Act on the Protection of Personal Information (Act No. 57 of 2003)
Below is what the official text of Act on the Protection of Personal Information (Act No. 57 of 2003) states about whom it covers, when it applies to a business and since when. Where the pages we read do not say, the row says "not stated".
The wording shown is taken from the official page named in each row. The duties of a business and the contents of a privacy notice are in the paid checklist.
Typical situations, run through the same conditions as the check
- A for-profit business established in Japan: Applies, or may apply: conditions to check.
- A US business with users in Japan: Applies, or may apply: conditions to check.
- A US business with no users in Japan: Not triggered by these answers.
Judged on 2026-10-06. Our law data was last verified on 2026-10-06; a law that took effect after that date is not in it. These situations leave other answers blank or neutral: use the check for your own.
What the official text states
| Question | What the official text states | Source |
|---|---|---|
| What it covers | The Act protects the rights and interests of individuals while ensuring proper handling and use of personal information, by setting basic principles and establishing obligations that businesses and administrative entities that handle personal information must comply with.Official wordingThe purpose of this Act is to protect the rights and interests of individuals while ensuring the smooth and proper management of the processes or services of administrative entities as well as ensuring due consideration of the value of personal information and the fact that the proper and effective application of personal information cont | www.japaneselawtranslation.go.jp read 2026-10-06 |
| When it applies to a business | The Act also applies where, in relation to supplying a good or service to a person in Japan, a business handling personal information handles in a foreign country the personal information by which that person in Japan is identifiable (Art. 171). Conditions to check: Art. 171 extends the Act abroad; the core obligations bind a 'business handling personal information', defined in Art. 16(2) as a person that uses a personal information database or the equivalent for business (excluding government organs and certain public bodies). Our questions cannot express that definition or the domestic case (a business in Japan with data subjects elsewhere). Cabinet and PPC orders and guidelines were not read. Official wordingThis Act also applies in those cases in which, in relation to supplying a good or service to a person in Japan, a business handling personal information, a business handling pseudonymized personal information, a business handling anonymized personal information, or a business handling information related to personal information handles th | www.japaneselawtranslation.go.jp read 2026-10-06 |
| In force from | Not stated on the official pages we read. The government translation page carries no supplementary provisions or enforcement dates; the page says 'Last Version: Act No. 37 of 2021' and no date can be stated from it. | — |
| Privacy notice | Included in the paid checklist. See the checklist | — |
| Consent and opt-out | Included in the paid checklist. See the checklist | — |
| Rights of individuals | Included in the paid checklist. See the checklist | — |
| Data protection officer | Not stated on the official pages we read. The text read states no requirement to appoint a data protection officer or person in charge. | — |
| Breach notification | Included in the paid checklist. See the checklist | — |
| What the privacy notice must contain | Included in the paid checklist. See the checklist | — |
What we do not cover
These areas are outside this site, so nothing on this page says anything about them:
- Privacy laws for particular sectors (for example health care, banking and credit, education)
- Rules specific to children's online privacy
- Cookie and electronic-communications rules (including consent for cookies and marketing messages)
- Employee, job applicant and contractor data
- Rules on sending personal data to other countries
- US state data-breach notification laws (a separate set of state laws)
- US state privacy laws that are not yet in force, and state laws on particular topics (for example biometric or health data)
- Privacy laws of countries that are not listed here
- Planned changes to the laws listed here