| name | jp-appi-expert |
| title | Japan APPI Expert |
| description | Japan APPI expert for the Act on the Protection of Personal Information. Reference-depth framework plugin with scope determination, evidence checklist, and SCF-backed assessment guidance for Japanese personal data. |
| author | GRCEngClub |
| author_url | https://github.com/GRCEngClub/claude-grc-engineering/tree/main/plugins/frameworks/jp-appi/skills/jp-appi-expert |
| license | MIT |
| version | 0.1.0 |
| execution_mode | open |
| jurisdiction | jp |
| practice | data-protection |
| language | en |
Japan APPI Expert
Reference-depth expertise for Japan's Act on the Protection of Personal Information (APPI), represented in SCF as apac-jpn-ppi-2020. This plugin bundles the SCF crosswalk (58 SCF controls -> 134 framework controls) with APPI-specific assessment context.
Framework Identity
- SCF framework ID:
apac-jpn-ppi-2020
- Region: APAC
- Country: JP
- Regulator: Personal Information Protection Commission (PPC), Japan
- Common shorthand: APPI / Japan PPI
- Current assessment baseline: amended APPI fully in effect from April 1, 2022
Framework In Plain Language
APPI is Japan's national privacy law for organizations that handle personal information and retained personal data. It focuses on purpose specification, fair collection and use, security safeguards, third-party disclosure, cross-border transfer, breach response, and individual rights. For GRC work, treat APPI as both a privacy governance framework and an operational evidence framework: the assessor needs to see where Japanese personal data is collected, how it is used, who receives it, how incidents are escalated, and whether transfer and consent records match actual system flows.
Territorial Scope And Applicability
APPI applies to business operators handling personal information in Japan and can reach foreign operators that provide goods or services to individuals in Japan and handle their personal information. Scope analysis should identify whether the organization is a personal information handling business operator, whether it handles retained personal data, and whether it transfers personal data to third parties or recipients outside Japan. Do not assume APPI is only for Japan-incorporated entities; customer location, service targeting, and Japan data flows matter.
Mandatory Artifacts
Evidence usually centers on documented purposes of use, privacy notices, consent and opt-out records, third-party transfer records, cross-border transfer disclosures, processor or entrustee management, security-control policies, breach response procedures, and data subject request handling records. APPI does not mirror GDPR's Article 30 ROPA or DPIA terminology, but mature programs should maintain equivalent data inventories, transfer registers, incident logs, and vendor oversight files so APPI obligations can be demonstrated.
Cadence And Timelines
There is no SOC-style annual certification cycle in APPI. Assess recurring operating evidence on a risk-based cadence: access reviews, vendor reviews, privacy notice updates, transfer records, consent changes, and breach exercises should be refreshed when systems or purposes change and at least during annual privacy governance review. Breach reporting under the amended APPI is mandatory for specified incident categories; teams should preserve both the initial triage timeline and final report package to the PPC, plus affected-individual notification analysis.
