Personal Data Breach Reporting in Japan: Deadlines and User Notices

When personal data is leaked, lost or damaged (collectively, a “breach”, 漏えい等) and the case falls into certain categories that pose a high risk of harm to individuals’ rights and interests, the business must report to the Personal Information Protection Commission (個人情報保護委員会, PPC) and notify the individuals concerned (Act on the Protection of Personal Information, or APPI, Article 26). Reporting takes place in two stages: a “preliminary report” (速報) generally within 3 to 5 days of becoming aware, and a “final report” (確報) in principle within 30 days (60 days for cases involving unlawful intent). The duty became mandatory in April 2022, and its scope was partly extended in April 2024.

The four reportable breach situations

The reporting duty applies to the following situations set out in Article 7 of the APPI Enforcement Rules. It covers not only actual breaches but also cases where a breach may have occurred.

Under the amendments to the Enforcement Rules that took effect on 1 April 2024, situation (3) now also covers personal information the business is in the process of acquiring (and intends to handle as personal data). The amendment targets “web skimming”, in which a tampered website sends information entered in input forms to a third party.

The 1,000-person threshold in (4) is assessed by the number of individuals whose personal data was affected in a single incident. Even if the number is not confirmed when the incident occurs, it is reportable if it may exceed 1,000. Even where a breach is not reportable, you still need to investigate the cause, explain the matter to those affected and consider measures to prevent a recurrence.

On the other hand, if the data was protected by advanced encryption or similar measures and the information needed to decrypt it was not leaked, the case is treated as outside the reporting duty.

Deadlines and content of preliminary and final reports

The main items to report are an overview, the categories of personal data affected, the number of individuals, the cause, whether there is or may be secondary damage and its nature, the status of measures taken for the individuals, the status of public announcements, measures to prevent a recurrence, and any other relevant matters. Items still unknown at the time of the final report are added once they become known.

The deadlines include weekends and public holidays. Reports are in principle submitted through the reporting form on the PPC website. In some industries, the minister with jurisdiction over the business, to whom authority has been delegated, receives the report instead.

Rules for notifying individuals

When a reportable situation occurs, the individuals concerned must also be notified (APPI, Article 26(2)). Notification should be made promptly in light of the circumstances.

• What to include: an overview, the categories of data affected, the cause, whether there is or may be secondary damage and its nature, and any other relevant matters
• How to notify: choose a method that will reliably reach the individual, such as post or email
• If notification is difficult: where contact details are unknown, for example, take alternative measures such as publicly announcing the incident or setting up an enquiry desk

In a card number leak, early contact is important so that individuals can take steps such as cancelling their cards. The notice should set out the facts and the response concisely and clearly state where to direct enquiries. If many customers or employees are foreign nationals, consider providing information in several languages. Publishing details while an unauthorized access investigation is ongoing may give information to the attacker, so decide the content and timing of any announcement in consultation with specialists.

When contractors or overseas group companies are involved

When a breach occurs at an outsourcing contractor

Where handling of personal data is outsourced, both the outsourcer and the contractor in principle have a reporting duty. If the contractor promptly notifies the outsourcer of the situation, the contractor is exempt from the reporting duty and the outsourcer makes the report and notifies individuals. The outsourcing contract should cover the following.

• The deadline and contact point for notifying the outsourcer when a breach is identified
• Cooperation with investigations into the cause, and provision of logs and other records
• Whether subcontracting is permitted, and how incidents at subcontractors are handled
• Allocation of costs and the scope of liability for damages

Points to check across the whole contract are explained in Key points for contracts under Japanese law.

When an overseas parent or group company is involved

• If the personal data is handled by the Japanese company, the Japanese company has the reporting duty even if the system is operated by its overseas parent.
• Foreign businesses are also subject to the APPI when they handle personal information in connection with supplying goods or services to people in Japan.
• If data is transferred to operations in mainland China or Hong Kong, also check the transfer rules (Cross-border transfer rules under the APPI).
• Laws in the home country may also require a report to the authorities, so track both sets of deadlines.

Breaches of specific personal information (特定個人情報), which includes My Number, are subject to separate reporting rules under the My Number Act (番号法). Companies that handle My Number for payroll and social insurance procedures should check both sets of rules.

How to respond when a breach occurs

1. Internal escalation and containment: report to the person in charge and take steps such as cutting off unauthorized access or asking recipients to delete misdirected emails.
2. Investigating the facts: confirm the data involved, the number of people, the cause and the period. Use a specialist forensic firm where necessary.
3. Deciding whether it is reportable, and the preliminary report: determine whether any of the four situations applies and, if so, submit a preliminary report.
4. Notifying individuals and public announcement: set up an enquiry desk, then notify.
5. Final report and preventive measures: decide on measures to prevent a recurrence based on analysis of the cause, and submit the final report.

If a business fails to report or take the necessary measures, the PPC may issue a recommendation or order, and violating an order is subject to penalties.

What to prepare in advance

How well you respond to a breach depends heavily on preparation in normal times. The APPI requires businesses to take security control measures (Article 23) and to supervise employees and contractors (Articles 24 and 25). Prepare the following.

• Response procedures: set criteria for deciding whether a case is reportable, and designate who handles the preliminary and final reports and who approves them.
• Contact arrangements: keep a list of contacts within the company and at contractors, the overseas parent, attorneys and forensic firms.
• Record retention: keep access logs and operation records so that the cause and scope can be investigated.
• Data mapping: document which systems hold whose data and which data items.
• Training and drills: regularly brief employees on how to handle misdirected emails and targeted phishing emails.

Without a clear picture of your data, you cannot identify the number of people or data items affected, which can delay the final report.

2026 legislative developments

An act amending the APPI was passed and promulgated in July 2026. Except for certain provisions, it takes effect on a date to be set by Cabinet Order within two years of promulgation. Cabinet Orders and Commission rules are expected to be put in place before it takes effect, and whether the scope or deadlines for breach reporting change will depend on their content.

This article explains the current rules in force as of October 2026. Review your internal response procedures once the PPC publishes the amended rules and guidelines. Until then, operate according to the current four situations, the preliminary and final report deadlines, and the rules on notifying individuals.

Summary

Breach reporting rests on three basics: deciding whether one of the four situations applies, meeting the preliminary and final report deadlines, and notifying individuals. Because the deadlines are short, working out procedures only after an incident is too late. Decide in advance who will report, the criteria for decisions and how to communicate with contractors. Working with partner attorneys (弁護士), TIMOA helps put breach response procedures in place and review internal rules and outsourcing contracts. For details, see our IP, Risk & Compliance services.