# Does Japan's privacy law (APPI) apply to data I host on a Tokyo VPS?

> Does Japan's APPI apply to data on a Tokyo VPS? Articles 16, 26, 27, 28 and 171, read in the official e-Gov text on 2 November 2026. Not legal advice.

- URL: https://lacquerbay.com/japan-appi-tokyo-vps/
- Last updated: 2026-11-02
- Publisher: Lacquerbay (https://lacquerbay.com)

What the Act on the Protection of Personal Information says about who must follow it, data handled abroad, transfers, leaks and penalties, summarised from the official Japanese text. Not legal advice.

**Quick answer — Does Japan's privacy law (APPI) apply to data I host on a Tokyo VPS?**

The APPI follows the business that uses personal data and the people the data is about; none of the articles read on 2 November 2026 names a server's location as the trigger. Article 16 covers anyone using a personal-information database for business, and Article 171 reaches handling abroad linked to serving people in Japan. Lacquerbay summary, not legal advice.

> **Not legal advice** This page summarises the official Japanese text of the Act on the Protection of Personal Information (Act No. 57 of 2003) and of its Enforcement Rules in Lacquerbay's own English words. It is not legal advice: for a decision about your data, ask a lawyer qualified in Japan. On 2 November 2026 the government's English translation site and the English pages of the Personal Information Protection Commission (PPC) refused our connections, so every article below was read in Japanese on e-Gov, in the version listed as in force that day.

## Who must follow Japan's APPI?

**The Act binds a "personal information handling business operator": anyone who uses a personal-information database for business (Article 16(2)).** The text leaves out only state organs, local governments and public agencies. It sets no minimum size and no nationality.

"Personal information" is information about a living person that identifies them, on its own or by easy matching with other data, or that contains an identification code: a code derived from a feature of the body, or a number assigned to the person on a card or document, of the kinds a Cabinet Order lists (Article 2(1) and (2)). A "personal-information database" is a collection of such information organised so that a computer can search it for a given person (Article 16(1)), apart from types a Cabinet Order excludes.

## Does the APPI reach a company outside Japan?

**Yes, when the data is about people in Japan and is handled to supply them goods or services.** Article 171 applies the Act to an operator that handles, in a foreign country, the personal information of a person in Japan in connection with supplying goods or services to people in Japan. The trigger is the people served, not the place of the servers: a shop abroad that sells to buyers in Japan is covered even if its database runs in Singapore.

The reverse case is not written down. A company outside Japan that keeps data about people outside Japan on a Tokyo VPS is not described by Article 171, and none of the articles read for this page settles it. That question belongs with a lawyer in Japan.

It is not a rare case. According to Lacquerbay's survey of 2 November 2026, 22 hosts, not counting the large clouds, sold a VPS in Tokyo, and the question above applies to every customer of each of them.

## What does the official text say for each case?

**The text does not turn on where the disk sits; it turns on who you are and whose data you hold.**

| Your situation | What the official text says | Articles |
| --- | --- | --- |
| You run a business in Japan and keep customer records on a VPS | You are an operator if you use a personal-information database for business; you must take security control measures and supervise anyone you entrust the data to | 16(2), 23, 25 |
| You are outside Japan and sell to people in Japan | The Act applies to your handling, abroad, of their personal information | 171 |
| You are outside Japan, the people are outside Japan, the VPS is in Tokyo | Not described by Article 171; not settled by the articles read | — |
| You give personal data to someone else | Prior consent of the person, outside listed cases; a contractor handling the data for you within your purpose is not a third party | 27(1), 27(5)(i) |
| You give personal data to a third party in another country | Prior consent to that foreign transfer, unless the country or the recipient meets the PPC's standards | 28(1) |
| A leak that may harm the people concerned | Report to the PPC and tell the people concerned | 26 |

## What must an operator do after a data leak?

**Four kinds of incident must be reported to the PPC: sensitive data, a risk of financial loss, a likely deliberate act such as an intrusion, and any leak that touches more than 1,000 people** (Enforcement Rules, Article 7). Data protected by advanced encryption, or by a measure of the same effect, is left out of all four.

A first report is due promptly after the operator learns of the incident, and a full report within 30 days, or within 60 days when the incident looks deliberate (Rules, Article 8). The people concerned must be told as well (Act, Article 26(2)). An operator that handles the data on behalf of another operator can notify that operator instead of the PPC (Article 26(1), proviso).

## Is putting personal data on a VPS a provision to a third party?

**The Act asks for consent before personal data goes to a third party, but a contractor that handles the data for the operator, within the purpose of use, is not a third party** (Article 27(1) and 27(5)(i)). Whether a VPS host that never opens your files counts as such a contractor, or as no recipient at all, is answered in the PPC's guidelines and Q&A. We could not open ppc.go.jp on 2 November 2026, so this page does not summarise them.

