Act on the Protection of Personal Information

APPI applies extraterritorially wherever a personal-information-handling business operator, regardless of location, handles the personal information of a person in Japan 'in relation to' supplying goods or services to that person (Art. 171) — confirmed against the PPC's official English translation. Unlike GDPR, there is no separate statutory 'monitoring behavior' limb. Art. 57 exempts operators from Chapter IV obligations for press reporting, professional writing, academic research, or religious/political activity; no small-business exemption, and government bodies are regulated under a different chapter of the same integrated Act rather than being unregulated.