JapanPenalties for APPI violations?
Violations of Japan's Act on the Protection of Personal Information (APPI) can result in criminal penalties including imprisonment up to 1 year or fines up to ¥500,000 — or both — for unauthorized disclosure or improper acquisition of personal information.
What the Law Says
The Act on the Protection of Personal Information (APPI) sets out criminal penalties for serious violations involving personal information handling by businesses and individuals.
Under APPI Section 83, a person who discloses personal information database files — obtained through their duties — to a third party without just cause faces imprisonment with work for up to one year or a fine of up to ¥500,000, or both.
Section 84 penalizes anyone who acquires personal information by fraud, coercion, or other unlawful means: punishment is imprisonment with work for up to one year or a fine of up to ¥500,000, or both.
Section 85 imposes penalties for false statements or refusal to cooperate during inspections by the Personal Information Protection Commission (PPC), including imprisonment with work for up to six months or a fine of up to ¥300,000.
These criminal provisions apply only to intentional, wrongful acts — not mere negligence or procedural oversights. The statute of limitations for these offenses is five years (APPI s. 87).
Statutory TextA person who discloses, for unjustifiable reasons, personal information database files which he/she has obtained in the course of performing his/her duties shall be punished by imprisonment with work for a period not exceeding one year or a fine not exceeding five hundred thousand yen, or both.
— Act on the Protection of Personal Information, s. 83 — Penalty for Disclosure of Personal Information Database Files
Statutory TextA person who acquires personal information by fraud, coercion or other unlawful means shall be punished by imprisonment with work for a period not exceeding one year or a fine not exceeding five hundred thousand yen, or both.
— Act on the Protection of Personal Information, s. 84 — Penalty for Acquisition of Personal Information by Unlawful Means
Statutory TextA person who makes false statements or refuses to answer questions in response to an inquiry made pursuant to the provisions of Article 47, paragraph (1) shall be punished by imprisonment with work for a period not exceeding six months or a fine not exceeding three hundred thousand yen, or both.
— Act on the Protection of Personal Information, s. 85 — Penalty for False Statements or Refusal to Answer Questions
Statutory TextThe limitation period for prosecution of the offences prescribed in Articles 83 through 86 shall be five years.
— Act on the Protection of Personal Information, s. 87 — Limitation Period for Prosecution
What to Do
Immediately cease any unauthorized use, disclosure, or acquisition of personal information.
Conduct an internal investigation and document all facts objectively.
Notify the Personal Information Protection Commission (PPC) if a breach meets reporting criteria under APPI s. 24.
Cooperate fully with PPC inspections or inquiries — refusal or false statements are themselves criminal offenses (APPI s. 85).
Consult qualified legal counsel to assess criminal exposure and implement corrective measures.
Sources
Same Question, Other Jurisdictions
Germany
Singapore
European Union
UK
South Korea
IndiaNot legal advice. This article is general information based on publicly available sources, written for educational purposes. Laws change and individual situations vary. Consult a licensed attorney in your jurisdiction before acting on anything you read here. Last reviewed: 2026-06-08.