Japan Compliance Obligations for a Multinational Subsidiary: A Map to Your Group Compliance Program

A Japan subsidiary of a multinational triggers five group compliance programs on day one (privacy, speak-up and whistleblowing, anti-bribery, third-party risk and records management), and a sixth, governance, if it is a large KK. Most Japanese obligations apply regardless of size. A handful switch on at specific statutory lines, including: 10 workers, 300 workers, a vendor's size relative to the buyer, JPY 50 million in sales, or JPY 500 million in capital. The work for HQ is to place each Japanese rule inside the program that already exists, name a local owner, and fix the places where Japan departs from the group template.

This guide is written for the people who run those programs from outside Japan: the regional CFO, in-house counsel, the HR or global mobility lead and the country manager. It covers what Japanese law requires, which threshold switches each duty on, which group program it belongs in, and who should own it locally. The mapping table below is the part to forward internally.

For general overviews, see our posts on compliance obligations for companies in Japan and key compliance requirements for foreign companies in Japan; this post covers how those obligations map onto group compliance programs.

Key points for HQ compliance owners

• Privacy is the program Japan stretches most. The Act on the Protection of Personal Information applies to every business handling personal data, and sending employee or customer data to the parent counts as a transfer to a foreign third party that needs its own legal basis.
• Whistleblowing has a hard line at 300 workers. Above it, the subsidiary must designate named people to handle reports and run an internal reporting system. At 300 or fewer, it is an effort obligation, which a group hotline can satisfy if the Japan entity designates the handlers.
• Procurement rules protect the seller, not the buyer. The Freelance Act and the renamed Subcontract Act set payment terms, written terms and prohibited conduct when the Japan entity buys from individuals and smaller vendors.
• Records rules are about format, not just duration. Invoices and receipts sent or received electronically must be kept electronically, searchable by date, amount and counterparty, unless a small-business relief applies.
• Bribery penalties are now material at group level. Since April 2024, under the Unfair Competition Prevention Act, a company can be fined up to JPY 1 billion for bribing a foreign public official, and an individual faces up to 10 years of imprisonment.

The mapping table: Japan obligations by group compliance program

The table pairs each Japanese obligation with the group program it belongs in, the threshold that triggers it, and a typical allocation of the local owner in a foreign-owned KK. Where the threshold column says "all", the duty applies from incorporation. Owners are suggestions; the point is that each row needs a named person in Japan, not just a policy at HQ.

Japanese obligation	Japanese law	Threshold that triggers it	Group program	Typical local owner
Security controls for personal data; breach reports to the regulator	Act on the Protection of Personal Information (APPI), Arts. 23 and 26	All. Breach reports are mandatory where sensitive data is involved, there is a risk of financial harm, the cause may be an improper purpose, or more than 1,000 individuals are affected	Privacy	Group privacy officer with Japan IT lead
Legal basis for transferring personal data to the parent or group systems abroad	APPI, Art. 28	All transfers to a recipient outside Japan, including the parent	Privacy (intra-group data transfer framework)	Group privacy counsel
Purpose limits and safeguards for employees' My Number	My Number Act	All employers. Simplified safeguards available to businesses with 100 or fewer employees, subject to exceptions	Privacy (HR data)	Japan HR and the payroll sharoushi
Internal reporting system and designated report handlers	Whistleblower Protection Act, Art. 11	Mandatory above 300 regular workers; effort obligation at 300 or fewer	Speak-up and whistleblowing	Group ethics office with a Japan designee
Harassment prevention measures, including customer harassment (mandatory since 1 October 2026)	Act on Comprehensive Promotion of Labor Policies; Equal Employment Opportunity Act	All employers	Code of conduct and speak-up	Japan HR
Ban on bribing foreign and Japanese public officials	Unfair Competition Prevention Act, Art. 18; Penal Code, Art. 198	All	Anti-bribery and corruption	Group compliance with the country manager
Written terms, 60-day payment and termination notice for freelancers	Freelance Act	Any contract with a freelancer who has no employees; most duties apply where the buyer has employees or two or more officers	Third-party risk and procurement	Procurement and accounts payable
Payment terms and prohibited conduct toward smaller vendors	Act on Ensuring Fair Transactions with Small and Medium Contractors (formerly the Subcontract Act)	Buyer and vendor size tests that depend on the type of work, for manufacturing, repair, content/software creation, re-entrusted services and transport	Third-party risk and procurement	Procurement and accounts payable
Checks that counterparties are not organized-crime related; exclusion clauses in contracts	Tokyo Metropolitan Ordinance on the Exclusion of Organized Crime, Art. 18	Effort obligation for businesses in Tokyo; other prefectures have similar ordinances	Third-party due diligence	Legal and procurement
Electronic storage of invoices, receipts and contracts sent or received electronically	Electronic Book Preservation Act	All. Search requirements relaxed where sales two fiscal years earlier were JPY 50 million or less	Records management	Finance with group ERP owner
Retention of tax books (7 years, 10 for loss years) and accounting books (10 years)	Corporation Tax Act; Companies Act, Art. 432(2) (KK) / Art. 615(2) (GK)	All	Records management	Finance
Board or director resolution on the internal control system	Companies Act, Arts. 348(4) and 362(5)	KK only: capital of JPY 500 million or more, or liabilities of JPY 20 billion or more	Governance and internal control	Representative director and corporate secretary

