What does Japan's APPI require for employee supervision and training?

The training duty comes from two short articles of the Act on the Protection of Personal Information (Kojin Jōhō no Hogo ni Kansuru Hōritsu, Act No. 57 of 2003), read with the Guidelines issued by the Personal Information Protection Commission (PPC). The Act itself does not use the word "training". The Guidelines turn the Act's general duties into specific measures, and education of employees is one of them.

Article 23 (security control measures, anzen kanri sochi) says that a business handling personal information "must take the necessary and appropriate measures for managing the security of personal data including preventing the leaking, loss or damage of the personal data they handle". Article 24 (supervision of employees, jūgyōsha no kantoku) says that "in having an employee handle personal data, businesses handling personal information must exercise the necessary and adequate supervision over that employee to ensure the secure management of the personal data" (English wording from the Japanese Law Translation database; the binding Japanese text is on e-Gov Laws). Article 25 applies a parallel supervision duty to contractors that handle personal data on the business's behalf.

For international readers, Japanese privacy regulation works in layers. The Act sets principles and duties. A Cabinet Order and PPC Rules (kisoku) fill in technical detail such as breach thresholds. The PPC's Guidelines (gaidorain) and Q&A explain how the Commission interprets the Act. The Guidelines are not legislation, but they state plainly how to read them: items written as "must" (shinakereba naranai) may be judged a violation of the Act if not followed, while items written as "desirable" (nozomashii) are not an immediate violation but are expected where feasible (PPC General Rules Guidelines).

The PPC Guidelines require businesses to make employees fully aware of the proper handling of personal data and to give them appropriate education. Section 10 of the General Rules Guidelines (an appendix setting out the security control measures to be taken) groups those measures into a basic policy, handling rules, organizational, human, physical and technical measures, and understanding the external environment. Under section 10-4, human security control measures (jinteki anzen kanri sochi), the measure that businesses must take is employee education: staff must be made thoroughly aware of the proper handling of personal data and given appropriate education.

The Guidelines then give two example methods, which apply equally to small and medium sized businesses: holding periodic training (teikiteki na kenshū) for employees on points to note when handling personal data, and including confidentiality obligations for personal data in the work rules (shūgyō kisoku) or similar documents. Methods are illustrations, so a business may choose other methods that achieve the same result, but the requirement to educate is not optional.

Section 3-4-3 of the Guidelines, on supervision of employees under Article 24, adds a risk based expectation. Considering the harm individuals would suffer from a leak, the size and nature of the business and the nature and volume of personal data handled, it is desirable to strengthen the content and frequency of education and training for employees who handle personal data. The same section lists failures that count as inadequate supervision, including not checking whether employees follow the handling rules, and leaving repeated removal of laptops or media containing personal data unaddressed until a loss occurs.

An employee (jūgyōsha) is anyone within the organization who works under its direct or indirect direction and supervision, not only people with an employment contract. The Guidelines list regular, contract, fixed term re-hired, part time and casual employees, and also directors, executive officers, board members, statutory auditors and dispatched (temporary agency) workers. A training plan that covers only permanent staff therefore misses people the PPC expects to be supervised.

Contractors are handled differently. Where a business entrusts the handling of personal data to another company, Article 25 requires supervision of that company, including selecting a contractor whose security measures are at least equivalent to what the Guidelines require. In practice, contract terms often require the contractor to train its own staff, and the business checks that this happens.

No. Small and medium sized businesses must still take the security control measures in Article 23, including employee education, but the Guidelines offer simpler example methods for some measures. A "small and medium sized business" in the Guidelines means one with 100 or fewer employees, excluding businesses that handle personal data about more than 5,000 individuals on any day in the previous six months and businesses that handle personal data as a contractor. For the education measure specifically, the example methods for small businesses are the same as for everyone else: periodic training and confidentiality in the work rules.

