REGULATORY INSIGHT

Breach reporting under Japan's 2026 APPI amendments — wider exceptions to notifying individuals, and keeping the basis for not reporting

22 October 2026

Who has to show what, and from when

Businesses handling personal information in Japan must report certain leaks of personal data to the Personal Information Protection Commission and notify the individuals affected (Act on the Protection of Personal Information, Article 26). An Act revising these rules passed on 10 July 2026 and was promulgated on 17 July 2026 (Act No. 56 of 2026).

Most of the amendments take effect on a date to be set by Cabinet Order within two years of promulgation, and the detailed lines for breach reporting will be drawn in revised Commission rules. The Commission published its “basic approach” to those rules in stages between September and October 2026, with public consultation to follow. In other words, the current rules still apply today, and the amendments are at the stage where the direction is fixed but the lines are not yet drawn.

The current rules, and what the amendments add

• Reportable events (current Rules, Article 7): leaks involving special care-required personal information, those risking financial loss, those that may have been caused for a wrongful purpose, and those affecting more than 1,000 individuals
• Deadlines (current Rules, Article 8): a preliminary report “promptly” (the guidelines suggest roughly three to five days from awareness), and a confirmed report within 30 days (60 days where a wrongful purpose may be involved)
• Wider exceptions to notifying individuals (amended Article 26(2), proviso): in addition to cases where notice is difficult, cases specified by Commission rules where the lack of notice is unlikely to harm the individual’s rights and interests. Either way, alternative measures are required
• Lighter reporting (Article 26(1), details delegated to the rules): exemption from part of the preliminary reporting where a third party has checked the business’s arrangements, and periodic consolidated confirmed reports for single-person cases such as misdirected mail
• A new reportable event: unlawful provision of personal data to third parties is to be added

The same Act introduces administrative surcharges for large-scale cases of improper use, improper acquisition and unlawful third-party provision, rules on the personal information of children under 16, and rules on facial feature data. Supplementary resolutions in both Houses asked that the scope and criteria of the new exception to notifying individuals be spelled out in the rules.

Where it gets difficult in practice

1. The wider the exceptions, the more often the decision will be “no report” or “no notice”. If you are later asked by the Commission or by an individual, you cannot explain your reliance on an exception without a record of the facts known at the time and why the requirement was judged not to apply
2. The preliminary report runs from awareness. Unless it is recorded when, and to whom, the first word arrived from a contractor or from the front line, you cannot show that the deadline was met
3. Consolidated confirmed reports only work if each small incident, such as a single misdirected letter, is recorded at the same granularity when it happens. Where departments track them in separate emails and spreadsheets, items drop out when the period is totalled
4. The test switches from the current rules to the revised rules on the date of effect. Unless each decision records which rules it was made under, the cases near the boundary cannot be explained

Carry it by hand, or build it in

There are two ways to meet a requirement like this. One is to carry it by hand: write the procedures and have people check and record. The other is to build in a mechanism that leaves the record you will be asked for as a matter of course.

The first is quicker to start, but it breaks down as the procedures and the people involved multiply. Exceptions accumulate, the granularity of the record drifts, and you lose the ability to establish the scope afterwards. The second puts the design effort up front, but keeps you able to check after the event.

We research and develop technology that carries conformity with regulation as a mechanism rather than as manual routine, and we hold the results as patent applications. See Domains for more.

We follow these rules as they come into force. Updates are available by RSS.

← Back to Insights