Two patterns stand out. First, little of this depends on size: most rows apply to a subsidiary with a single employee, and the whistleblowing row still applies below 300 workers as an effort obligation. Second, the thresholds that do exist are measured on different bases (workers, capital, sales, liabilities), so a subsidiary can cross one line without noticing it has crossed another. The next section lays those lines out in one place.

The threshold ladder: what changes with headcount, capital and sales

Group programs usually scale by risk tier or revenue band. Japanese law scales by statutory lines that rarely match those bands. The table below lists the lines a foreign-owned subsidiary is most likely to cross as it grows, with the duty each one switches on. It includes the 10-worker line for rules of employment, which sits in HR policy rather than the compliance program but is often the first statutory threshold a new entity meets.

Line crossed	Measured on	What switches on	Law
10 workers	Workers continuously employed	Written rules of employment, filed with the Labour Standards Inspection Office	Labor Standards Act, Art. 89
More than 100 employees	Employees	Full My Number safeguards; the simplified approach for 100 or fewer no longer applies	PPC My Number guideline
More than 300 regular workers	Workers regularly employed	Mandatory internal reporting system and designated report handlers	Whistleblower Protection Act, Art. 11(3)
Sales above JPY 50 million	Sales two fiscal years earlier	Full search requirements for electronic transaction data	Electronic Book Preservation Act
KK only: capital of JPY 500 million or more, or liabilities of JPY 20 billion or more	Balance sheet	Internal control system resolution; also triggers an accounting auditor	Companies Act, Arts. 348(4), 362(5) and 328
More than 1,000 individuals in a breach	Individuals affected	Mandatory breach report to the PPC (other triggers apply at any number)	APPI, Art. 26 and PPC rules

A practical consequence: a small new KK can fall outside the renamed Subcontract Act's size tests for a given vendor and still be fully inside the Freelance Act when it engages an individual consultant, because the Freelance Act's written-terms duty applies to every buyer. Groups that read one exemption as covering both laws end up with non-compliant freelancer contracts.

Privacy: APPI and My Number for a foreign-owned subsidiary

The Japan subsidiary is a personal information handling business under APPI from the day it holds an employee file or a customer list, and it must keep personal data secure, report qualifying breaches and justify every transfer abroad. The group privacy program usually covers most of this; the gaps are the transfer basis and the reporting clock.

