First announced: Amendment bill passed by the National Diet in 2025; phased enforcement beginning 2026.
Submitted by: NYBACS Compliance Desk
What changed
The amendments expand extraterritorial scope, increase administrative fines, and clarify obligations for overseas data transfers. Businesses must provide more transparent disclosures on international data handling and implement stronger safeguards for personal information.
Who’s affected
Multinational corporations processing personal data of individuals in Japan, e-commerce operators, cloud providers, fintech firms, and digital service platforms.
Immediate actions
• Review cross-border transfer agreements and safeguards.
• Update privacy notices for Japanese data subjects.
• Strengthen internal breach reporting mechanisms.
• Conduct compliance audit against updated APPI provisions.
Practical notes & timeline
Certain reporting and safeguard requirements begin in 2026, with additional enforcement guidance expected from Japan’s Personal Information Protection Commission (PPC).
