Japan APPI

Act on the Protection of Personal Information - PPC oversight, opt-out for sale, cross-border transfer.


Short name	APPI
Region	Asia-Pacific
Country or scope	Japan
Sector	Privacy
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers APPI

Scan requirements: 6, all decided by a scan.
Controls: the scan requirements below, plus 8 controls from Safeguard's control catalog for APPI.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 23: 1 written for APPI and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`JP-APPI-23` Security Control Measures	Business operators must take necessary and appropriate measures for the security control of personal data, including assurance of the integrity of the software systems processing it (APPI Art. 23)	Scan
`JP-APPI-23-INV` Knowing the Processing Systems	Security control measures presuppose that the operator knows which software components handle personal data, so those components must be inventoried (APPI Art. 23; PPC security control guidelines)	Scan
`JP-APPI-25` Supervision of Trustees	When entrusting personal data handling to third parties, operators must exercise necessary and appropriate supervision over the trustee, which requires knowing the suppliers behind processing software (APPI Art. 25)	Scan
`JP-APPI-26` Breach Reporting Readiness	Leakage incidents likely to harm individuals' rights must be reported to the PPC and affected data subjects notified, which requires quickly determining whether deployed components match a disclosed vulnerability (APPI Art. 26)	Scan
`JP-APPI-ACC` Accuracy and Currency of Processing Records	Operators must keep personal data accurate and up to date and delete it when no longer needed, and equivalent discipline applies to records of the processing systems, requiring components documented with name and version (APPI data-accuracy obligation)	Scan
`JP-APPI-TRANS` Transparency of Handling	Operators must make information about their personal data handling publicly accessible, and supporting technical documentation should be identifiable and timestamped (APPI transparency/public-disclosure obligations)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`APPI-15-17`	Purpose Specification & Acquisition
`APPI-20-22`	Security Management Measures
`APPI-23-24`	Third-Party Provision & Cross-Border Transfer
`APPI-27-30`	Data Subject Rights
`APPI-56-61`	Anonymously Processed Information
`APPI-76`	Breach Notification & Reporting
`APPI-SPD`	Sensitive Personal Data Handling
`APPI-PPC-REG`	PPC Registration & Compliance Programme

Policy templates

Written for APPI:

APPI Cross-Border Personal Data Transfer Policy

And 22 from the standard set, adapted to APPI.