What APPI requires of the subsidiary

The Act on the Protection of Personal Information (個人情報の保護に関する法律, Kojin Joho no Hogo ni Kansuru Horitsu), Article 23 (e-Gov, current consolidated text) requires necessary and appropriate measures to prevent leakage, loss or damage of personal data. There is no headcount or revenue floor. A two-person sales office with a CRM is covered in the same way as a plant with 2,000 staff.

Enforcement runs through the Personal Information Protection Commission (PPC). Under the same Act, breaching a PPC order is punishable by up to one year of imprisonment or a fine of up to JPY 1 million for the individual (Article 178), and the company can be fined up to JPY 100 million (Article 184). In practice the exposure for a subsidiary is less the fine than the order itself and the public announcement that can accompany it.

Transfers to HQ: the Article 28 question

Article 28 of APPI requires the data subject's prior consent before personal data is provided to a third party in a foreign country, unless the recipient is in a country the PPC treats as equivalent or has a system that meets PPC standards. The parent company is a third party for this purpose. So is a group HR platform hosted and operated abroad, depending on how access is structured.

The PPC currently recognises only the EEA and the UK as equivalent. A parent there is treated like a domestic recipient (the ordinary third-party rules still apply). For a US, Singapore or other parent, the intra-group agreement route below is the practical basis.

Groups headquartered outside the EEA and the UK that have a GDPR intra-group data transfer agreement can extend it to Japan so the parent can rely on the "system meeting PPC standards" route rather than collecting consent employee by employee. The extension needs Japan-specific content: the APPI duties the recipient will follow and how the subsidiary monitors them. Japan's domestic joint-use arrangement is a separate tool and does not by itself answer the cross-border question.

The breach reporting clock

Under APPI Article 26, a business must report to the PPC when a breach involves sensitive personal information, creates a risk of financial harm, may have been caused for an improper purpose, or affects more than 1,000 individuals. The PPC's breach reporting guidance (accessed October 2026) asks for a preliminary report within 3 to 5 days of discovery and a final report within 30 days, or 60 days where an improper purpose may be involved.

The risk is sequencing. If the group incident response plan routes the incident to HQ security and the investigation takes two weeks, nobody in Japan may file the preliminary report in time. Put the PPC filing in the group playbook as a Japan step with a named owner, the same way the 72-hour GDPR notification is.

My Number: employer duties and who holds the data

Every employer in Japan collects employees' individual numbers for tax and social insurance filings under the My Number Act (番号法, Bango Ho). The PPC's My Number guideline for businesses (revised June 2025) limits use to the statutory purposes, restricts when the number may be requested, requires supervision of any outsourced handler and sets safeguards. A business with 100 or fewer employees may use simplified safeguards, with listed exceptions.

For group programs, the key design decision is location. My Number data should not flow into the global HRIS or be copied to HQ, because use outside the statutory purposes is prohibited. Keep it inside the Japan payroll process, held by the subsidiary and its sharoushi, and record that boundary in the privacy program's data inventory. Our guide to Japan payroll services and statutory compliance explains where payroll data sits in a typical setup.

Speak-up and whistleblowing: the 300-worker line and the December 2026 amendment

A Japan subsidiary with more than 300 regular workers must designate report handlers and maintain an internal reporting system; a smaller one has an effort obligation. Both sizes will face stricter rules on retaliation from 1 December 2026.

What Article 11 requires

The Whistleblower Protection Act (公益通報者保護法, Koeki Tsuhosha Hogo Ho), Article 11 (e-Gov, current consolidated text) requires a business to designate the people who receive and investigate reports (公益通報対応業務従事者, koeki tsuho taio gyomu jujisha) and to put in place a system to handle internal reports. Article 11(3) turns both duties into effort obligations for businesses whose regularly employed workers number 300 or fewer.

Designated handlers carry a personal confidentiality duty. A handler who leaks information identifying a whistleblower faces a fine of up to JPY 300,000 under Article 21. That matters for groups whose hotline is run from HQ: if the Japan entity relies on the group hotline, the people at HQ who triage Japanese reports should be formally designated by the Japan entity and told what the designation means.

