Framework library · Japan

APPI

APPI — Act on the Protection of Personal Information. Published by Personal Information Protection Commission (PPC), version Act No. 57 of 2003 (as amended). Kapālins maps it to 5 controls. 2 of 5 controls are proved by a live signal from the platform, and 3 by the assessment.

Read the source document

Controls mapped
APPI-17Purpose of use — specification and restrictionAssessment
APPI-20Proper acquisition & special care-required dataAssessment
APPI-23Security control measuresLive signal
APPI-26Breach reporting to the PPCLive signal
APPI-28Cross-border transfer of personal dataAssessment

Live signal: a signal from the gateway, probes or device sensor proves it continuously. Assessment: it is evidenced by answers to the assessment. Both are exported in the regulator evidence pack.

History

How APPI got here.

  1. In force

    The amended Act on the Protection of Personal Information took full effect. Personal Information Protection Commission

  2. Amended

    The Diet approved the 2020 APPI amendment bill; it was promulgated on 12 June 2020. Personal Information Protection Commission

  3. In force

    The 2020 amendments to the APPI took full effect. Personal Information Protection Commission

  4. Amended

    An APPI amendment Act was promulgated after Diet passage on 10 July 2026, adding administrative fines. A&O Shearman

  5. In force · upcoming

    Strengthened criminal penalties under the 2026 APPI amendments commence; the main reforms follow by 17 July 2028. A&O Shearman

See this framework on your estateAll 29 frameworks