Japan Act on the Protection of Personal Information (APPI)

Specify the purpose of use as far as possible when acquiring personal information and make it public or notify the individual; any change must stay within a scope reasonably related to the original purpose and be re-notified. Before using Japanese user data for model training, confirm that training falls within the published purpose of use, otherwise extend the purpose or obtain consent first.

Applies when

Personal information handling business operators that supply products or services to individuals in Japan, including operators established abroad.

Evidence to retain

• · Japanese-language privacy policy and published purpose-of-use page
• · Assessment record of the reasonable relatedness of any purpose change
• · Mapping of model-training uses to the published purposes

Estimated first-time effort: 4–10 person-days (estimate, not a commitment)

Special care-required personal information — such as creed, medical history and criminal record — may only be acquired with the individual’s prior consent, subject to statutory exceptions. For AI companies, scraping public web pages containing health, religious or political content for training is not exempted merely because the content is public; each case must be checked against the exceptions.

Applies when

Companies scraping or receiving datasets that may contain special care-required information, or handling health or biometric-related data in Japan.

Evidence to retain

• · Detection and filtering rules for special care-required information
• · Consent records or assessment of the exception relied on
• · Sampling review report on sensitive content in the dataset

Estimated first-time effort: 6–15 person-days (estimate, not a commitment)

Implement organisational, personnel, physical and technical security control measures over the personal data handled, to prevent leakage, loss or damage; where handling is entrusted abroad, the operator must also understand the relevant foreign regime and take necessary and appropriate measures.

Applies when

All operators handling Japanese personal data, including those running training and inference environments in China.

Evidence to retain

• · Security control measures procedure covering all four categories
• · Record of the survey of the foreign regime where handling occurs
• · Access control and log audit records
• · Employee confidentiality undertakings and training records

Estimated first-time effort: 10–25 person-days (estimate, not a commitment)

Where all or part of the handling of personal data is entrusted to another party, the entrusting operator must exercise necessary and appropriate supervision — in practice, selecting the contractor appropriately, concluding a contract containing security requirements, and keeping track of how the contractor actually handles the data. A Chinese AI company acting as contractor to a Japanese customer must be ready to be supervised and audited.

Applies when

Both the entrusting operator and the contractor; Chinese vendors are typically the contractor.

Evidence to retain

• · Entrustment agreement with security and sub-contracting clauses
• · Contractor selection assessment record
• · Periodic handling-status reports and onsite or remote audit records
• · Sub-contracting approval records

Estimated first-time effort: 5–12 person-days (estimate, not a commitment)

Where a leakage, loss or damage event of the kind prescribed by PPC rules occurs — one posing a substantial risk to individuals’ rights and interests — the operator must report to the PPC as prescribed and notify the affected individuals, unless notification is difficult and substitute protective measures are taken. A contractor that notifies the entrusting operator is relieved of reporting itself. Reporting is in two stages, a prompt report and a definitive report.

Applies when

All operators handling Japanese personal data; Chinese vendors acting as contractors should fix the notification deadline to the Japanese principal by contract.

Deadline: Two-stage prompt and definitive reports as prescribed by PPC rules; the exact deadlines in those rules were not verified in this pass and must be confirmed against the rules themselves

Evidence to retain

• · Incident response plan including the Japanese reporting path
• · Records of the prompt and definitive reports filed
• · Notice text to individuals and proof of dispatch
• · Justification and records of any substitute protective measures

Estimated first-time effort: 5–12 person-days (estimate, not a commitment)

Providing personal data to a third party in a foreign country in principle requires the individual’s prior consent to that provision, and before obtaining consent the operator must supply information about the personal-information regime of that country, the protective measures taken by the recipient and other reference information, as prescribed by PPC rules. Two exceptions apply: the recipient country is designated by PPC rules as having a regime at an equivalent level to Japan; or the recipient has established a system meeting PPC-prescribed standards for continuously implementing equivalent measures. Where the latter is relied on, the provider must take the measures necessary to ensure those equivalent measures continue and must supply information about them on request.

Applies when

Chinese AI companies routing Japanese users’ or customers’ personal data into training, annotation, support or operations environments in China. Mainland China is not on the PPC list of countries with an equivalent regime, so in practice either the consent route or the equivalent-measures route must be used.

Evidence to retain

• · Information supplied to individuals about the foreign regime and the recipient’s protective measures
• · Consent records including time and scope of consent
• · Equivalent-measures system documentation: contract, internal rules and a gap-mapping table
• · Annual confirmation record of continued implementation
• · Records of responses to individuals’ requests for information

Estimated first-time effort: 10–25 person-days (estimate, not a commitment)

Article 171 provides that the Act also applies where a personal information handling business operator, pseudonymously processed information handling operator, anonymously processed information handling operator or personally referable information handling operator handles, in a foreign country, the personal information of a person in Japan — or personally referable information to be acquired as such, or pseudonymously or anonymously processed information created from it — in connection with supplying goods or services to persons in Japan. Operators abroad therefore need a working capability to receive individuals’ requests and to respond to PPC enquiries and reporting requirements.

Applies when

Chinese AI companies with no Japanese entity that nonetheless offer apps, websites, model APIs or device-companion services to users in Japan.

Evidence to retain

• · Extraterritoriality assessment memo linking business activity to users in Japan
• · Japanese-language contact channel and internal response-time rules
• · Register of individuals’ requests
• · PPC enquiry response plan and designated authorised contact

Estimated first-time effort: 4–10 person-days (estimate, not a commitment)