Skip to main content

Japan Privacy Law (APPI)

Jump straight to Avatar compliance regarding APPI

Data privacy in Japan is governed by the Act on the Protection of Personal Information (APPI). It applies to all business operators handling the personal information of individuals in Japan, as enforced by the Personal Information Protection Commission (PPC).

2026 amendment

The APPI was amended in 2026 (Act No. 56 of 2026). The PPC is drafting the implementing cabinet order and rules (overview, in Japanese). Among other changes, the amendment removes the need for consent when personal data are used only to create statistical information, including AI development that qualifies as such, and prohibits the improper use and unlawful acquisition of pseudonymously and anonymously processed information that contains contact details such as an address, a phone number, an email address or a cookie ID (PPC, 14 October 2026, in Japanese). This page describes the APPI as currently applied. It will be updated once the amendment applies.

What is Personal Information?​

According to Article 2(1) of the APPI, Personal Information is strictly defined as information relating to a living individual that:

(i) can identify a specific individual by name, date of birth or other description contained in such information (including such information as will allow easy reference to other information and will thereby enable the identification of a specific individual); or (ii) contains an individual identification code.

The APPI does not use a system of "legal bases" (such as legitimate interest or contractual necessity). Instead, lawful processing is governed by Purpose Specification and Restriction on Provision to a Third Party:

  • Specification of Purpose (Article 17): A business operator must specify the utilization purpose as explicitly as possible and must not handle personal information beyond the scope necessary to achieve that purpose (Article 18) without obtaining the principal's consent.
  • Third-Party Provision (Article 27): With limited exceptions, a business operator shall not provide personal data to a third party without obtaining the prior consent of the principal.

Pseudonymization vs. Anonymization​

The APPI explicitly defines two strict statutory categories for transformed data in Article 2:

  • Pseudonymously Processed Information (Article 2(5)): Information relating to an individual that can be produced from processing personal information so that the individual cannot be identified unless collated with other information. Pseudonymized data is restricted to internal use; it cannot be provided to third parties (Article 41), but operators are exempt from certain obligations like responding to access requests.
  • Anonymously Processed Information (Article 2(6)): Information relating to an individual that can be produced from processing personal information so that a specific individual cannot be identified and the personal information cannot be restored.

Processing of Special Care-Required Information (Sensitive Data)​

Under Article 2(3) of the APPI, Special care-required personal information comprises data revealing a principal's race, creed, social status, medical history, criminal record, or fact of having suffered damage by a crime.

Under Article 20(2), acquiring this sensitive data explicitly requires the prior consent of the principal, except in very specific circumstances (e.g., protecting human life). Furthermore, the opt-out exception for third-party provision (Article 27(2)) cannot be applied to special care-required information.

To legally qualify as Anonymously Processed Information, the data must be processed according to strict standards prescribed by the PPC rules. Under Article 43, a business operator must ensure the process is irreversible.

The PPC Guidelines specify that producing Anonymously Processed Information requires:

  1. Deleting descriptions that can identify a specific individual.
  2. Deleting all individual identification codes.
  3. Deleting codes linking the information to other datasets.
  4. Deleting idiosyncratic (peculiar) descriptions.
  5. Taking appropriate measures to prevent the restoration of the original personal information.

Furthermore, under Article 43(3), when an operator produces such data, they must publicly announce the categories of information it contains. Under Article 43(5), the operator is strictly prohibited from collating the anonymized data with other information to identify the original individual.

If these strict statutory conditions are met, the Anonymously Processed Information can be freely provided to third parties without the individual's consent.

The synthetic data generated using the Avatar method fulfills and exceeds the requirements for Anonymously Processed Information under the APPI, rendering it safe for secondary use and third-party provision without individual consent. Here's why:

  • Article 2(6) and Article 43 of the APPI allow the sharing and secondary use of data if it is irreversibly transformed so that the original personal information cannot be restored.
  • The anonymization method developed by Octopize systematically deletes all direct and idiosyncratic identifiers. It replaces original records with fully synthetic, statistically representative avatars, making the restoration of the original personal information mathematically and technically impossible.
  • Because the process is entirely irreversible and prevents re-identification, Avatarized datasets do not trigger the consent requirements for third-party provision under Article 27.

The anonymity of the data is systematically evaluated and documented through a rigorous process involving:

  • A technical report measuring the residual re-identification risk against universal and APPI standards (Singling out, Linkability, and Inference) using metrics that simulate state-of-the-art attack scenarios, proving that restoration is impossible.
  • A Privacy Impact Assessment evaluating the likelihood and severity of these attacks, ensuring compliance with the strict non-re-identification rules enforced by the PPC.

Official References: