Japan APPI Breach Reporting Requirements: Triggers, Deadlines and Response Steps
Jump to Section
Japan’s Act on the Protection of Personal Information requires organizations to report certain actual or suspected leakages, losses, or damage involving personal data. A report may be required when an incident involves special care-required personal information, creates a risk of financial harm, may involve a wrongful act, or affects more than 1,000 individuals.
Once an organization discovers a potentially reportable incident, the timeline moves quickly. The Personal Information Protection Commission instructs organizations to submit a preliminary report promptly, generally within three to five calendar days. A final report is generally due within 30 days, or within 60 days when the incident may have resulted from a wrongful purpose. Qualifying incidents also require prompt notice to affected individuals.
For multinational privacy and security teams, the challenge is making a defensible decision before every fact is known. Organizations need a repeatable process that captures incident facts, applies Japan-specific requirements, keeps deadlines visible, and preserves the reasoning behind each decision as the investigation develops.
What are Japan’s APPI breach reporting requirements?
Since April 1, 2022, organizations must report qualifying personal-data incidents to the PPC and notify affected individuals. Previously, these actions were generally framed as steps organizations should take.
The rules can apply to organizations outside Japan. The APPI may cover an overseas business that handles information about people in Japan in connection with providing goods or services to them. PPC guidance confirms that this can include information obtained from another organization rather than directly from the individual.
For incident-response teams, this means evaluating APPI applicability early. The assessment should identify whose information is involved, how it was obtained, which entity handled it, and how the processing relates to goods or services offered to people in Japan.
Which incidents must be reported under the APPI?
An organization subject to the APPI must report a leakage, loss, or damage involving personal data when the incident has occurred, or is suspected to have occurred, and at least one of four conditions applies.
| Reporting trigger | What it covers |
| Special care-required personal information | Personal data that includes medical history, health examination results, disabilities, criminal history, or other categories designated by law. |
| Risk of financial harm | Personal data that could cause property or financial damage if misused, such as credit card information or login credentials for a payment-enabled service. |
| Potential wrongful purpose | An incident that may involve malicious intent, including unauthorized access, ransomware, theft, or an employee’s improper removal of data. |
| Scale | Leakage, loss, or damage involving personal data relating to more than 1,000 individuals. |
These categories are not limited to confirmed data exfiltration. A suspected leakage, loss, or damage may also trigger reporting.
Privacy and security teams should therefore evaluate ransomware events, uncertain access, misplaced devices, unintended disclosures, and other possible exposures using the facts available. Update the assessment as the investigation develops.
The PPC provides additional examples and guidance on its breach-response resource page.
What are the APPI breach-reporting deadlines?
The APPI uses a two-stage regulatory reporting process.
Preliminary report
The organization must submit the preliminary report promptly after it discovers the incident. PPC guidance generally defines prompt reporting as within 3 to 5 calendar days.
The organization should report the facts known at that point. It should not delay the preliminary report until the forensic investigation is complete.
Final report
The final report is generally due within 30 calendar days after the organization discovers the incident.
That period extends to 60 calendar days when the incident may have resulted from an act committed for a wrongful purpose, such as unauthorized access or another malicious act.
Notice to affected individuals
When an incident falls within the mandatory reporting categories, the organization must also promptly notify affected individuals, depending on the circumstances.
If direct notification is difficult, the organization may take an alternative measure necessary to protect the individuals’ rights and interests. Depending on the circumstances, this could include publishing information about the incident or establishing an inquiry channel through which people can determine whether their data was involved.
The response team should document:
- The date the incident was discovered
- The reporting category or categories considered
- The preliminary and final reporting deadlines
- The individual-notification decision
- The content and method of notification
- Any reason an alternative measure was used
The PPC offers additional information about regulatory reporting and individual notification.
Does the APPI apply to overseas organizations?
The APPI applies when an overseas organization handles information about people in Japan in connection with supplying them goods or services.
This application is not necessarily limited to information collected directly from individuals. For example, an overseas service provider may fall within the APPI’s scope when it receives personal data about users in Japan from another organization and handles that data in connection with services offered to those users.
Global response teams should establish:
- Whether the incident involves people located in Japan
- Which legal entity handled their personal information
- How the information relates to goods or services offered in Japan
- Where the information was stored or accessed
- Whether a processor, service provider, or other organization was involved
- Whether other laws or contractual requirements apply alongside the APPI
The PPC addresses these circumstances in its guidance on the APPI’s extraterritorial application.
