Japan Compliance Frameworks: A Buyer-Driven Map for SaaS and HealthTech Vendors

Short answer: SaaS vendors handling personal data of people in Japan generally must comply with the Act on the Protection of Personal Information (APPI). Beyond that law, most Japan compliance frameworks are buyer driven: enterprises ask for ISMS certification, consumer-facing firms value the Privacy Mark, government agencies require ISMAP, banks expect FISC alignment, and healthcare buyers expect the medical information security guidelines.

Related guides:

• How to set up your security to scale overseas
• ISO 27001 certification steps explained
• SOC 2 vs ISO 27001: which framework is right for you?

Key takeaways

• APPI is the only item on this list that is binding law. It is overseen by the Personal Information Protection Commission (PPC). Amendments in force from April 1, 2022 added mandatory breach reporting and stricter cross-border transfer rules, and a further amendment promulgated in July 2026 phases in administrative surcharges and other changes through 2028.
• Certifications are procurement gates, not legal requirements. ISMS (JIS Q 27001), the Privacy Mark (JIS Q 15001) and ISMAP are not legal obligations for vendors, but they can be mandatory in practice for specific buyers.
• Your buyer decides the stack. Private enterprise, government, financial services and healthcare each bring a different expectation. Map your pipeline before you pick a certification.
• SOC 2 and ISO 27001 evidence carries over. An existing ISO 27001 certificate maps directly to JIS Q 27001, and SOC 2 controls cover much of what ISMAP and sector guidelines assess.

---

Which compliance frameworks apply to SaaS vendors in Japan?

One law applies to almost everyone, and a set of voluntary frameworks applies depending on who you sell to. Japanese procurement teams rarely ask "are you compliant?" in the abstract. They ask for a specific certificate or a checklist against a specific guideline.

Think of the landscape in three layers:

1. Baseline law. APPI governs how you collect, use, share, transfer and protect personal information. It applies whether you sell to a hospital, a bank or a retailer.
2. General certifications. ISMS certification and the Privacy Mark are the two marks Japanese buyers recognize across industries. ISMS speaks to information security. The Privacy Mark speaks to personal information handling.
3. Buyer-specific programs. ISMAP for government cloud procurement, FISC security guidelines for financial institutions, and the government's medical information system guidelines for healthcare.

If you have expanded into the EU, the pattern will feel familiar. Our overseas security playbook, linked above, covers the general approach. This guide focuses on what is specific to Japan.

What does APPI compliance require from a foreign vendor?

APPI requires you to handle personal information for specified purposes, protect it with appropriate security measures, report qualifying breaches, and meet transfer rules when data leaves Japan. APPI can apply to foreign businesses that handle personal information of people in Japan in connection with supplying goods or services to them, so a US or EU SaaS company does not escape it by hosting data elsewhere.

The amendments that took full effect on April 1, 2022 are the part most vendors need to study closely (the PPC publishes an overview of the amended Act):

• Mandatory breach reporting. Leaks and similar incidents that fall into defined categories, such as large-scale leaks, must now be reported to the PPC, and affected individuals must be notified. Your incident response plan needs a Japan branch that decides whether an incident meets the criteria.
• Stricter cross-border transfer rules. When personal data is transferred to a third party in a foreign country on the basis of consent, individuals must be informed about that country's personal information protection regime and the measures the recipient takes. Transfers relying on contractual safeguards also come with ongoing obligations to monitor the recipient.
• Pseudonymously processed information. The amendments introduced a category of data processed so that individuals cannot be identified without additional information. It eases some internal analytics but has its own handling rules.

There is good news for companies with an EU footprint. Japan and the EU put a mutual adequacy arrangement in place on January 23, 2019: the European Commission adopted an adequacy decision for Japan and the PPC designated the EU under APPI. This allows personal data to flow between the two without additional transfer mechanisms, subject to Supplementary Rules that apply to data received from the EU. If you already run a GDPR program, much of your data mapping, purpose limitation and rights handling work transfers. Our GDPR compliance checklist is a useful starting point, but do not assume GDPR compliance equals APPI compliance. Consent, notice and transfer details differ.

APPI has a built-in review every three years, and the latest cycle has already produced a new law. Following the PPC's triennial review policy of January 2026, the Diet passed an amendment on July 10, 2026, promulgated on July 17, 2026 as Act No. 56 of 2026. According to an A&O Shearman summary, most changes take effect by July 2028 and include administrative surcharges for certain serious violations, stronger protections for children's data, a new category of specified biometric information, and exemptions from individual breach notification for low-risk incidents. Confirm the current text and PPC guidelines on the Personal Information Protection Commission website before finalizing your program.