The 2025 amendment, in force 1 December 2026

The Consumer Affairs Agency's overview of the amended Act (2025) confirms that Act No. 62 of 2025 was promulgated on 11 June 2025 and takes effect on 1 December 2026. According to the CAA's comparison of the old and new articles (2025), the amendment introduces criminal penalties for dismissing or disciplining a worker because of a protected report, presumes that a dismissal or disciplinary action within one year of a report was because of it (for external reports, the year runs from when the business learned of the report), and extends protection to freelancers working under contracts with the business. The amended Act also lets the Consumer Affairs Agency issue a recommendation (勧告, kankoku) and then an order (命令, meirei) to a business that breaches the Article 11(1) duty to designate report handlers, and adds on-site inspection powers (立入検査, tachiiri kensa).

For a group program, the changes point to three actions before December 2026: check that the Japan entity's handler designations are documented (above 300 workers, a missing handler designation is no longer only a paper gap: from December 2026 the CAA can order a fix), brief Japanese managers on the presumption so disciplinary decisions near a report are reviewed first, and make the hotline available to freelancers as well as employees.

Harassment prevention sits next to speak-up

The Ministry of Health, Labour and Welfare's harassment prevention guidance (accessed October 2026) confirms that employers of every size must take employment-management measures against power harassment, a duty extended to smaller companies from 1 April 2022. Under the 2025 amendments, measures against customer harassment (Act on Comprehensive Promotion of Labor Policies, 労働施策総合推進法, Rodo Shisaku Sogo Suishin Ho) and against sexual harassment of job seekers (Equal Employment Opportunity Act, 男女雇用機会均等法, Danjo Koyo Kikai Kinto Ho) became mandatory on 1 October 2026. The group code of conduct normally covers the substance; Japan needs a local consultation point and a documented response process.

Anti-bribery: foreign officials, Japanese officials, gifts and entertainment

Japan criminalises bribery of foreign public officials under the Unfair Competition Prevention Act and bribery of Japanese officials under the Penal Code, and both apply to a foreign-owned subsidiary and its staff. The group anti-bribery program fits Japan well; the local work is calibrating gifts and entertainment thresholds and identifying who counts as an official.

Foreign public officials

Article 18 of the Unfair Competition Prevention Act (不正競争防止法, Fusei Kyoso Boshi Ho) (e-Gov, current consolidated text) prohibits giving or offering benefits to foreign public officials to obtain an improper business advantage. After the 2023 amendment, which took effect in April 2024, an individual faces up to 10 years of imprisonment, a fine of up to JPY 30 million, or both (Article 21), and the company can be fined up to JPY 1 billion (Article 22). The corporate fine applies when the bribe is paid by an employee in connection with the company's business, which is why the group program's controls over agents, distributors and sales staff matter for the Japan entity too.

Japanese public officials and deemed officials

Under Article 198 of the Penal Code (刑法, Keiho) (e-Gov, current consolidated text), giving, offering or promising a bribe to a Japanese public official is punishable by up to three years of imprisonment or a fine of up to JPY 2.5 million. Staff of some state-linked entities, such as national university corporations, are treated as public officials by the statutes that create those entities, so a customer list that looks private can include officials. Group anti-bribery due diligence should ask that question for Japanese customers in the public and quasi-public sectors.

Gifts and entertainment in practice

Japanese business culture includes seasonal gifts (ochugen in summer, oseibo in winter) and business dinners, and a group gift threshold set in dollars or euros can end up either banning normal courtesy or allowing too much. A workable approach is a Japan-specific schedule: a yen threshold for gifts, a per-head threshold for meals, a pre-approval rule for anything involving public officials or deemed officials, and a register kept by the Japan finance team so the monthly close can match entertainment expenses to approvals.

