Personal Information Protection Policy (APPI)

1. Purpose

This policy sets out how [Company Name] handles personal information in accordance with the Act on the Protection of Personal Information (Act No. 57 of 2003, as amended) ("APPI"), the guidelines of the Personal Information Protection Commission ("PPC"), and related Japanese legislation.

2. Scope

Applies to all personal information, personal data and retained personal data handled by [Company Name], its officers, employees and entrusted persons, including data relating to individuals in Japan processed from outside Japan.

3. Purpose of use

[Company Name] specifies the purposes of use as concretely as possible and publishes or notifies them to the individual. Personal information is not handled beyond the scope necessary to achieve those purposes without prior consent.

4. Proper acquisition

Personal information is acquired only by lawful and fair means. Special care-required personal information (要配慮個人情報) — such as medical history, criminal records and creed — is not acquired without the individual's prior consent, except as permitted by law.

5. Security control measures

[Company Name] implements organisational, human, physical and technical security control measures, supervises employees, and supervises any entrusted person to whom handling is outsourced.

6. Provision to third parties

Personal data is not provided to third parties without prior consent except where APPI permits. Records of provision and receipt are kept as required. Transfers to third parties in foreign countries follow the Cross-Border Transfer Procedure.

7. Leak response

Where a leak, loss or damage of personal data meets the reporting thresholds, [Company Name] submits a preliminary report to the PPC promptly (within 3–5 days) and a final report within 30 days (60 days for unauthorised-purpose cases), and notifies affected individuals.

8. My Number

Individual Numbers are collected and used only for social security, tax and disaster-response procedures permitted by the My Number Act, and handled under the My Number Handling Policy.

9. Requests from individuals

Requests for disclosure, correction, cessation of use or deletion of retained personal data are handled by [DPO / Privacy Contact] via [Contact Email].

10. Review

This policy is reviewed every [Review Cadence].

Approved by: [Company Owner] Effective date: [Effective Date] Next review: [Review Date]