How to build a defensible APPI incident-response process
A defensible APPI response connects cybersecurity investigation, privacy analysis, legal review, and communications through one documented workflow.
NIST Special Publication 800-61 Rev. 3 similarly recommends integrating incident response throughout cybersecurity risk management to improve preparation, detection, response, and recovery. That operational discipline supports the timely fact development and documentation an APPI assessment requires.
A practical response process should:
- Standardize incident intake. Capture the affected systems, data elements, individuals, jurisdictions, safeguards, and suspected cause from the start.
- Record the discovery date. Establish when the organization first discovered the incident and immediately calculate potential reporting deadlines.
- Apply APPI-specific requirements. Evaluate the facts against each of the four mandatory reporting categories.
- Document uncertainty. Record unknown facts, working assumptions, approvals, and changes to the assessment.
- Coordinate communications. Keep regulator reports and individual notices consistent as the investigation develops.
- Preserve human review. Ensure privacy, security, legal, and communications stakeholders can review the decision and its supporting evidence.
A complete record helps demonstrate what the organization knew, when it knew it, how it evaluated the available facts, and why it reached its notification decision.
See NIST SP 800-61 Rev. 3 for broader incident-response recommendations.
How RadarFirst supports APPI incident assessment
RadarFirst helps privacy teams turn incident facts into a consistent, reviewable response process. Teams can standardize intake, evaluate an incident against jurisdiction-specific requirements, manage deadlines, and retain the evidence and rationale supporting each decision.
For an incident involving people in Japan, this structure supports the APPI’s two-stage reporting process. Teams can prepare an initial assessment using the facts available, continue the investigation, and update the decision record as the scope, data types, and cause become clearer.
Regulatory intelligence and workflow automation reduce repetitive research and coordination. Human oversight remains central, helping teams reach decisions that are explainable, consistent, and ready for legal review.
Learn more about RadarFirst intelligent incident response.
What does the 2026 APPI amendment change?
Japan enacted another APPI amendment on July 10, 2026, and promulgated it on July 17, 2026.
Most provisions will take effect on a date the Cabinet sets within two years of promulgation. The PPC is continuing to develop the associated orders, rules, and guidance.
Organizations should monitor that implementation work and update their incident workflows when effective dates and final requirements are confirmed. Until applicable provisions take effect, teams should continue following the current breach-reporting triggers and timelines described above.
The PPC maintains current information on its 2026 APPI amendment page.
Turn APPI requirements into consistent action
APPI assessments often begin before an organization knows the full scope or cause of an incident. RadarFirst helps privacy teams organize the available facts, apply jurisdiction-specific requirements, track reporting deadlines, and preserve the rationale behind each decision.
See how RadarFirst can help your team respond to APPI incidents faster, more consistently, and with greater defensibility.
This article provides general information and does not constitute legal advice. Organizations should consult qualified counsel regarding specific incidents and current APPI requirements. The PPC notes that English translations are provided as reference materials and that the original Japanese laws and regulations have legal effect.
Frequently asked questions about APPI breach reporting
How quickly must an APPI breach be reported?
The PPC instructs organizations to submit a preliminary report promptly, generally within three to five calendar days after discovering an incident. The final report is generally due within 30 days, or 60 days when the incident may have resulted from a wrongful purpose.
Does a suspected data breach have to be reported?
It may. The mandatory categories cover qualifying leakage, loss, or damage that has occurred or is suspected to have occurred. Organizations should evaluate the available evidence and update the assessment as the investigation progresses.
Is an initial report required before the investigation is complete?
Yes. An organization should submit the facts available during the preliminary reporting stage rather than waiting for a complete forensic investigation. The final report can reflect additional findings.
When does the 60-day deadline apply?
The 60-day final reporting period applies when the incident may have resulted from an act committed for a wrongful purpose, such as unauthorized access or another malicious act.
Must affected individuals always receive direct notice?
Qualifying incidents generally require prompt individual notification. When direct notice is difficult, an organization may use an alternative measure necessary to protect the individuals’ rights and interests.
Is public disclosure always required?
No. Public disclosure is not automatically required, although it may be used as an alternative when direct individual notification is difficult or may otherwise be appropriate based on the incident.
Related Posts
Insights on Privacy, AI Risk, and Compliance
Let’s Get Started
Trusted by leading organizations, RadarFirst enables teams to manage incidents with speed, consistency, and defensibility by standardizing how incidents are captured, assessed, and actioned.
