCMMSTDETAIL&id=240000131&Mode=0
  • e-Gov, Act on the Protection of Personal Information (Act No. 57 of 2003): https://laws.e-gov.go.jp/law/415AC0000000057
  • e-Gov, Enforcement Rules of the Act on the Protection of Personal Information (PPC Rule No. 3 of 2016): https://laws.e-gov.go.jp/law/428M60020000003

This page is compiled from material published by government agencies and from statutory text. Please consult a lawyer where a decision is needed on a specific matter.

Free Tools for This Area

Share this article
This article provides general legal information and does not constitute legal advice. For specific legal issues, please consult with a qualified attorney.

More Legal News

Related Articles

Japan APPI Data Breach Reporting for Foreign Companies: Extraterritorial Reach, Deadlines and Notifying Individuals

Foreign companies that supply goods or services to people in Japan can be bound by Japan's data breach reporting duty even without a Japanese office. This guide covers extraterritorial reach, the four reportable situations, the preliminary report (roughly 3–5 days) and final report (30 days, or 60 days for wrongful-purpose incidents), notifying individuals, penalties and the amending act promulgated in July 2026.

Data Breaches and Ransomware in Japan: Reporting Deadlines, Damages, Director Liability, and First Response

For companies facing a personal data leak or ransomware attack in Japan: PPC reporting deadlines, notice to individuals, vendor leaks, damages and director liability, a first-response timeline, and how the APPI differs from the GDPR.

Personal Data Breach Notification in Japan: APPI Obligations and Response Procedures

Japan's mandatory breach notification obligations under the amended APPI: which incidents trigger reporting, timelines, content requirements, and best practices.

Entering Japan as a Foreign Company: Representative Office, Branch or Subsidiary, and the Governing Law of Your Contracts

How a foreign company can enter Japan through a representative office, a branch or a subsidiary, explained against the Companies Act: the ban on continuous transactions before registration, the representative in Japan, KK versus GK, governing law and jurisdiction clauses, Foreign Exchange Act filings, and the October 2025 changes to the Business Manager status of residence.

Director Liability in Japan: Duties, the Business Judgment Rule, Derivative Suits, and D&O Insurance

A practical guide for executives on directors' duties and liability under Japan's Companies Act: the duty of care and loyalty, the business judgment rule (Apamanshop case), conflict-of-interest approvals, subsidiary oversight, how derivative suits unfold, and liability limitation, indemnification and D&O insurance, with a checklist.

Labor Compliance for Japanese Companies: Key Regulations and Penalties

Comprehensive guide to labor compliance for Japanese companies, covering key regulations and penalties.

Related reading

Corporate Law

Entering Japan as a Foreign Company: Representative Office, Branch or Subsidiary, and the Governing Law of Your Contracts

How a foreign company can enter Japan through a representative office, a branch or a subsidiary, explained against the Companies Act: the ban on continuous transactions before registration, the representative in Japan, KK versus GK, governing law and jurisdiction clauses, Foreign Exchange Act filings, and the October 2025 changes to the Business Manager status of residence.

Corporate Law

Japan APPI Data Breach Reporting for Foreign Companies: Extraterritorial Reach, Deadlines and Notifying Individuals

Foreign companies that supply goods or services to people in Japan can be bound by Japan's data breach reporting duty even without a Japanese office. This guide covers extraterritorial reach, the four reportable situations, the preliminary report (roughly 3–5 days) and final report (30 days, or 60 days for wrongful-purpose incidents), notifying individuals, penalties and the amending act promulgated in July 2026.

Corporate Law

Director Liability in Japan: Duties, the Business Judgment Rule, Derivative Suits, and D&O Insurance

A practical guide for executives on directors' duties and liability under Japan's Companies Act: the duty of care and loyalty, the business judgment rule (Apamanshop case), conflict-of-interest approvals, subsidiary oversight, how derivative suits unfold, and liability limitation, indemnification and D&O insurance, with a checklist.

Corporate Law

Labor Compliance for Japanese Companies: Key Regulations and Penalties

Comprehensive guide to labor compliance for Japanese companies, covering key regulations and penalties.

Corporate Law

Intellectual Property Basics in Japan: Patents, Trademarks, and Copyrights

Overview of intellectual property rights in Japan: patents, trademarks, designs, and copyrights.

Corporate Law

Shareholders' Meeting Procedures in Japan: From Notice to Resolution

Guide to shareholders' meeting procedures in Japan, including notice requirements and resolution types.

Attorney Yusuke Abe

Free 30-min consultation

Talk to a lawyer about the issues in this article

Yusuke Abe, admitted in Japan and New York, will handle your matter — in Japanese or English, online or in person.

Book a free consultation