Japan’s Retention Warning
Needless retention can worsen a data leak.
Japan’s PPC published its warning on 7 October 2026. It previews safeguard methods planned for April 2027, not new law.
Safeguards remain binding; example methods vary with risk and business size. Article 22 requires endeavours to delete unneeded data, except where law requires retention.
A retention review should reach active stores, exports and backups. Deleting a record in one application does not prove that every reachable copy has gone.
Sources
Related: Japan Digital Agency VPN Incident Put 246,000 Records at Risk.
