[Home](/)/[Resources](/resources)/Japan APPI Connected Products JapanPrivacy # Japan APPI: What Connected Hardware Makers Must Know About Personal Data Obligations Japan's Act on the Protection of Personal Information (APPI) — Act No. 57 of 2003, substantially amended in 2022 — is Japan's primary privacy law. For connected hardware makers, APPI's relevance is direct: any device that collects, transmits, or processes data about identifiable individuals — health metrics, location, behavioural patterns, voice, biometric data — brings the manufacturer, importer, or operator into scope as a 'Personal Information Handling Business Operator'. The 2022 amendments strengthened individual rights, imposed new cross-border transfer rules, added data breach reporting obligations, and created stricter rules for sensitive ('requiring special consideration') personal information. Hardware companies shipping connected products into Japan need to understand which obligations attach to them specifically — not just to app developers, but to the hardware layer that collects the data in the first place. Copy Link[Share on WhatsApp](https://wa.me/?text=https%3A%2F%2Fkrono-labs.com%2Fguides%2Fjapan-appi-connected-products) At a glance Governing law APPI (Act No. 57 of 2003) Regulator Personal Information Protection Commission (PPC) 2022 key changes Extraterritoriality, breach notification, cross-border rules Breach reporting 3–5 days to PPC ## Key APPI obligations for connected hardware operators ### Who is a 'Personal Information Handling Business Operator' under APPI Any entity handling a database of personal information in the course of business — including hardware companies whose devices feed data into cloud platforms or apps — qualifies. The 5,000-person database threshold that previously exempted small operators was removed in 2017; there is no longer a size exemption. If your device collects personal information in Japan, you are in scope. ### What constitutes 'personal information' under APPI APPI defines personal information as information relating to a living individual that can identify that person — including name, address, date of birth, and any information that can be cross-referenced to identify an individual. Connected hardware commonly collects GPS coordinates (locatable to a home), health metrics (paired with user registration), voice recordings (biometric), and device usage patterns (individually identifiable through profiling). Each category has specific handling requirements. ### Special care-required personal information (sensitive data) APPI identifies a category of 'personal information requiring special care' — equivalent to sensitive data in EU GDPR terms — including race, creed, social status, medical history, criminal record, physical/mental disability, sexual orientation, and genetic data. Hardware collecting health metrics (smartwatches, medical adjacent devices, fitness trackers) is particularly likely to touch this category. Acquiring sensitive data requires explicit consent; third-party sharing of sensitive data has additional restrictions. ### Cross-border transfer rules (2022 amendments) The 2022 amendments significantly changed Japan's cross-border data transfer rules. Transfers to third countries are permitted only if: (a) the recipient country provides equivalent protection to Japan's standard, (b) the recipient has entered into a data handling agreement meeting PPC-specified requirements, or (c) the individual has consented after being informed of the destination country's data protection standard. The PPC publishes assessments of country-level equivalence. EU adequacy and Japan's mutual adequacy recognition are relevant for EU-Japan hardware pipelines. ### Data breach notification obligation (2022 amendments) When a personal information breach occurs that meets the significance threshold — leakage, loss, or damage to personal information likely to cause harm — operators must report to the PPC within 3 to 5 days (promptly), and notify affected individuals. For connected hardware, a cloud backend breach affecting stored device telemetry may trigger this obligation. The PPC's enforcement guidance specifies that the notification obligation falls on the entity that operates the database, which for hardware companies is often a cloud service provider operating on the hardware company's behalf under a processing arrangement. ## APPI compliance steps for hardware makers 01 Inventory all personal information your hardware collects, transmits, or stores — including through companion apps and cloud backends. Map data flows from device to cloud to any third-party service. This data map is the foundation of APPI compliance. 