What is the APPI?

The APPI aims to provide protections for individuals and their personal data, as well as requirements for businesses regarding the collection, processing, transfer, use, storage, and maintenance of customer and employee data. It was originally passed in 2003. It has since been updated in 2015, and again in 2020, with the amendments entering into effect on April 1, 2022. The amended APPI introduced strengthened requirements for cross-border data transfers and data breach reporting, among other things.

Key highlights

The APPI and the GDPR share some similarities, as follows:

• defining personal data as information that can be used to identify an individual;
• establishing obligations for operators or controllers/processors who handle personal data;
• containing provisions for special or sensitive information; and
• including an extraterritorial scope.

However, despite their similarities, the APPI and the GDPR also differ in certain aspects, including:

• unlike the GDPR, the APPI only refers to personal information controllers and does not distinguish between data controllers and data processors;
• certain provisions in the APPI apply to such retained personal data, while the GDPR does not make this differentiation; and
• the GDPR contains provisions regarding children, processing for research purposes, and specifications on how to obtain consent, which are not addressed in the APPI.