Amendments to Japan’s Act on the Protection of Personal Information (APPI) take effect today.
Key points
- Mandatory breach reporting to the Personal Information Protection Commission.
- A preliminary report promptly, then a final report within 30 days, or 60 days for malicious attacks.
- Enhanced transparency for cross-border transfers.
- Higher penalties for corporate offences.
UK organisations with Japanese customers need incident response processes for APPI reporting. Japan’s mutual adequacy with the UK continues to support transfers. The amendments also tighten rules on pseudonymised information and third-party provision of data, so UK organisations sharing data with Japanese partners should review contracts and transparency information.
Source: Act on the Protection of Personal Information (Personal Information Protection Commission, Japan)
Need help understanding what this change means for your organisation? Get in touch for a pragmatic, no-obligation conversation.
