Japan

The law applies even if you have no office in Japan. That is Article 171 of the Act on the Protection of Personal Information. The 2020 amendment took effect on 1 April 2022. Since then the Personal Information Protection Commission can use its full set of powers against foreign companies. That includes demands for reports, on-site inspection, guidance, recommendations and orders. The Commission's own frequently asked questions confirm two things. The law applies if you collect from people in Japan directly. It also applies if you receive the data from another Japanese business. The Ministry of Internal Affairs and Communications takes a separate view on the Telecommunications Business Act. It says that Act applies to services provided from abroad to people in Japan, where the service is clearly aimed at Japan. Signs of that are a Japanese-language interface, prices in yen, and marketing aimed at Japan. Those providers must register or file a notification, and name a representative or agent in Japan.

Sector by sector, checked 18 August 2026: - Government and public sector — data must stay in the country The Digital Agency's Government Cloud purchase specification says information assets are to be kept inside Japan. It requires data centres in Japan, spread across several Japanese regions. Cloud providers must first be listed under the Information system Security Management and Assessment Program (ISMAP). The 2026 round has one exception: a separately walled 'overseas AI inference environment' for frontier models that are not available in Japan. - Telecoms — data can leave only if conditions are met There is no rule about where data is stored. But keeping communications secret is a criminal duty. Designated large providers must file an internal handling code for 'specified user information' with the ministry. And the external transmission rules make you disclose what user information you send to third parties. - Critical infrastructure — data can leave only if conditions are met This covers 16 named sectors, including finance, medical care, telecoms, energy, transport and credit cards. Before installing critical equipment you must notify the responsible minister. The minister reviews who owns the supplier, its ties to foreign governments, and whether foreign law could force the supplier to break its contract. The minister can order changes. - Banking, payments, insurance, securities — data can leave freely The Financial Services Agency regulates by risk, not by geography. Its October 2024 cybersecurity guidelines expressly cover outsourced work done overseas, but set no storage location. Supervisory guidance requires the bank to be able to monitor and trace customer data at an outsourcer, and to write audit rights into the contract. - Health — data can leave only if conditions are met, medium confidence. Three ministries publish guidelines. The health ministry guideline is version 7.0, of June 2026. The economy and communications ministries' supplier guideline is version 2.0, revised March 2025. These are guidance, not law. We found no clause in the versions we could open requiring storage in Japan. But hospitals must stay accountable and must understand the law where the data sits. - Mapping and geospatial — we found no export restriction, checked 18 August 2026, medium confidence. The Geospatial Information Authority's published approval procedures cover copying and using survey results. They say nothing about taking them out of Japan. - Defence — we found no rule about location, checked 18 August 2026. The defence purchasing information security standard controls encryption, access and designated handling facilities, not the country of storage.

Article 28 of the Act sets three routes. One. The country has been named by Commission rule as giving equivalent protection. Only the European Economic Area and the United Kingdom are named, by Commission Notice No. 1 of 2019. Two. The recipient has a system that meets the standards set by Commission rule. That usually means a contract inside your group or with a supplier, binding internal rules, or Asia-Pacific Economic Cooperation Cross-Border Privacy Rules certification. This route brings a continuing duty under Article 28(3). You must keep checking that the recipient still complies, and tell the person about it if they ask. Three. The person consents in advance, after you give them the information required by Article 28(2). One-off consent covering an unnamed 'overseas' is not enough. You have to name the country where it can be identified. Data that arrived in Japan from Europe or the United Kingdom, under their official decisions that Japan is safe enough, carries an extra layer. The Commission's Supplementary Rules limit passing it on more tightly than the Act itself.

We rate enforcement active rather than aggressive. The number of actions is low next to the caseload, and the tools are soft. Here are the figures for the first half of the 2025 financial year, April to September 2025. There were 8,928 breach reports from private-sector businesses. There were 11 demands for a report and 2 on-site inspections. There were 236 pieces of guidance and advice, 2 recommendations and 1 order. The recommendations went to Business Planning Ltd and Chuo Business Service Ltd. The emergency order went to Business Planning Ltd, requiring it to stop providing personal information in breach of the ban on improper use. Sector regulators run alongside, and all of them are working. They are the Financial Services Agency, and the Ministry of Internal Affairs and Communications for telecoms. Also the Digital Agency for government systems, and the Cabinet Office for economic security screening. And the Ministry of Health, Labour and Welfare for medical information.

