Compliance Radar
Who was sanctioned, and for what?
Fines, court rulings and incidents from Europe, North America, Latin America, Asia-Pacific, Middle East and Africa: 2,207 cases from 44 jurisdictions, each with an official source and checked against that source before publication. Filter by country, area of law and sector. Click a chart to drill down one level.
Click a bar to drill down one level.
Where?
by authority- Personal Information Protection Commission (PPC, 個人情報保護委員会) – 0 % · 3 cases
What for?
by topicWho?
by sectorAll sectors
When?
per year, by date of decision| Period | Cases | Total |
|---|---|---|
| 2023 | 1 | – |
| 2024 | 1 | – |
| 2025 | 0 | – |
| 2026 | 1 | – |
3 cases
19 Aug 2026 KDDI株式会社 (KDDI Corporation)KDDI: data protection authority guidance after leak of 12.2 million email credentials Reprimand or warning
Through a software vulnerability in a mail platform developed by KDDI and provided to several internet service providers, unauthorised parties obtained the credentials (email address and password) of 12,231,954 people; 7,616,173 passwords were stored in plain text, so mailboxes could be read (discovered on 17 June 2026). The authority gave KDDI guidance (shidō) under Art. 147 APPI to improve its technical security measures because access controls against attackers spreading through the system had been inadequate, required a report by 19 October 2026 and also gave such guidance to individual providers responsible for the plain-text storage.
Passwords must never be stored in plain text, and platforms that serve many customers need layered defences against attackers spreading after a breach.
Password security and password reuse
- Authority / court
- Personal Information Protection Commission (PPC, 個人情報保護委員会)
- Area of law
- Data protection · Data breaches and data security
- Legal basis
- Act on the Protection of Personal Information (APPI, 個人情報の保護に関する法律) Art. 147, Art. 146 Abs. 1
- Action
- Reprimand or warning
- Status of proceedings
- unknown
- Sector
- Telecoms, IT and software
- Employees
- 10,000 or more
- Published
- 19 Aug 2026
- PPC – ＫＤＤＩ株式会社及びインターネットサービスプロバイダに対する個人情報の保護に関する法律に基づく行政上の対応並びにメールサービス利用者に対する注意喚起について（令和８年８月19日, PDF） Press release of an authority
- PPC – Pressemitteilung KDDI (19.08.2026) Press release of an authority
Checked against the official source on 4 Oct 2026 · Direct link
Report an error
28 Mar 2024 a Japanese internet groupInternet group: formal recommendation after data leak via a contractor’s infected PC Reprimand or warning
After the work PC of an employee at the company’s South Korean security contractor was infected with malware, unauthorised parties accessed its systems from 14 September to 27 October 2023; data of around 520,000 people (users of its messaging service, business partners, employees) were leaked or put at risk. The authority issued a formal recommendation under Art. 148(1) APPI for inadequate organisational security measures (Art. 23 APPI) and required reports until March 2025; in addition, it gave guidance (shidō) under Art. 147 over the possible exposure of user identifiers (GUID) on the group's auction platform.
Contractors’ access to your systems is part of your own security responsibility; an infected machine at a contractor must not become the way in.
Malware and contractors’ access rights
- Authority / court
- Personal Information Protection Commission (PPC, 個人情報保護委員会)
- Area of law
- Data protection · Data breaches and data security
- Legal basis
- Act on the Protection of Personal Information (APPI, 個人情報の保護に関する法律) Art. 148 Abs. 1 i. V. m. Art. 23; Art. 147
- Action
- Reprimand or warning
- Status of proceedings
- unknown
- Sector
- Media and online platforms
- Employees
- 10,000 or more
- Published
- 28 Mar 2024
Checked against the official source on 8 Oct 2026 · Company name anonymised since 28 Mar 2026 · Direct link
Report an error
12 Jul 2023 a Japanese carmakerCarmaker: data protection authority guidance after vehicle data was exposed for ten years Reprimand or warning
Because of a misconfigured cloud environment at an affiliated contractor within the group, servers for two of the carmaker's connected-vehicle services were accessible from outside for around ten years; data of about 2.3 million people were affected, including in-vehicle device IDs, vehicle identification numbers and location data. The carmaker had not recognised these data as personal data, as the staff responsible had not been adequately trained, and had not checked the contractor’s access controls. The authority gave the company guidance (shidō) under Art. 147 APPI to improve training, access control and supervision of the contractor and to implement its own remedial measures.
Vehicle identification numbers and locations are personal data too: anyone configuring cloud storage must know this, and contractors’ access settings must be checked.
Secure cloud configuration and recognising personal data
Missing or inadequate training played a role in the decision.
- Authority / court
- Personal Information Protection Commission (PPC, 個人情報保護委員会)
- Area of law
- Data protection · Data breaches and data security
- Legal basis
- Act on the Protection of Personal Information (APPI, 個人情報の保護に関する法律) Art. 147 i. V. m. Art. 23 und Art. 25
- Action
- Reprimand or warning
- Status of proceedings
- unknown
- Sector
- Automotive
- Employees
- 10,000 or more
- Published
- 12 Jul 2023
Checked against the official source on 8 Oct 2026 · Company name anonymised since 12 Jul 2025 · Direct link