Third-party risk: freelancers, smaller vendors and anti-social forces

Japan regulates the buyer side of procurement: the Freelance Act protects individual contractors, the renamed Subcontract Act protects smaller vendors, and local ordinances expect counterparties to be screened for organized-crime ties. Group third-party programs focus on supplier risk to the company; Japan adds duties the company owes to the supplier.

The Freelance Act

The Act on the Proper Conduct of Transactions with Specified Entrusted Business Operators (特定受託事業者に係る取引の適正化等に関する法律, commonly the Freelance Act) (e-Gov, current consolidated text) took effect on 1 November 2024. It protects individuals with no employees and one-person companies with no other officers or employees. Every business that engages such a freelancer must state the terms in writing or electronically at once (Article 3).

Where the buyer has employees, or two or more officers, more duties apply: payment within 60 days of receiving the work (Article 4), harassment measures (Article 14) and, for continuous engagements, at least 30 days' notice before termination or non-renewal (Article 16). The Cabinet Order under the Act, published by the Japan Fair Trade Commission (2024), sets the period that triggers the list of prohibited conduct at one month and defines a continuous engagement as six months or more.

The Subcontract Act, renamed from January 2026

From 1 January 2026, the former Subcontract Act (下請法, Shitauke Ho) became the Act on Ensuring Fair Transactions with Small and Medium Contractors (中小受託取引適正化法, Chusho Jutaku Torihiki Tekiseika Ho, "Toriteki Ho") (e-Gov, current consolidated text). It covers only specified entrustments: manufacturing, repair, creation of information-based products such as software and content, services the buyer provides to its own customers and re-entrusts, and, from 2026, specified freight transport; buying off-the-shelf goods, or services the KK consumes itself, is generally outside it.

Whether a transaction is in scope depends on size tests comparing the buyer with the vendor, and the tests differ by type of work, so procurement should check each vendor against the Act rather than assume an exemption. Payment must fall within 60 days of receipt, and payment by promissory note is now prohibited.

For a subsidiary on a group procurement platform, the risk is default payment terms. For in-scope transactions, a 90-day group standard breaches both the Freelance Act and the renamed Subcontract Act. Japan needs a vendor flag in the master data and a payment-term override.

Anti-social forces screening

Article 18 of the Tokyo Metropolitan Ordinance on the Exclusion of Organized Crime (東京都暴力団排除条例, Tokyo-to Boryokudan Haijo Jorei) asks businesses to make efforts to confirm that counterparties are not linked to organized crime and to include exclusion clauses in written contracts. The Tokyo Metropolitan Police Department's Q&A on the ordinance confirms both are effort obligations. Japanese banks, landlords and customers will nonetheless expect the clause in contracts, so add it to the Japan contract templates and the vendor onboarding questionnaire.

Records management: electronic transaction data and retention periods

Japan sets both how long records are kept and in what format: tax books for 7 years (10 for loss years), accounting books for 10 years, and electronically received transaction documents in electronic form with search capability. Group records schedules address duration; the format rule is the part a group template can miss.

Electronic Book Preservation Act

Since 1 January 2024, invoices, receipts, quotes and contracts sent or received electronically must be kept as electronic data under the Electronic Book Preservation Act (電子帳簿保存法, Denshi Chobo Hozon Ho). Printing them and deleting the file is no longer an option. The National Tax Agency's leaflet on storing electronic transaction data (December 2023) sets out the requirements: a display and manuals available, search by transaction date, amount and counterparty, and either a tamper-proof system or written internal rules preventing improper correction or deletion.

The search requirement is waived under the Act's enforcement regulations (施行規則 Art. 4) where sales two fiscal years earlier were JPY 50 million or less, or where printouts are filed by date and counterparty, provided the company can produce the data on request during a tax examination. A subsidiary that relies on the JPY 50 million relief loses it two fiscal years after sales pass the line, so check it each year.

