JapanIs security camera footage personal information?
Yes, security camera footage that captures identifiable individuals is considered personal information under Japan’s Act on the Protection of Personal Information (APPI).
What the Law Says
Japan’s Act on the Protection of Personal Information (APPI) defines and regulates how personal information—including images from security cameras—must be handled by businesses and organizations.
Under the APPI, 'personal information' means information about a living individual that can identify a specific person—either directly (e.g., name, face) or indirectly (e.g., through combination with other data).
Security camera footage qualifies as personal information if it enables identification of an individual, even without names or IDs—such as clear facial images, distinctive clothing, or gait combined with time/place context.
The law requires organizations to specify the purpose of collecting such footage, obtain consent unless an exception applies (e.g., legitimate security interest), limit retention to what is necessary (generally no longer than 1 year), and implement appropriate security measures.
Failure to comply may result in orders from the Personal Information Protection Commission (PPC), fines up to 5,000 yen for minor violations, or criminal penalties for serious breaches.
Statutory Text‘Personal information’ means information about a living individual that can identify a specific individual by name, date of birth, or other description contained in such information, including information that can be easily cross-referenced with other information to identify a specific individual.
— Act on the Protection of Personal Information, Art. 2(1) — Definition of Personal Information
Statutory TextA business handling personal information shall not use such information beyond the scope reasonably necessary to achieve the purpose of use previously notified to the individual or publicly announced.
— Act on the Protection of Personal Information, Art. 16(1) — Purpose Limitation
Statutory TextA business handling personal information shall take necessary and proper measures to prevent leakage, loss, or damage to personal information it handles.
— Act on the Protection of Personal Information, Art. 20(1) — Security Measures
What to Do
Confirm whether your camera footage captures identifiable individuals (e.g., clear faces, license plates, or unique identifiers).
Notify individuals (e.g., via signs) about the purpose, duration, and scope of surveillance before recording.
Limit retention to no more than 1 year unless legally required otherwise.
Implement technical and organizational safeguards (e.g., access controls, encryption, staff training).
Appoint a responsible person to manage compliance and respond to inquiries or requests from individuals.
Sources
Same Question, Other Jurisdictions
Germany
Ireland
Singapore
US-New York
South KoreaNot legal advice. This article is general information based on publicly available sources, written for educational purposes. Laws change and individual situations vary. Consult a licensed attorney in your jurisdiction before acting on anything you read here. Last reviewed: 2026-06-08.