Japan's Personal Information Protection Commission processed 17,139 breach reports from businesses under Article 26(1) of the Act on the Protection of Personal Information (APPI) in fiscal 2025, which ran from April 2025 to March 2026, according to its annual report to the Diet. Alongside them it issued 455 guidance measures, 2 recommendations and 1 order, with no administrative fine listed.
How many breach reports does the PPC receive?
The PPC processed 17,139 mandatory breach reports from businesses in fiscal 2025, of which 13,345 came directly to the Commission and 3,794 arrived through delegated ministries. That is 10.1% fewer than the 19,056 processed in fiscal 2024, but still far above the 12,120 recorded in fiscal 2023.
The fiscal 2024 total was inflated by one event. The PPC's fiscal 2024 report says it includes 2,745 reports tied to a ransomware attack on a payroll and HR software provider, MK System, which was reported by many client businesses at once. Strip those out and the underlying count for fiscal 2024 is about 16,300, so the fiscal 2025 figure is closer to flat than the headline drop suggests. That adjustment is our arithmetic, not a figure the PPC publishes.
Reports are mandatory for the categories of incident set out in the APPI's enforcement rules, such as leaks involving sensitive personal information or suspected unauthorized access. The PPC also logged 1,893 voluntary reports in fiscal 2025 that fell outside the mandatory categories, and does not count them in the 17,139.
Reporting volume has settled at a level roughly 40% above fiscal 2023.
What do the breach reports look like?
Most Japanese breach reports are small and involve paper. In fiscal 2025, 93.6% involved 1,000 people or fewer, 83.9% involved customer information, and 76.9% involved paper records only, according to the PPC's annual report. The most common causes were misdelivered documents at hospitals and pharmacies, misaddressed credit cards, and unauthorized access.
The PPC sorts reports by the legal trigger. In fiscal 2025, 61.9% involved sensitive personal information (the first reporting category) and 22.3% involved unauthorized access or similar malicious activity (the third). The two categories can overlap with others, so the shares do not sum to 100%. A year earlier the split was 45.4% and 39.9%, which suggests the mix has shifted toward routine paper errors in health settings and away from hacking.
| Measure | Fiscal 2024 | Fiscal 2025 |
|---|---|---|
| Business breach reports processed | 19,056 | 17,139 |
| Of which direct to the PPC | 14,198 | 13,345 |
| Reports from extraterritorial businesses | 36 | 52 |
| Share involving sensitive information | 45.4% | 61.9% |
| Share involving unauthorized access | 39.9% | 22.3% |
Source: PPC annual reports for fiscal 2024 and fiscal 2025.
The typical Japanese breach is a misdelivered letter, not a hack.
How much did PPC reports grow before 2025?
Direct breach reports to the PPC roughly doubled in a single year. They went from 7,075 in fiscal 2023 to 14,198 in fiscal 2024, a rise of 100.7%, according to the fiscal 2024 annual report. Total reports rose from 12,120 to 19,056, or 57.2%, because the share routed through ministries fell slightly from 5,045 to 4,858.
The growth shows how quickly a mandatory reporting duty changes the numbers. For another regulator's numbers, see our look at South Korea's PIPA enforcement.
Reports from outside Japan are small but rising. The PPC counted 52 extraterritorial reports in fiscal 2025, up from 36 in fiscal 2024 and 13 in fiscal 2023, and its guidance to overseas businesses went from 0 to 6 to 11 over the same three years.
The reporting duty works as the PPC's main early-warning system.
What enforcement tools does the PPC use?
The PPC's enforcement ladder in the annual report runs from a request for reports and on-site inspection (Article 146), through guidance and advice (Article 147), to a recommendation and then an order (Article 148). In fiscal 2025 it used 19 report requests, 148 inspections, 455 guidance measures, 2 recommendations and 1 order.
Figure 1: The escalation path in Articles 146 to 148 of the APPI as the PPC describes it. Source: PPC, Annual Report for Fiscal 2025.
Article 148 also allows a direct emergency order where serious harm to individuals requires urgent action, which is the route used in May 2025. The report does not list a statutory administrative fine among these measures.
Figure 2: PPC supervisory actions on businesses, fiscal 2024 versus fiscal 2025. Source: PPC annual reports.
Inspections tripled while PPC-run report requests fell sharply. Of the 148 inspections in fiscal 2025, 146 were run by delegated ministries and only 2 by the Commission itself, so the rise reflects ministry activity, not a larger PPC field team. Guidance grew 15.2%, from 395 to 455.
Japan's model is escalation by conversation first, with formal orders as a rare backstop. Regulators elsewhere in the region are covered in our Southeast Asia PDPA tracker.
Which cases did the PPC act on in 2025?
