Japan’s APPI Surcharge Rules: Proceeds and Voluntary Reporting

On October 14, 2026, Japan’s Personal Information Protection Commission (PPC) released a new set of discussion materials on implementing rules following amendments to the country’s privacy law. The materials address administrative surcharge calculations, voluntary reporting, and verification requirements for personal data transactions.

The 50% reduction available for qualifying voluntary reports has attracted particular attention. Equally significant is that the new system calculates surcharges by reference to proceeds from specified unlawful conduct and offers a 50% reduction for qualifying voluntary reports, encouraging businesses to disclose violations early.

This update concerns implementing rules following the legislative amendments. The legislation amending the Act on the Protection of Personal Information (APPI) was passed on July 10, 2026, and promulgated on July 17. Its principal provisions will take effect on a date specified by Cabinet Order within two years of promulgation. The amending legislation has already established the 50% reduction mechanism. The current discussions focus on implementation, including calculations, reporting, and supporting evidence.

1. Scope of the surcharge system and calculation of proceeds

The PPC identifies a gap in the existing enforcement framework: businesses that stop unlawful conduct after receiving a recommendation or order may still retain the economic benefits they previously obtained. Criminal penalties for conduct such as unlawfully providing personal information databases may also provide insufficient deterrence.

The new administrative surcharge, known in Japanese as “課徴金,” is intended to reduce that economic incentive. Its main targets include improper use, improper acquisition, breaches of restrictions on third-party provision, and breaches of relevant obligations under the exceptions for producing statistics and similar activities. The system also includes limiting conditions relating to due care, infringement of individual rights and interests or a concrete risk of infringement, and the scale of the case. The PPC’s explanation uses 1,000 affected individuals as the benchmark for large-scale cases and discusses exclusions where the degree of harm to rights and interests is not substantial.

Surcharges are calculated by reference to financial benefits arising from conduct covered by the statutory provisions. The materials propose including both consideration received or receivable for engaging in that conduct and consideration received or receivable as a condition for stopping it.

A hypothetical example provided by the PPC illustrates the approach: a business sells a dataset containing personal data, including the names of 50,000 individuals, for ¥10 million without obtaining their consent. The surcharge in the example is ¥10 million. The materials also include an example involving a database access licensing fee, showing that income from granting access to a database may enter the calculation as well.

The calculation also addresses receivables that have not yet been paid. For example, where the parties have agreed on a price but the buyer has not paid, the materials propose including the amount receivable in the surcharge. Arranging payment in installments or delaying settlement would therefore not automatically reduce the calculation base.

Where accounting records are incomplete or the prices of some transactions cannot be established, the PPC also discusses reasonable estimation methods. For example, where multiple data transactions can collectively be treated as a single covered act, proceeds could be estimated using the consideration per individual in a transaction whose facts are known, together with the number of individuals involved in the other transactions. The aim is to prevent missing records from obstructing recovery of unlawful proceeds or resulting in lower amounts for businesses that do not provide complete information.

2. Conditions and procedures for a voluntary reporting reduction

Article 148-6 of the amended law provides for a 50% reduction, calculated as prescribed by law, where a business reports facts constituting conduct subject to a surcharge to the PPC in accordance with the requirements. The PPC explains that such violations often occur without the affected individuals’ knowledge. The reduction mechanism is intended to promote early detection and encourage businesses to establish internal compliance systems.

The timing of a report directly affects eligibility for a reduction. A reduction is unavailable where a business reports after anticipating, as a result of an investigation into the conduct, that it will receive a surcharge payment order. The assessment turns on the specific relationship between the investigation and the business’s report.

The materials propose written reporting using a standardized form. Proposed reporting items include the type of conduct, the categories of personal information and number of individuals involved, the nature and amount of consideration obtained, and other relevant information, such as the circumstances, causes, and payment status. The report would also be accompanied by materials showing the facts constituting the covered conduct.

The PPC is considering allowing submission in person, by post, by email, or through other online channels, while specifying when a report is deemed submitted under each method. Postal and online submissions may involve a gap between the business sending a report and the regulator receiving it, which can affect whether the report is timely.

For businesses, the ability to organize the facts after identifying a problem will affect whether they can report promptly and completely. Data flows, affected numbers, contracts, prices, and payment records are all directly relevant to the report and the calculation. An internal investigation that establishes only that an anomaly exists, without explaining what happened and identifying the data and proceeds involved, will provide limited support for this reporting process.

3. Identity verification and purpose confirmation in data transactions

The materials also discuss strengthening Japan’s opt-out system for third-party provision. Subject to statutory conditions, notification to the PPC, and safeguards such as stopping provision at an individual’s request, this system allows businesses to provide personal data to third parties without prior consent.

The PPC notes that some list brokers using the system have supplied data to malicious resellers, ultimately feeding illicit lists used by criminal groups. The amended law therefore adds a requirement: subject to statutory exceptions, a provider using this system must verify the recipient’s identity and confirm its purpose of use before providing the data.

On implementation, the materials propose verifying recipients’ identities using identity documents, with examples including My Number cards, driving licenses, and corporate registration certificates. Because equivalent public certificates are unavailable for purposes of use, the materials propose allowing confirmation through recipients’ declarations. Identity verification and purpose confirmation would use different methods to establish who the transaction counterparty is and how the data is intended to be used.

The materials also address verification further upstream. When list brokers acquire personal data for onward provision under the opt-out system, the proposed approach would strengthen verification of the provider’s identity, helping prevent customer lists unlawfully removed by employees from entering circulation. Proposed recordkeeping additions include the person conducting the verification, its time, and the method used, enabling subsequent checks.

Compliance reviews of data transactions would consequently address where the data came from, who receives it, and how recipients intend to use it. Verification records for both acquisition and onward provision need to be traceable to the relevant transactions.

4. Next steps for the implementing rules

The materials connect the basis for surcharge calculations, voluntary reporting procedures, and verification along the transaction chain. Unlawful proceeds establish the basis of the monetary burden, voluntary disclosure affects reductions, and transaction records help establish the conduct and resulting proceeds.

As of October 16, 2026, the specific submission formats, estimation methods, and verification procedures discussed here remain under development as part of the implementing rules. Businesses involved in transactions concerning personal data in Japan can use these materials to assess whether their existing records explain the counterparties, data, purposes, and consideration involved. They will then need to consult the formally published Cabinet Orders, PPC rules, and guidelines to establish the specific implementation requirements.

References

PPC, Basic Approach to Developing Cabinet Orders and Rules (3), October 14, 2026, especially PDF pages 6–8, 21–27, and 49–54: https://www.ppc.go.jp/files/pdf/261014_kihonntekinakanngaekatanitsuite_3.pdf; text of the 2026 amending legislation: https://www.ppc.go.jp/files/pdf/260717_houritsu.pdf; PPC explanation of the amendments: https://www.ppc.go.jp/files/pdf/260717_kaiseihounitsuite.pdf; legislative and implementing-rule updates: https://www.ppc.go.jp/personalinfo/legal/r8kaiseihogohou/.