Japan

Extraterritorial reach sits in Article 171 of the Act on the Protection of Personal Information. Since the 2020 amendment took effect on 1 April 2022 the Personal Information Protection Commission can use its full toolkit against foreign operators, including demands for reports, on-site inspection, guidance, recommendations and orders. The Commission's own FAQ confirms the law bites whether the operator collects from individuals in Japan directly or receives the data from another Japanese business. Separately, the Ministry of Internal Affairs and Communications takes the view that the Telecommunications Business Act applies to services provided from abroad to people in Japan where the service is clearly aimed at Japan (Japanese-language interface, yen pricing, Japan-targeted marketing), and those providers must register or file a notification and name a representative or agent in Japan.

Sector by sector, checked 18 August 2026: - Government and public sector — closed The Digital Agency's Government Cloud procurement specification states that information assets are to be kept inside Japan and requires domestic data centres spread across several Japanese regions. Cloud providers must first be listed under the Information system Security Management and Assessment Program (ISMAP). The single carve-out in the 2026 round is a separately walled 'overseas AI inference environment' for frontier models unavailable in Japan. - Telecoms — conditional No storage-location mandate, but secrecy of communications is a criminal duty, designated large providers must file an internal handling code for 'specified user information' with the ministry, and the external transmission rules force disclosure of what user information is sent to third parties. - Critical infrastructure (16 named sectors including finance, medical care, telecoms, energy, transport, credit cards) — conditional Before installing critical equipment, the operator must notify the responsible minister, who reviews supplier ownership, foreign-government ties and whether foreign law could force the supplier to break its contract. The minister can order changes. - Banking, payments, insurance, securities — open The Financial Services Agency regulates by risk, not geography. Its October 2024 cybersecurity guidelines expressly cover outsourced work carried out overseas but set no storage location. Supervisory guidance requires the bank to be able to monitor and trace customer data at an outsourcer, and to write audit rights into the contract. - Health — data can leave once conditions are met, medium confidence. The three-ministry guideline framework (health ministry guideline version 7.0, June 2026; economy and communications ministries' supplier guideline version 2.0, revised March 2025) is guidance, not statute. We found no clause in the versions we could open requiring domestic storage, but hospitals must stay accountable and understand the legal environment where the data sits. - Mapping and geospatial — no export restriction found, checked 18 August 2026, medium confidence. The Geospatial Information Authority's published approval procedures cover copying and using survey results and say nothing about taking them out of Japan. - Defence — no geographic rule found, checked 18 August 2026. The defence procurement information security standard controls encryption, access and designated handling facilities rather than country of storage.

Article 28 of the Act sets the three routes: a country designated by Commission rule as having equivalent protection (only the European Economic Area and the United Kingdom are designated, by Commission Notice No. 1 of 2019); a recipient that has put in place a system conforming to the standards set by Commission rule, which in practice means an intra-group or vendor contract, binding internal rules, or Asia-Pacific Economic Cooperation Cross-Border Privacy Rules certification; or the individual's prior consent supported by the information disclosure required by Article 28(2). The second route carries a continuing duty under Article 28(3) to check the recipient is still complying and to tell the individual about it on request. Where you rely on consent, one-off consent covering an unspecified 'overseas' is not enough — the country has to be named where it can be identified. Data that arrived in Japan from Europe or the United Kingdom under their adequacy decisions carries an extra layer: the Commission's Supplementary Rules restrict onward transfer more tightly than the Act itself.

Enforcement is rated active rather than aggressive because the volume is low relative to the caseload and the tools are soft. Figures for the first half of the 2025 financial year (April to September 2025): 8,928 breach reports from private-sector operators, 11 demands for a report, 2 on-site inspections, 236 pieces of guidance and advice, 2 recommendations, 1 order. The recommendations went to Business Planning Ltd and Chuo Business Service Ltd; the emergency order went to Business Planning Ltd, requiring it to stop providing personal information in breach of the prohibition on improper use. Sector regulators run in parallel and are all fully operational: the Financial Services Agency, the Ministry of Internal Affairs and Communications for telecoms, the Digital Agency for government systems, the Cabinet Office for economic security screening, and the Ministry of Health, Labour and Welfare for medical information.

