The APPI was passed in 2003 and took full effect in 2005. Since a 2017 amendment it applies to every business that holds personal information in a database, however small; the earlier exemption for businesses with fewer than 5,000 records was removed. The regulator is the Personal Information Protection Commission. Employee records, CVs, interview notes and payroll data are all personal information under the Act.
Three rules matter most in HR. First, special care-required personal information, which includes medical history, disability, health check results and criminal records, cannot be collected without the person's consent, except in limited cases such as where another law requires it. Second, transferring personal data to a third party in another country needs the person's consent, given after they have been told about that country's data protection system and the recipient's safeguards, unless the recipient is in a country Japan recognises, such as the EU and UK, or has equivalent protections in place. Within a group, a foreign parent is a separate third party. Third, since April 2022, a leak involving sensitive data, risk of financial loss, a malicious cause or more than 1,000 people must be reported to the Commission, with a preliminary report in roughly three to five days and a final one usually within 30 days, and the individuals must be told.
The national identification number, My Number, is governed by a separate and stricter statute.
What it means for a foreign employer
- Map what goes to head office. Global HRIS, talent reviews and payroll vendors outside Japan are all overseas transfers. Use consent in the onboarding pack, or a data transfer agreement that gives equivalent protection.
- Health data is the trap. Annual health checks are mandatory, but forwarding the results to a regional HR team or a global wellness vendor needs a clear legal basis.
- Background checks need care. Collecting criminal records or medical history on candidates needs their consent and a real business need.
- Plan breach response in Japanese. The preliminary report window is short. Know in advance who files it.
Sources
- Act on the Protection of Personal Information (Act No. 57 of 2003), as amended in force 30 May 2017 and 1 April 2022, Articles 20, 26 and 28.
- Personal Information Protection Commission, Guidelines (Provision to Third Parties in Foreign Countries) and guidance on breach reporting.