Act on the Protection of Personal Information

APPI applies extraterritorially wherever a personal-information-handling business operator, regardless of location, handles the personal information of a person in Japan 'in relation to' supplying goods or services to that person (Art. 171) — confirmed against the PPC's official English translation. Unlike GDPR, there is no separate statutory 'monitoring behavior' limb. Art. 57 exempts operators from Chapter IV obligations for press reporting, professional writing, academic research, or religious/political activity; no small-business exemption, and government bodies are regulated under a different chapter of the same integrated Act rather than being unregulated. Amendment in progress: a substantial APPI amendment bill passed the Diet on July 10, 2026 and was promulgated July 17, 2026. It adds protections for children's data (parental consent under 16), a new 'specific biometric personal information' category, a statistical-processing exemption, and administrative fines plus broader PPC order-making power. Most of it takes effect on a date to be fixed by cabinet order within two years of promulgation (so by mid-2028), with a subset of penalty provisions commencing January 17, 2027 — the entry below still describes the currently operative law.