ISMS, Privacy Mark or ISMAP: which certification do buyers want?

Private enterprises most often ask for ISMS certification, consumer-facing and personal-data-heavy companies value the Privacy Mark, and government agencies require ISMAP. They answer different questions, so it helps to know what each one proves.

ISMS certification (JIS Q 27001). JIS Q 27001 is the Japanese adoption of ISO/IEC 27001. When Japanese buyers ask about ISMS certification, they are asking whether you run a certified information security management system. For a foreign vendor, an ISO 27001 certificate from an accredited certification body is generally the answer, and it is the most portable credential you can bring to Japan. If you do not have one yet, the ISO 27001 certification steps guide linked above walks through the process.

Privacy Mark (P-Mark). The Privacy Mark is a certification for personal information protection management systems based on JIS Q 15001, administered by JIPDEC. It is widely recognized in Japan and is generally aimed at organizations operating there, so a foreign SaaS company typically considers it once a Japanese subsidiary handles significant personal data.

ISMAP. The Information system Security Management and Assessment Program is the Japanese government's security assessment program for cloud services. It was established and put into operation in June 2020, and the first ISMAP Cloud Service List was published in March 2021. According to the official ISMAP brochure, government agencies and related agencies are, in principle, required to procure cloud services from this list. Getting listed requires an audit by a registered assessor against the ISMAP control criteria, which incorporate the JIS Q 27000 series, Japan's government common standards and NIST SP 800-53, followed by review and a registration decision by the ISMAP Steering Committee. ISMAP-LIU (ISMAP for Low-Impact Use), in operation since November 2022, is a track for SaaS used for low-risk business and information, with fewer external audit items than full ISMAP. Details and the current lists are on the ISMAP portal.

If you sell only to private enterprise, ISMAP is rarely worth pursuing early. If public sector is in your plan, scope it once your ISMS is stable.

What do financial and healthcare buyers expect on top?

Financial institutions expect alignment with the FISC security guidelines, and healthcare organizations expect alignment with the government's guidelines on the security of medical information systems. Both show up as detailed questionnaires and contract clauses, not certificates.

Financial services: FISC. The Center for Financial Industry Information Systems (FISC) publishes security guidelines that Japanese banks, insurers and other financial institutions use as a reference for their own systems and for outsourced and cloud services. A bank evaluating your SaaS will often send a checklist structured around FISC topics such as governance, access control, encryption, outsourcing management, business continuity and incident handling.

Healthcare: the "3 ministries 2 guidelines". Healthcare buyers in Japan refer to a set of government guidelines on the security of medical information, often called the "3 ministries 2 guidelines" because three ministries publish two guidelines:

• For medical institutions: the Ministry of Health, Labour and Welfare (MHLW) Guidelines for the Security Management of Medical Information Systems, revised to version 7.0 in June 2026.
• For vendors: the Ministry of Internal Affairs and Communications (MIC) and the Ministry of Economy, Trade and Industry (METI) guidelines for providers of information systems and services that handle medical information, revised to version 2.0 in March 2025. This is where a HealthTech SaaS vendor sits, and version 2.0 clarified that it can cover providers that touch medical information as part of the supply chain even without a direct contract with the medical institution.

Together the guidelines cover topics such as responsibility sharing between the provider and the institution, risk assessment, access control and authentication, logging, data location, encryption and incident response. Health information is also treated as special care-required personal information under APPI, which brings stricter consent rules.

For HealthTech vendors used to HIPAA, the mindset is similar: document shared responsibility clearly and show how you protect health data in every system it touches. The guidelines are revised periodically, so confirm the current edition on the ministry pages linked above.

Framework map: who asks, is it mandatory, and what can you reuse?

Use this table to match each framework to the buyers who request it and to see how much of your existing SOC 2 or ISO 27001 work carries over.