Training must prepare staff to escalate suspected leaks quickly, because Article 26 makes reporting to the PPC mandatory for certain incidents. Since the 2020 amendment took full effect on April 1, 2022, businesses must report to the PPC and notify affected individuals when a leak, loss or damage of personal data falls into a reportable category. Under PPC Rules Article 7, reportable situations include leaks involving sensitive (special care required) personal information, leaks likely to cause financial damage, leaks that may have been committed for a wrongful purpose, and leaks affecting more than 1,000 individuals.

The clock is short. The Guidelines give roughly three to five days from the time any department of the business becomes aware of the situation as the benchmark for a prompt preliminary report, and require a final report within 30 days (60 days where the leak may result from an act done for a wrongful purpose, such as unauthorized access). Because the clock starts when any department knows, front line staff must know what to report, to whom, and how fast. The Guidelines also expect a reporting line from employees to responsible persons to be set up in advance as an organizational measure.

The PPC can request reports and conduct on-site inspections (Article 146), and can issue recommendations and orders for violations of Articles 23 to 26 (Article 148). Breaching a PPC order is a criminal offense punishable by imprisonment of up to one year or a fine of up to 1,000,000 yen (Article 178). An employee or officer who provides or misappropriates a personal information database for wrongful gain faces up to one year's imprisonment or a fine of up to 500,000 yen (Article 179), and the corporation can be fined up to 100 million yen for either offense (Article 184).

The penalties are in transition. The "Act Partially Amending the Act on the Protection of Personal Information and Related Acts" was passed by the Diet on July 10, 2026 and promulgated on July 17, 2026, following the PPC's triennial review (the so-called sannen-goto minaoshi).

According to the PPC's summary of the amending Act, it introduces an administrative surcharge (kachōkin) for serious violations, broadens and raises the criminal penalties for unlawful provision of personal information databases, and relaxes some consent and breach notification rules. It takes effect, in principle, within two years of promulgation, and the PPC is still preparing the Cabinet Order, Rules and Guidelines (PPC page on the 2026 amendment). The summary does not list changes to Articles 23 or 24, so the education duty described here continues.

The penalty changes come sooner: under Article 1 of the Supplementary Provisions of the amending Act they take effect six months after promulgation, in January 2027. From then the insider database offense (renumbered Article 178) also covers provision intended to cause harm and carries up to two years' imprisonment or a fine of up to 1,000,000 yen, a new offense covers acquiring personal information by fraud, violence or unauthorized access, and the corporate liability provision becomes Article 185.

APPI training should cover the handling rules the business has actually set, not a generic tour of the Act, because the Guidelines tie education to the proper handling of the business's own personal data. The table below is an illustrative mapping from each obligation to a learning outcome and the evidence that would show it was met. Use a training needs analysis to decide which roles need which rows.

Mapping obligations this way follows the method in how to map training to compliance obligations. It also makes the education measure publicly defensible: businesses must make the security control measures they have taken available to individuals on request, and the PPC's own example of a disclosable human measure is periodic training for employees on points to note when handling personal data.

Keep records that show who was educated, on what version of the handling rules, when, and whether they understood it. The Act does not prescribe a record format, but the PPC can request reports and materials under Article 146, and a business investigating a leak will be asked what supervision it exercised. A practical evidence set includes the following.

1. The handling rules (toriatsukai kitei) and the version in force on each training date.
2. A roster of everyone treated as an employee under Article 24, including officers and dispatched workers.
3. Training completion records with dates, content version and assessment results, kept as an audit trail.
4. Signed confidentiality clauses or work rules acknowledgements, for example through policy attestation.
5. Records of periodic self checks or audits of how staff actually handle personal data, which the Guidelines list as an organizational measure.
6. A record of how training frequency and depth were set by risk, supporting the section 3-4-3 expectation.

The same records support audits under other privacy regimes, so multinational organizations can compare this page with GDPR staff training requirements and Australia's Privacy Act training expectations and build one core module with jurisdiction specific inserts.

Knowledge Foundry models Articles 23 to 26 and the relevant sections of the PPC Guidelines as obligations, links each to the business's own handling rules, and derives learning outcomes and assessment points before any content is written. When the 2026 amendment's Rules and Guidelines are finalized, the affected obligations are flagged so the linked training can be reviewed rather than rebuilt.