Jurisdiction Guide
Japan Privacy & Data Protection Laws
Every regime below can apply to a business handling Japan residents' data, depending on whether you have an established presence there, actively offer goods or services to residents, or monitor their behavior. This is a general reference, not a determination for your specific business — run the full questionnaire to see which of these actually apply to you.
Comprehensive Privacy Law · 1
APPI applies extraterritorially wherever a personal-information-handling business operator, regardless of location, handles the personal information of a person in Japan 'in relation to' supplying goods or services to that person (Art. 171) — confirmed against the PPC's official English translation. Unlike GDPR, there is no separate statutory 'monitoring behavior' limb. Art. 57 exempts operators from Chapter IV obligations for press reporting, professional writing, academic research, or religious/political activity; no small-business exemption, and government bodies are regulated under a different chapter of the same integrated Act rather than being unregulated.