For a subsidiary on a group ERP, the questions to answer are concrete: does the ERP or document store capture the three search fields for Japanese documents, is there a written rule on correction and deletion, and can the Japan finance team export the data for the tax office without a ticket to the global IT team. Our post on paper and digital document rules in Japanese back offices covers how seals and signatures fit into the same workflow.

Retention periods

The National Tax Agency's guidance on retention of corporate books (accessed October 2026) sets 7 years from the day after the filing deadline, and 10 years for fiscal years in which a blue-return company has a loss carried forward. Separately, the Companies Act (会社法, Kaisha Ho) (e-Gov, current consolidated text), Art. 432(2) (KK) / Art. 615(2) (GK), requires a KK or GK to keep its accounting books and important business records for 10 years from closing. A group schedule that says "7 years for finance records" is short for Japan.

Governance: when Japan requires a formal internal control resolution

A Japan KK with capital of JPY 500 million or more, or liabilities of JPY 20 billion or more, must have its directors or board formally decide on its internal control system. A GK has no equivalent statutory duty. Below that line, there is no statutory resolution, but the group control framework still needs a Japan home.

Companies Act Article 348(4) requires directors of such a company to decide on the systems ensuring that directors act in line with law and the articles and that the business of the company and its group runs properly. Article 362(5) puts the same duty on the board where the company has one. The same thresholds trigger the need for an accounting auditor. A wholly owned subsidiary capitalised for a large Japanese operation can cross the line at incorporation.

The resolution is a natural place to anchor the mapping table above: adopt the group policies by board or director resolution, record the Japan owners and keep the resolution with the corporate records. Our article on mapping the group approval matrix onto Japanese company law and the corporate seal covers how those approvals interact with who can sign.

Who owns what, and the order to put it in place

The most efficient sequence is to set up privacy and records duties before the first hire, procurement terms before the first vendor payment, and speak-up and anti-bribery localisation in the first quarter. Japan's thresholds then become items on an annual review, not surprises.

A workable sequence for a new or growing subsidiary

1. Before the first employee: extend the intra-group data transfer agreement to cover the Japan entity, confirm the APPI privacy notice for employees, and decide where My Number data will live (in Japan payroll, not in the global HRIS).
2. Before the first vendor payment: add Freelance Act and renamed Subcontract Act terms to the Japan purchase order template, set a 60-day payment override, and add the organized-crime exclusion clause.
3. At accounting setup: configure electronic storage with the three search fields and adopt a written rule on correction and deletion, even if the statutory JPY 50 million relief currently applies.
4. In the first quarter: designate whistleblowing handlers, set a Japan gifts and entertainment schedule in yen, name a harassment consultation point, and add the PPC breach-report step to the incident playbook.
5. Every year: check the statutory thresholds, comparing headcount against 10, 100 and 300, capital and liabilities against the JPY 500 million and JPY 20 billion lines, sales against JPY 50 million, and vendor status against the procurement tests.

Our first-year HQ calendar for a new Japan subsidiary places these steps alongside the tax, payroll and registration filings, and the headquarters playbook for setting up a Japan subsidiary covers the decisions that come before them.

Common mistakes

• Treating the global hotline as automatic compliance. It can satisfy Article 11, but only if the Japan entity designates the handlers and Japanese-language reporting works.
• Running Japan on group payment terms. A 90-day default breaches the 60-day rules for in-scope freelancers and vendors.
• Printing electronic invoices, sent or received. The paper copy is not the record; the electronic file is.
• Exporting My Number with payroll data. Payroll files sent to HQ for cost reporting should strip individual numbers.
• Using a 7-year retention schedule. Companies Act accounting books need 10 years, and so do tax books for loss years.

Working with AQ Partners

Working with AQ Partners. Our Tokyo team provides monthly bookkeeping, corporate document storage and administration, monthly payroll coordination with a licensed sharoushi, and rules of employment and employment contracts for foreign companies operating in Japan, so the records and employment documents behind your Japan compliance map stay current. Book a consultation to discuss your situation.