/cloak

APPI (Japan) Compliance Reference

Purpose: Implementation guidance for Japan's Act on the Protection of Personal Information (個人情報保護法, APPI) — original 2003, major amendments 2017, 2022, and the 2024 amendment cycle. Covers the three-tier data taxonomy (個人情報 / 仮名加工情報 / 匿名加工情報), Article 24 cross-border transfer regime, Article 23 opt-out for third-party provision, PPC notification thresholds, and 要配慮個人情報 (special-care PI) handling.

Scope Boundary

• cloak appi: Japan-specific implementation (PPC reporting, three-tier taxonomy, Article 24 transfer, Article 23 opt-out filing, 要配慮個人情報 explicit consent).
• cloak gdpr (sibling): EU regime — overlaps on consent and DSAR shape, diverges on retention philosophy and lawful basis. APPI uses "purpose of utilization" (利用目的), not GDPR's six bases.
• cloak ccpa (sibling): California — opt-out by default. APPI is a hybrid: opt-in for sensitive, opt-in for third-party transfer (with Art. 23 opt-out exception), purpose-bound use otherwise.
• cloak pseudonymize (sibling): techniques. appi consumes pseudonymization output and applies the 仮名加工情報 / 匿名加工情報 distinction to determine downstream obligations.
• cloak dpia (sibling): APPI does not mandate DPIA but PPC strongly recommends for large-scale or special-care processing.
• canon (elsewhere): standards-level audit. appi produces operational compliance code.
• crypt (elsewhere): encryption design backing the "appropriate safety management" duty (Art. 23 安全管理措置).
• canon (elsewhere): 個人情報保護方針 (Privacy Policy in Japanese), 利用目的の特定 wording, Tokushoho disclosures for EC.
• canon[regulatory] (elsewhere): ISMS / Pマーク (Privacy Mark) certification mapping; APPI is law, Pマーク is voluntary certification.

Workflow

DISCOVER  →  inventory 個人情報 / 個人データ / 保有個人データ
          →  flag 要配慮個人情報 (sensitive); identify cross-border processors

CLASSIFY  →  three-tier taxonomy: 個人情報 vs 仮名加工情報 vs 匿名加工情報
          →  determine 利用目的 (purpose of utilization) for each field set

MAP       →  domestic third-party transfers (Art. 23 opt-out filing path)
          →  cross-border transfers (Art. 24 — equivalent country list / SCC-equivalent / consent)

ASSESS    →  consent surface for 要配慮個人情報, breach-notification thresholds (1k records or sensitive),
          →  PPC reporting timeline (速やか — promptly), 3-year retention limit on access logs

REMEDIATE →  consent UI for 要配慮; opt-out filing form for Art. 23;
          →  cross-border addendum templates; pseudonymization pipeline for 仮名加工情報 reuse;
          →  anonymization pipeline + deletion of intermediate keys for 匿名加工情報

VERIFY    →  PPC report channel tested, 利用目的変更 re-consent flow, retention auto-purge,
          →  third-party recipient registry maintained for 3 years (Art. 26)

Three-Tier Data Taxonomy

Critical distinction: 仮名加工情報 retains the key (held separately, access-controlled); 匿名加工情報 destroys the key irreversibly. Cloak must verify operationally — many implementations claim 匿名 but retain reversible mappings, making them 仮名 in fact.

仮名加工情報 standards (PPC rules): remove direct identifiers, remove descriptions enabling identification, remove individual identification codes (My Number, biometric IDs).

匿名加工情報 standards: same as above plus mandatory technical evaluation that re-identification is infeasible; public disclosure of categories created (Art. 43).

要配慮個人情報 (Special-Care Personal Information)

Acquisition and third-party transfer require explicit prior consent — opt-out under Art. 23 is unavailable.

Cross-Border Transfer (Article 24)

2022 amendment teeth: consent-based path now requires the substance of the foreign regime to be disclosed — generic "we may transfer abroad" no longer suffices. PPC publishes country fact-sheets businesses can reference.

Article 23 — Opt-Out for Third-Party Transfer

Domestic third-party transfer can use opt-out if all of the following are filed with PPC and disclosed to subjects:

Excluded from opt-out path: 要配慮個人情報, illegally acquired PI, data acquired via opt-out from another business (no chain-opt-out).

PPC Notification (Article 26)

Plus subject notification (or public announcement if individual notice infeasible). Cloak's appi recipe must wire both PPC API/form path AND subject-notification template.

2024 Amendment Highlights

Reform is staged — track PPC quarterly notices for in-force dates.

Anti-Patterns

• Calling pseudonymized data 匿名加工 — keeping the mapping table anywhere makes it 仮名加工情報 with all the duties (no third-party transfer, internal-use-only). Auditors check key-destruction logs.
• Generic "may transfer abroad" notice — post-2022, the foreign regime substance must be disclosed. Insufficient notice voids consent.
• Treating health-checkup results as ordinary PI — corporate wellness data is 要配慮個人情報. Explicit consent required even for HR processing.
• Single 利用目的 declaration covering everything — purpose must be specific enough to predict use. "For business purposes" fails Art. 17 specificity.
• Skipping the Art. 23 PPC filing for opt-out third-party transfer — without filing, the legal basis is consent, not opt-out. Most ad-tech vendors get this wrong.
• No retention limit on access logs — Art. 26 requires 3-year retention of disclosure/correction request records; longer creates liability.
• Conflating APPI with PIPL or PIPA — China's PIPL and Korea's PIPA share vocabulary but diverge on consent granularity, transfer regime, and breach thresholds. Don't reuse Chinese/Korean templates verbatim.
• Assuming 匿名加工情報 lets you skip privacy notice — Art. 43 requires public disclosure of categories of anonymized information created and method.
• Manual PPC reporting — the 速やか standard implies operational readiness. Build the channel before the breach.

Handoff

• To Crypt: encryption + key management for the 仮名加工情報 mapping table; key destruction protocol for 匿名加工情報 transition.
• To Canon: APPI ↔ ISO/IEC 27701 control mapping; Pマーク (JIS Q 15001) gap matrix when seeking certification.
• To Canon: 個人情報保護方針 (Privacy Policy) review in Japanese; 利用目的 specificity check; cross-border disclosure substance per 2022 standard.
• To Canon[regulatory]: ISMS scope alignment, Pマーク evidence package, audit trail design for PPC inspection.
• To Builder: PPC reporting endpoint, consent UI for 要配慮 categories, Art. 23 opt-out channel, transfer addendum signing flow.
• To Schema: tier annotations (appi_tier: 個人 | 仮名 | 匿名), 要配慮 flags, 利用目的 column-level metadata.
• To Gateway: cross-border-aware routing — block prohibited destinations at API edge.