← Data protection and cybercrime laws by country, compared
Japan: data protection law, cybercrimes, fines and penalties
APPI overseen by the PPC, with mandatory leak notification; a triennial review is under discussion.
- Law
- APPI (Act on the Protection of Personal Information)
- Authority
- PPC (Personal Information Protection Commission)
- Max fine
- Up to ¥100M for companies that breach orders
- Breach notification
- Preliminary "promptly" (about 3–5 days); final within 30 days (60 if wilful)
- DPO
- —
Crimes
| Unauthorized access | Act on the Prohibition of Unauthorized Computer Access | Up to 3 years or ¥1M |
| Creating or providing computer viruses | Art. 168-2 Penal Code | Up to 3 years |
| Computer fraud | Art. 246-2 Penal Code | Up to 10 years |
Risks
- APPI review (possible administrative surcharge fine)
- Leaks with short notification deadlines
Source: PPC · Japanese Law Translation