Framework	Who asks for it	Mandatory or voluntary	How SOC 2 / ISO 27001 evidence helps
APPI	Every customer, and the PPC as regulator	Mandatory by law when it applies to you	Security controls, vendor management and incident response carry over. Add Japan-specific notice, transfer and PPC breach reporting steps
ISMS (JIS Q 27001)	Private enterprises across most industries	Voluntary, often a procurement requirement	An ISO 27001 certificate maps directly. SOC 2 controls cover much of Annex A, so the gap is mainly ISMS management clauses
Privacy Mark (JIS Q 15001)	Consumer-facing companies and data-heavy Japanese partners	Voluntary	ISO 27001 security controls help. You still need a personal information management system and Japanese-language documentation
ISMAP / ISMAP-LIU	Japanese government agencies	Voluntary for vendors, but agencies are in principle required to procure from the ISMAP lists	ISO 27001 and SOC 2 evidence supports many controls, but ISMAP has its own criteria and registered auditors
FISC security guidelines	Banks, insurers and other financial institutions	Voluntary guidelines, expected by financial buyers	SOC 2 reports and ISO 27001 evidence answer many checklist items. Outsourcing, continuity and data location need specific answers
Medical information system guidelines	Hospitals, clinics and healthcare service providers	Government guidelines, expected by healthcare buyers	HIPAA and SOC 2 controls cover much of the security content. Add responsibility sharing documentation and APPI health data handling

The pattern is consistent: your control library carries most of the weight, and each Japanese framework adds a layer of local documentation, language and process. If you hold only SOC 2 today, ISO 27001 is usually the better anchor for Japan because buyers recognize it directly as ISMS certification.

What does a phased Japan entry plan look like?

Start with APPI and ISO 27001, then add Privacy Mark, ISMAP or sector programs only when a specific buyer segment demands them. The phases below assume you already hold SOC 2 or ISO 27001 and are selling into Japan for the first time.

Phase 1: Legal baseline (before your first Japanese customer)

1. Map personal data about people in Japan, including where it is stored and which subprocessors receive it.
2. Update privacy notices and customer contracts for APPI purposes of use and cross-border transfers.
3. Add a Japan branch to incident response covering PPC reporting and notification to individuals.
4. Appoint an owner for Japan privacy questions.

Phase 2: Enterprise readiness (first enterprise deals)

1. Obtain or extend ISO 27001 certification so it covers the services you sell in Japan.
2. Prepare a Japanese-language security overview and an answered questionnaire library.
3. Decide on data residency. Many Japanese buyers ask whether data can stay in Japan, so know your answer and your cloud region options.

Phase 3: Segment expansion (driven by pipeline)

1. Financial services: build a FISC-aligned response pack with evidence for each checklist area.
2. Healthcare: document responsibility sharing under the medical information system guidelines and confirm APPI consent flows for health data.
3. Consumer or data-heavy partners: evaluate the Privacy Mark if you operate through a Japanese entity.
4. Government: scope ISMAP or ISMAP-LIU once your ISMS is mature and the public sector opportunity is concrete.

Phase 4: Operate continuously

Keep controls running, collect evidence on a schedule and refresh questionnaire answers when APPI guidance or sector guidelines change. A broader view of how frameworks fit together is in our compliance framework guide.

How SecureSlate helps

SecureSlate helps SMB, SaaS and HealthTech teams enter new markets without rebuilding their compliance program. Multi-framework mapping links one control library to SOC 2, ISO 27001, HIPAA and GDPR, so Japanese requirements extend work you have already done. Continuous control monitoring and automated evidence collection keep your ISMS audit ready, policy templates speed up documentation, vendor risk management tracks the subprocessors you must disclose for cross-border transfers, and a trust center gives Japanese procurement teams a single place to review your security posture.

Start your free SecureSlate trial

FAQ

Does APPI apply to a SaaS company with no office in Japan?

It can. APPI may apply to foreign businesses that handle personal information of people in Japan in connection with supplying goods or services to them. If you have Japanese users or customers, assume APPI applies and confirm the details with qualified counsel.

Is ISO 27001 accepted in Japan, or do we need JIS Q 27001?

JIS Q 27001 is the Japanese adoption of ISO/IEC 27001, so an ISO 27001 certificate from an accredited certification body generally answers buyer requests for ISMS certification.

Do we need ISMAP to sell to Japanese enterprises?

No. ISMAP is aimed at government cloud procurement, where agencies are in principle required to buy from the ISMAP lists. Private enterprises usually ask for ISMS certification and their own questionnaires.

Does GDPR compliance cover Japan?

Partly. The Japan-EU mutual adequacy arrangement in force since January 2019 simplifies data flows, and much GDPR work carries over. APPI still has its own rules on notice, consent, cross-border transfers and breach reporting to the PPC, so run a gap assessment rather than assuming coverage.

Disclaimer (legal note)

This article is for general information only and is not legal, regulatory or professional advice. Requirements vary by framework, industry and jurisdiction. Consult qualified advisors for your specific obligations.