What the Act does say plainly: the operator must keep personal data secure against leaks, loss and damage (Article 23), and must supervise any contractor it entrusts that data to (Article 25).

## What penalties does the APPI set?

**Criminal penalties attach to defying the regulator and to handing over or misusing a database for illicit gain, with fines up to ¥100 million for companies.** The amounts below are from the Act as read on e-Gov on 2 November 2026.

| Conduct | Penalty | Article |
| --- | --- | --- |
| Breaking a PPC order issued under Article 148(2) or (3) | Up to 1 year of imprisonment or a fine up to ¥1,000,000 | 178 |
| Handing over or misusing a personal-information database for illicit gain | Up to 1 year of imprisonment or a fine up to ¥500,000 | 179 |
| Either offence above, committed for a company by its staff | A fine up to ¥100,000,000 for the company | 184(1)(i) |
| No report, or a false report, when the PPC asks under Article 146(1) | A fine up to ¥500,000 | 182 |

## Where does Lacquerbay stand?

Lacquerbay is operated by DomaineGoat LLC, a company formed in Panama, and Panamanian law is the only law the company answers to. Each data centre sits under the law of its own territory: Hong Kong, Singapore or Japan. Lacquerbay rents the machine; what you store on it, and about whom, is yours to assess. Our own handling of customer data is on the [privacy page](https://lacquerbay.com/privacy/ "Privacy Policy").

For the practical side of a Tokyo server, see [Where can I rent a Japan (Tokyo) VPS and pay with crypto?](https://lacquerbay.com/japan-vps-tokyo/ "Where can I rent a Japan (Tokyo) VPS and pay with crypto?"), [Can a foreigner rent a VPS in Japan without a Japanese phone number or ID?](https://lacquerbay.com/rent-japan-vps-as-a-foreigner/ "Can a foreigner rent a VPS in Japan without a Japanese phone number or ID?") and [Is my "Singapore" VPS really in Singapore, and how can I check where a VPS is located?](https://lacquerbay.com/check-vps-location/ "Is my ’Singapore’ VPS really in Singapore, and how can I check where a VPS is located?")

## APPI and a Tokyo VPS: short answers

### Does the APPI apply only to Japanese companies?

No. Article 16(2) names no nationality, and Article 171 applies the Act to handling abroad when it is linked to supplying goods or services to people in Japan. This is a summary of the official text, not legal advice.

### Does a small website count as a business operator under the APPI?

The text sets no size threshold: anyone who uses a personal-information database for business is covered. A customer list that a computer can search by person is such a database, unless a Cabinet Order excludes its type (Article 16(1)).

### Do I need consent to store user data on a Tokyo VPS?

Article 27 requires consent to give personal data to a third party and treats a contractor handling it for you as outside that rule. How the PPC classifies a VPS host is in its guidance, which this page does not cover.

### How fast must a data leak be reported in Japan?

Promptly after the operator learns of it, then in full within 30 days, or 60 days for a likely deliberate act, under Article 8 of the PPC's Enforcement Rules read on 2 November 2026. The people concerned must also be told.

### Where can I read the APPI in English?

The Japanese government publishes a translation on japaneselawtranslation.go.jp and the PPC on its English pages; both refused our connection on 2 November 2026, so this page quotes neither. The binding text is the Japanese one on e-Gov.

## Sources

1. [個人情報の保護に関する法律 (Act on the Protection of Personal Information, Act No. 57 of 2003), version in force on 2 November 2026](https://laws.e-gov.go.jp/law/415AC0000000057) — e-Gov Law Search, Digital Agency of Japan (read 2026-11-02)
2. [個人情報の保護に関する法律施行規則 (Enforcement Rules, PPC Rules No. 3 of 2016), version in force since 14 June 2026](https://laws.e-gov.go.jp/law/428M60020000003) — e-Gov Law Search, Digital Agency of Japan (read 2026-11-02)
3. [Act text through the e-Gov law API (articles 2, 16, 23, 25 to 28, 148, 171, 178, 179, 182, 184)](https://laws.e-gov.go.jp/api/2/law_data/415AC0000000057) — e-Gov Law Search, Digital Agency of Japan (read 2026-11-02)

---

Lacquerbay: Lacquerbay sells Linux KVM VPS in Hong Kong, Singapore and Tokyo, paid in crypto with no ID upload. It is operated by DomaineGoat LLC, a company registered in Panama. Each plan costs the same in all three cities, and on a 12-month term it is priced at least 25% under a named comparable plan, selected among 12 no-KYC crypto hosts and read on 2 November 2026.