JapanWhat reporting duties for data breaches?
In Japan, businesses must report personal data breaches to the Personal Information Protection Commission (PPC) without delay if the breach poses a risk of harm to individuals’ rights or interests. Notification to affected individuals is also required in certain cases.
What the Law Says
Japan’s Act on the Protection of Personal Information (APPI) sets mandatory reporting duties for data breaches involving personal information. The law requires business operators to assess risk and report promptly when harm to individuals’ rights or interests is likely.
Under the APPI, a business operator who suffers a data breach must promptly notify the Personal Information Protection Commission (PPC) if the breach is likely to harm the rights or interests of individuals. This includes incidents involving unauthorized access, loss, or leakage of personal data.
If the breach affects 100 or more individuals and poses a risk of serious harm (e.g., financial loss, identity theft), the business must also publicly disclose details on its website or through other appropriate means.
Notification to affected individuals is mandatory when the breach creates a risk of damage to their rights or interests — for example, if leaked data includes names, addresses, or credit card numbers.
Statutory TextA business operator shall, without delay, notify the Commissioner of the Personal Information Protection Commission of any incident involving personal information that is likely to cause harm to the rights or interests of an individual.
— Act on the Protection of Personal Information, s. 23 — Reporting of incidents concerning personal information
Statutory TextWhere a business operator has caused damage to the rights or interests of an individual by failing to take necessary and proper measures for the safe management of personal information… the business operator shall, without delay, notify the individual concerned.
— Act on the Protection of Personal Information, s. 24 — Notification to individuals
What to Do
Assess whether the breach involves personal information and poses a risk of harm to individuals’ rights or interests.
Notify the PPC without delay — ideally within 72 hours of confirming the breach.
If the breach affects 100+ individuals and risks serious harm, publish a public notice on your website.
Notify affected individuals directly if harm (e.g., fraud, discrimination) is reasonably foreseeable.
Document all actions taken, including timing, scope, cause, and remedial measures.
Sources
Same Question, Other Jurisdictions
Canada
Australia
Ireland
Singapore
European Union
India
South Korea
UK
US-California
US-New YorkNot legal advice. This article is general information based on publicly available sources, written for educational purposes. Laws change and individual situations vary. Consult a licensed attorney in your jurisdiction before acting on anything you read here. Last reviewed: 2026-06-08.