Floors: corporate tax books and transaction documents, seven years from the day after the filing deadline, extended to ten years for a business year in which a blue-return loss arises that is carried forward. Company accounting books and supporting materials, ten years under the Companies Act. Medical records, five years under the Medical Practitioners Act. Telecoms operators have no general statutory log-retention period. Ceiling: Article 22 of the privacy Act is drafted as an endeavour obligation — the operator 'shall endeavour to erase' personal data without delay once it is no longer needed. There is no equivalent of Europe's storage-limitation principle enforced with fines, and no maximum period fixed by statute. The practical consequence is the opposite of most jurisdictions: in Japan the risk sits in keeping too little, not too much.

The privacy duty bites only for four categories of breach: sensitive personal information; data whose misuse could cause financial loss, such as card numbers or payment credentials; anything caused deliberately, including hacking and rogue employees; and any breach affecting more than 1,000 people. Below those thresholds reporting is voluntary. The first report is due 'promptly', which the Commission reads as three to five days from discovery; the full report is due within 30 days, extended to 60 where the breach may have been done for an improper purpose. Notification to affected individuals is a separate duty and runs in parallel. The Act on the Prevention of Damage from Unauthorised Acts against Important Computers (Act No. 42 of 2025) adds a second regime for designated critical infrastructure: a prompt first alert followed by a detailed report within 30 days. Where the incident touches communications, the Telecommunications Business Act adds a third. The overlap is where operations fail: three regimes, three recipients, three formats, one incident.

Trap 1 in detail. The Commission's FAQ says storing personal data on a server run by a foreign provider is not provision to a third party in a foreign country, provided the contract stops that provider handling the data and access controls back it up. But Articles 23 and 32 then require you to understand the external environment: identify the country where the provider sits and the country where the servers sit, take security measures suited to that country's legal regime, and put the country names and the measures where the individual can find them. If you genuinely cannot pin down the server location, you must publish the reason instead. Trap 2 in detail. Ignoring a Commission order is punishable by up to one year's imprisonment or a fine of up to 1 million yen (about $6,500) for the individual, and up to 100 million yen (about $650,000) for the company. The same 100 million yen corporate ceiling applies to the offence of improperly providing or stealing a personal information database. Failing to answer a demand for a report carries up to 500,000 yen (about $3,300). Trap 3 in detail. Violating the secrecy of communications is punishable by up to two years' imprisonment or a fine of up to 1 million yen (about $6,500); for someone engaged in the telecommunications business it rises to three years or 2 million yen (about $13,000). Attempts are punishable. Trap 4 in detail. The external transmission rules, in force since 16 June 2023, require any covered online service to tell users what information about them is sent to third parties, to whom and why, before it is sent. The communications ministry's own guidance confirms foreign providers serving Japan are covered. Trap 5 in detail. Where the destination country can be identified, naming it is part of the information you must give before consent. Blanket wording about 'servers outside Japan' does not carry the consent.

Dates and switches, checked 18 August 2026. Already enacted, not yet in force: the Act partially amending the Act on the Protection of Personal Information and related acts, promulgated 17 July 2026, commencing on a date to be fixed by cabinet order within two years of promulgation — so at the latest 17 July 2028. Content: a surcharge payable to the state for serious violations of the bans on improper use, improper acquisition and unlawful third-party provision, aimed at cases involving 1,000 or more people and calculated on the financial benefit obtained; involvement of a legal guardian for anyone under 16; a publication duty and an opt-out ban for facial-feature and similar biometric data; an exemption from consent where data is used only to produce statistics, which is designed to unblock artificial-intelligence training; rationalised breach reporting so that low-risk cases need not be notified to individuals; wider emergency order powers; and heavier criminal penalties, with the database-misuse offence rising from one year to two and from 500,000 yen to 1 million yen, plus a new offence of obtaining personal information by deception. Being switched on in stages: the Act on the Prevention of Damage from Unauthorised Acts against Important Computers, Act No. 42 of 2025, Japan's 'active cyber defence' law. Its basic policy was settled in December 2025 and the public-private reporting machinery has been coming into operation through 2026, with the remaining provisions phased to 2027. Dormant switches — powers already held that could change the picture with no consultation: the Commission may add or remove countries from the equivalence list by its own notice, so the European Union and United Kingdom designations are revocable; the Digital Agency rewrites the Government Cloud specification at each procurement round and could widen or close the new overseas artificial-intelligence inference carve-out; the responsible ministers may add categories of critical equipment and further operators to the economic security screening system; and the communications ministry may designate additional telecoms providers into the specified user information regime.