How long you must keep data. Corporate tax books and transaction documents: seven years from the day after the filing deadline. That extends to ten years for a business year in which a blue-return loss arises and is carried forward. Company accounting books and supporting materials: ten years under the Companies Act. Medical records: five years under the Medical Practitioners Act. Telecoms operators have no general log-keeping period set by law. How long you may keep data. Article 22 of the privacy Act is written as a best-efforts duty. You 'shall endeavour to erase' personal data without delay once you no longer need it. Japan has no equivalent of Europe's storage-limitation rule backed by fines, and no maximum period set by law. The result is the opposite of most countries. In Japan the risk sits in keeping too little, not too much.

The privacy duty applies to only four kinds of breach. Sensitive personal information. Data whose misuse could cause financial loss, such as card numbers or payment credentials. Anything done deliberately, including hacking and rogue employees. And any breach affecting more than 1,000 people. Below those thresholds, reporting is voluntary. The first report is due 'promptly'. The Commission reads that as three to five days from discovery. The full report is due within 30 days. That extends to 60 days where the breach may have been done for an improper purpose. Telling the affected people is a separate duty and runs at the same time. The Act on the Prevention of Damage from Unauthorised Acts against Important Computers (Act No. 42 of 2025) adds a second set of rules for designated critical infrastructure. You give a prompt first alert, then a detailed report within 30 days. Where the incident touches communications, the Telecommunications Business Act adds a third. The overlap is where operations fail: three sets of rules, three recipients, three formats, one incident.

Trap 1 in detail. The Commission's frequently asked questions cover this. Storing personal data on a server run by a foreign provider is not giving it to a third party in a foreign country. That holds as long as your contract stops that provider handling the data, and access controls back it up. But Articles 23 and 32 then require you to understand the outside environment. You must identify the country where the provider sits, and the country where the servers sit. You must take security measures suited to that country's law. And you must put the country names and the measures where the person can find them. If you truly cannot pin down the server location, you must publish the reason instead. Trap 2 in detail. Ignoring a Commission order can bring up to one year's imprisonment. For an individual it can also bring a fine of up to 1 million yen (about 6,500 United States dollars). For a company the fine goes up to 100 million yen (about 650,000 United States dollars). The same 100 million yen company ceiling applies to improperly providing or stealing a personal information database. Failing to answer a demand for a report carries up to 500,000 yen (about 3,300 United States dollars). Trap 3 in detail. Breaking the secrecy of communications can bring up to two years' imprisonment. It can also bring a fine of up to 1 million yen (about 6,500 United States dollars). For someone working in the telecommunications business it rises to three years or 2 million yen (about 13,000 United States dollars). Attempts are punishable too. Trap 4 in detail. The external transmission rules have been in force since 16 June 2023. Any covered online service must tell users what information about them is sent to third parties, to whom and why, before it is sent. The communications ministry's own guidance confirms that foreign providers serving Japan are covered. Trap 5 in detail. Where the destination country can be identified, you must name it before you ask for consent. Blanket wording about 'servers outside Japan' does not carry the consent.

Dates and switches, checked 18 August 2026. Already passed, not yet in force. The Act partially amending the Act on the Protection of Personal Information and related acts was published on 17 July 2026. It starts on a date to be fixed by cabinet order within two years of publication, so at the latest 17 July 2028. Here is what it contains. A surcharge paid to the state for serious breaches of three bans: improper use, improper acquisition, and unlawfully giving data to a third party. That surcharge targets cases involving 1,000 or more people, and is worked out from the money gained. A legal guardian must be involved for anyone under 16. If you handle facial-feature or similar biometric data, you must publish that fact, and you cannot rely on opt-out. You will not need consent where data is used only to produce statistics. That change is meant to unblock artificial intelligence training. Breach reporting gets simpler, so low-risk cases need not be reported to individuals. Emergency order powers get wider. And criminal penalties get heavier. The database-misuse offence rises from one year to two, and from 500,000 yen to 1 million yen. There is also a new offence of obtaining personal information by deception. Being switched on in stages. The Act on the Prevention of Damage from Unauthorised Acts against Important Computers, Act No. 42 of 2025, is Japan's 'active cyber defence' law. Its basic policy was settled in December 2025. The public-private reporting machinery has been coming into operation through 2026, and the rest is phased to 2027. Powers the government already holds, which could change the answer with no consultation. The Commission may add or remove countries from the equivalence list by its own notice. So the European Union and United Kingdom designations can be revoked. The Digital Agency rewrites the Government Cloud specification at each purchasing round, and could widen or close the new overseas artificial intelligence inference exception. The responsible ministers may add categories of critical equipment, and more operators, to the economic security screening system. And the communications ministry may designate more telecoms providers into the specified user information rules.