Four of the matters the report describes by name fell between April and September 2025: a crime-map website on 3 April 2025, four non-life insurers on 30 April, a list broker on 16 May and a second broker on 10 September. Each is described in the annual report with its legal basis.
Figure 3: Named PPC enforcement actions described in the fiscal 2025 annual report. Source: PPC, Annual Report for Fiscal 2025.
The 30 April guidance went to Tokio Marine & Nichido, Sompo Japan, Mitsui Sumitomo Insurance and Aioi Nissay Dowa. The PPC found breaches of proper acquisition (Article 20(1)), security control measures (Article 23) and supervision of contractors (Article 25), and asked for a report on remedial steps.
The two broker cases both concern Article 19, the ban on using personal information in ways that may encourage unlawful acts. The PPC found that Business Planning Ltd. supplied personal information while aware recipients could be acting unlawfully, and that individuals were exposed to contact from special fraud groups. The May 2025 order told it to stop at once and build a system to prevent repeats, with a recommendation on missing third-party transfer records under Article 29(1).
For comparison, the fiscal 2024 recommendation was to a construction-industry recruiter, Beavers Co., for obtaining site supervisors' phone numbers by calling under a fictitious company name, a breach of proper acquisition under Article 20(1).
The 2025 cases are small in number but sharply aimed at data brokers and at data sharing between insurers and agencies.
What about public bodies and My Number?
Public-sector breach reports rose to 2,278 in fiscal 2025 from 1,951 in fiscal 2024 and 1,159 in fiscal 2023, with 248 from national bodies and 2,030 from local governments. The PPC issued 194 guidance measures to public bodies and no recommendations.
Figure 4: The 19,417 breach reports processed in fiscal 2025 by route (our sum of the PPC's reported figures). Source: PPC, Annual Report for Fiscal 2025.
Reports under the separate My Number Act fell from 2,052 in fiscal 2024 to 392 in fiscal 2025. The fiscal 2024 report ties 1,726 of the earlier total to the MK System ransomware event, so the decline mirrors the one-off spike, not a change in behavior.
Consumers also contact the PPC directly. Its APPI consultation line took 19,887 inquiries from the private sector in fiscal 2025, compared with 20,868 in fiscal 2024, and "provision of personal data to third parties" was the most common topic.
The public sector now supplies about one in eight breach reports.
The Bottom Line
The PPC processed 17,139 breach reports from businesses in fiscal 2025, issued 455 guidance measures, and made one of the three formal measures in the year an emergency order. Japan's enforcement works through reporting and guidance, with formal orders aimed at deliberate misuse, and brokers are the clearest target. Any business handling Japanese residents' data should keep a short incident log, be ready to report to the PPC, and check that its notice describes purposes and third-party sharing accurately. A privacy policy generator can help you draft that notice, but it does not replace legal advice. For a wider view of the regimes involved, see our global privacy laws list.
Frequently Asked Questions
How many breach reports did Japan's PPC process in fiscal 2025? 17,139 reports under Article 26(1) of the APPI for April 2025 to March 2026, down from 19,056 in fiscal 2024 and up from 12,120 in fiscal 2023, according to the PPC's annual reports.
Does the PPC issue fines under the APPI? The PPC's own enforcement toolkit in its annual report consists of requests for reports, on-site inspections, guidance and advice (Article 147), and recommendations and orders (Article 148). In fiscal 2025 that meant 455 guidance measures, 2 recommendations and 1 order, and the report lists no administrative fine.
What was the PPC's first order in fiscal 2025? On 16 May 2025 the PPC issued an emergency order to a list broker, Business Planning Ltd., to stop providing personal information in breach of the APPI's ban on improper use (Article 19), alongside a recommendation on record-keeping. It was the only order among 3 formal measures that year.
How many people does a typical Japanese breach report involve? 93.6% of fiscal 2025 business reports involved 1,000 people or fewer, and 76.9% involved paper records only, per the PPC's annual report.
Where the Numbers Come From
- Personal Information Protection Commission: Annual Report for Fiscal 2025 (Japanese). Fiscal 2025 means 1 April 2025 to 31 March 2026. Source of the 17,139 reports, 455 guidance, 2 recommendations, 1 order, 148 inspections, case descriptions and public-sector counts.
- Personal Information Protection Commission: Annual Report for Fiscal 2024 (Japanese). Source of the 19,056 reports, fiscal 2023 comparisons (12,120 and 7,075), the 2,745 MK System reports and the Beavers recommendation.
- Personal Information Protection Commission: Annual reports index. Index of fiscal year reports and first-half reports.
- Personal Information Protection Commission: Act on the Protection of Personal Information (English, June 2020 edition). English reference text of the APPI. Article numbers in this post follow the fiscal 2025 annual report, which uses the numbering in force at the time of each event.
Note: All figures verified as of November 2026 against the PPC's Japanese annual reports; the English translation is for reference only and article numbers differ between editions.
