Japan's My Number Act: Strict Rules for the National ID

Executive Summary

My Number is Japan's 12-digit Individual Number, assigned to every resident since October 2015 under Act No. 27 of 2013, used across tax, social security, and disaster response.
Unlike ordinary personal data, My Number may only be collected and used for statutorily enumerated purposes; consent cannot expand them.
Employers are the main private-sector handlers: they must collect My Numbers for payroll tax and social insurance filings, with identity verification, scope limits, and safe management duties.
Penalties are criminal and stricter than APPI's: providing a My Number file unlawfully carries up to 4 years imprisonment or JPY 2 million, with no order-first grace.
The 2021-2023 reforms tied My Number Cards to health insurance and expanded uses, keeping the regime under active political and PPC scrutiny.

Japan runs two privacy regimes side by side: APPI for personal information generally, and a much harder law for one specific data element. The My Number Act governs the 12-digit Individual Number every resident has carried since late 2015, and it inverts the usual privacy logic: instead of broad processing bounded by purposes you declare, My Number use is prohibited except where statute affirmatively allows it. For most companies, that means one thing done carefully, payroll, and a standing rule everywhere else: do not collect, do not store, do not ask.

Regulation	Act No. 27 of 2013 (My Number Act)
Data element	12-digit Individual Number + linked ‘specific personal information’
Max penalty	4 years imprisonment / JPY 2M (unlawful file provision)
Enforcing authority	PPC

What the law permits, and forbids

Permitted uses are enumerated: social security procedures, tax filings, and disaster response, plus narrow additions from the 2021-2023 reform wave (health insurance linkage through the My Number Card, some licensing). Everything else is off limits: a business cannot use My Numbers as customer IDs, cannot demand them for loyalty programs, and cannot keep them “just in case.” The prohibition covers collecting and retaining, not just using, and consent cannot make any of it lawful.

Employer duties. Collect numbers from employees and their dependents for withholding and social-insurance filings, with two-step verification (number confirmation plus identity confirmation). Designate handling staff, wall off access, encrypt or physically secure records per the PPC’s specific personal information guidelines, supervise outsourcees, and delete when the statutory retention for the underlying filings expires.

Financial institutions. Securities firms, banks, and insurers collect My Numbers for legally mandated tax reporting on accounts and products, under the same fixed-purpose discipline.

Penalties with teeth

The act carries direct criminal liability: providing a database of My Numbers to a third party unlawfully reaches 4 years imprisonment or JPY 2 million (both possible), acquiring numbers by deceit or theft up to 3 years, and unlawful provision by public officials is aggravated. Corporations face parallel fines. Compare APPI, where most criminal exposure requires first ignoring a PPC order, background in the APPI compliance guide.

Program design in one paragraph

Isolate My Number data in a dedicated, Japan-resident enclave with named-person access; collect only through verified channels at onboarding; never let the number reach CRM, analytics, or log pipelines; contract payroll vendors to the PPC’s safe-management standard with re-outsourcing consent clauses; and schedule deletion against the tax-document retention calendar. Treat any My Number appearing on a web form or in a support ticket as an incident. For the general-data layer that surrounds it, employee and customer information, the ordinary APPI rules and transfer analysis apply; check what your public web properties collect with a free scan.

Frequently Asked Questions

Can we ask customers for their My Number?

Almost never. Private businesses may collect My Numbers only for enumerated administrative purposes, in practice, employer obligations (payroll tax withholding, social insurance) and specific financial-institution duties (tax reporting on securities and insurance). Marketing, KYC convenience, or customer identification are unlawful purposes, and consent does not cure them.

How is this stricter than APPI?

Three ways: purposes are fixed by statute rather than declared by the operator; collection, use, provision, and even asking for a My Number outside those purposes is prohibited; and direct criminal penalties attach to mishandling without requiring a prior regulator order, unlike most APPI offenses. My Number data is 'specific personal information' with its own PPC guidelines.

What must employers do to handle My Numbers correctly?

Verify identity at collection (number plus identity documents or the My Number Card), restrict use to the filing purposes, limit internal access to designated staff, apply the PPC's safe-management measures (organizational, human, physical, technical), supervise any outsourcees with equivalent controls, and delete numbers when retention duties end.

Can My Number processing be outsourced?

Yes, payroll vendors are common, but the outsourcer must supervise the contractor to the same safe-management standard, and any re-outsourcing needs the original client's consent. The 2023 incidents around mis-linked Individual Numbers in government systems show how contractor error propagates, and the PPC investigated public bodies over them.

Do foreign companies with staff in Japan handle My Numbers?

If they employ residents of Japan and run Japanese payroll or social insurance, yes: the collection obligation follows the filings. Storing My Numbers offshore or in group HR systems abroad raises both My Number safe-management questions and APPI transfer analysis, most groups isolate My Number fields in Japan-resident systems.

Regulatory Crosswalk

APPIUS SSN handling rules

Organizations subject to this regulation often operate under these overlapping frameworks. BD Emerson maps controls across frameworks to reduce duplicated compliance effort.

Evaluate your compliance posture now

BD Emerson's automated scanner audits your public-facing properties against your applicable regulations in minutes, not weeks.

Run Free Scan Speak to an Expert