Is consent required to provide personal info to third parties?

Article 23
APPI consent rule
Opt-in
Consent standard
3 years
Record retention
JPY 1M
Max fine
The Short Answer

Yes, consent is generally required to provide personal information to third parties in Japan, unless an exception under the Act on the Protection of Personal Information applies.

What the Law Says

The Act on the Protection of Personal Information (APPI) governs how businesses and organizations in Japan handle personal data, including disclosures to third parties.

Under the APPI, a business operator must obtain the prior consent of the individual before providing their personal information to a third party, unless one of the statutory exceptions applies.

Consent must be obtained in a clear, understandable manner — typically through written or electronic opt-in. Implied or pre-ticked consent is not sufficient.

Exceptions include disclosures required by law, necessary to protect life or property in emergencies, or for joint use among affiliated entities that have publicly declared the purpose and scope.

Statutory Text

A business operator shall not provide a third party with personal data without obtaining the prior consent of the individual concerned.

— Act on the Protection of Personal Information, s. 23 — Provision to Third Parties
Statutory Text

The consent referred to in the preceding paragraph must be obtained in a manner that enables the individual to clearly understand the purpose of use and the identity of the third party.

— Act on the Protection of Personal Information, s. 23, Paragraph 2

What to Do

1

Confirm whether the disclosure falls under an exception in APPI Article 23(2) or (3).

2

If no exception applies, obtain explicit, documented consent from the individual before sharing.

3

Clearly disclose the purpose of use, the type of data shared, and the identity of the third party.

4

Keep records of consent for at least three years.

5

Review contracts with third parties to ensure compliance with APPI’s handling requirements.

Sources

statuteAct on the Protection of Personal Information, s. 23 — Provision to Third Parties

Same Question, Other Jurisdictions

CanadaAustraliaIrelandSingaporeEuropean UnionIndiaSouth KoreaUKCompare all →

Not legal advice. This article is general information based on publicly available sources, written for educational purposes. Laws change and individual situations vary. Consult a licensed attorney in your jurisdiction before acting on anything you read here. Last reviewed: 2026-06-08.