02 Establish a privacy policy (privacy notice) in Japanese that discloses: the name of the business operator, purpose of use, the fact of third-party provision (if applicable), procedure for handling requests from individuals, and contact information for complaints. Post this privacy policy in a location accessible to Japanese users before the product is sold. 03 Implement consent mechanisms for sensitive personal information collection. If your device collects health metrics, voice recordings, or other sensitive data categories, explicit prior consent is required — not implied consent through device setup. 04 Review cross-border transfer mechanisms for any personal data flows from Japan to servers outside Japan. If using cloud infrastructure outside Japan, implement a data processing agreement (DPA) that meets PPC's third-party provision requirements, or obtain explicit individual consent for the cross-border transfer with the required disclosures. 05 Establish a data breach response procedure that covers the PPC notification timeline (report promptly, within 3–5 days for significant breaches) and individual notification obligations. Brief your cloud infrastructure provider on their breach notification obligations to you as the data operator. ## Frequently asked questions ### Does APPI apply to a foreign hardware company with no Japan entity? Yes — the 2022 amendments extended APPI's extraterritorial reach. Foreign operators handling personal information of Japanese residents in connection with the supply of goods or services to Japanese residents are subject to APPI even without a Japan legal entity. The PPC can request reports from foreign operators and has a framework for international enforcement cooperation. ### Is Japan's APPI equivalent to EU GDPR? Can we reuse our GDPR compliance? Japan and the EU have mutual adequacy recognition — the EU recognises Japan's APPI as providing adequate protection, and Japan's PPC recognises EU GDPR transfers as meeting APPI's cross-border requirements. However, APPI and GDPR are not identical in structure or requirements. GDPR compliance is a good starting point but APPI has specific requirements — particularly around the 'purpose specification' obligation and the form of Japanese-language privacy notices — that require Japan-specific implementation. ### What are the penalties for APPI violations? The PPC can issue administrative orders (guidance and recommendations) before imposing penalties. Criminal penalties for APPI violations include imprisonment of up to one year or fines up to JPY 1 million for individuals, and corporate fines up to JPY 100 million for legal entities. The 2022 amendments introduced higher corporate penalties specifically to deter systematic violations — the previous JPY 500,000 maximum was seen as inadequate. ### Does the PSE mark or TELEC certification cover APPI compliance? No — PSE and TELEC cover electrical safety and radio conformity respectively, which are entirely separate regulatory domains from data protection. APPI compliance is the responsibility of the entity operating the data collection function — typically the hardware company, importer, or app developer — and has no certification process equivalent to PSE or TELEC. It is a business practice and operational compliance obligation, not a product mark. **Disclaimer:** Educational resource only. Regulatory requirements change and vary by product category. Consult an accredited test laboratory or qualified compliance engineer before making certification decisions. 🇯🇵 Japan roadmap for your product Every standard, document, and test that applies — free, no account required. See your free roadmap[ Want an expert to take your product through 🇯🇵 Japan compliance for you? One consultant from Krono's compliance team takes your product from requirements to legal sale, with a fixed quote before any work starts. See compliance services](/services) Learn this properly In-depth course that teaches the full process, not just this one answer. [Start the course — $149](/courses/42-japan-pse-marking-ecommerce-electronics-sellers)[Prefer to read? Get the book — $24.99](/books/42-japan-pse-marking-ecommerce-electronics-sellers) Related guides * [Japan METI IoT Security GuidelinesJapan METI's IoT security guidelines for connected hardware makers: baseline security requirements, the labeling scheme for IoT security conformance, and how this relates to Japan's broader APPI data protection obligations.](/guides/japan-iot-security-guidelines) * [UAE Data Protection PDPLUAE Federal Decree-Law No. 45 of 2021 (PDPL) for connected product makers: data collection obligations, cross-border transfers, and Arabic privacy notices.](/guides/uae-data-protection-pdpl) * [Australia Privacy Act Connected DevicesAustralia Privacy Act 1988 for connected devices: the 13 APPs, NDB 30-day breach notification, and 2024 reform obligations for IoT product makers.](/guides/australia-privacy-act-connected-devices)