Japan · Notification, Not Licence, and the Internet Exclusion
Last verified: 6 September 2026 · Source: 探偵業の業務の適正化に関する法律 (Act on Proper Operation of Detective Business), Act No. 60 of 2006, in force 1 June 2007. Read from the Tokyo Metropolitan Police Department's official guide to the Act, a thirteen-page government publication that reproduces each obligation against its article number and penalty. The guide is in Japanese despite its English title, and the English on this page is an AI9OS working translation, not official. Where a word decides a matter, read the Japanese. The statute text itself was not separately retrieved: see the open questions below.
| Field | Japan |
|---|---|
| What the state regulates | The profession, by notification rather than by licence. There is no permission to be granted and no examination to pass. You notify before you start, and the obligations attach from then on. |
| Governing instrument | 探偵業の業務の適正化に関する法律, Act No. 60 of 2006, in force 1 June 2007. Its stated purpose (Art 1) is the proper operation of the business and the protection of individual rights and interests. It was not enacted to promote the industry, a point the police guide makes expressly. |
| Authority | The Prefectural Public Safety Commission (都道府県公安委員会) for the area of each business office, with notifications filed through the local police station. |
| Trigger | Carrying on 探偵業務 as a business. Notification must be filed by the day before operations begin, for each business office (Art 4). |
| Definition, and this is the whole point | Bounded by method. Receiving a request from another person, collecting information on a specific person's whereabouts or conduct, by field investigation using interviews, tailing, stakeout or similar methods, and reporting the result to the requester (Art 2(1)). |
| "Specific person" | Includes legal persons, not only individuals. Corporate subjects are inside the definition. |
| Penalty for operating without notifying | Imprisonment up to 6 months or a fine up to ¥300,000 (Art 18). |
| Heaviest penalty | Up to 1 year or ¥1,000,000 for breaching a suspension or cessation order (Art 17). |
| Corporate liability | Dual liability (両罰規定, Art 21): where an employee commits an offence in the course of the business, the company or sole proprietor is fined as well as the individual. |
| Foreign and cross-border firms | Unverified, requires local advice. The obligation attaches per 営業所, business office, which suggests a firm with no office in Japan has nothing to notify. That is an inference from the structure, not a reading of a provision on extraterritoriality. |
The exclusion that matters more than the regime
Japan's definition of detective work is bounded by how the information is obtained. That is unusual, and for anyone doing open-source work it is the single most consequential fact on this page.
The police guide lists the categories of work that fall outside the Act entirely. Among them:
Work in which the investigation is carried out solely by telephone enquiry, or by the collection of information using the internet.
The other exclusions are: newsgathering by writers, journalists and internet media for their own reporting; research by academics as part of their own scholarly work; activity by lawyers, certified public accountants, tax accountants and patent attorneys necessary for matters they have been retained on; opinion polls and questionnaire surveys by research bodies; and businesses that compile broadly collected location or conduct information into lists or databases and supply them on request.
Read the exclusion narrowly, because it is narrow. It says solely. A matter that begins as desk research and adds one period of physical observation is no longer within it, and the Act then applies to the whole engagement rather than to the observation alone. The safe reading is that the exclusion protects a genuinely desk-bound engagement and nothing else.
Why this is the exact inverse of Singapore
These two statutes answer the same question in opposite ways, and a practitioner who assumes the ASEAN position travels badly in both directions.
| Singapore (PSIA 2007) | Japan (Act No. 60 of 2006) | |
|---|---|---|
| Definition turns on | The function. Obtaining and giving information about any person, for reward | The method. Field investigation by interview, tailing or stakeout |
| Does the source of the information matter? | No. The page for Singapore records this expressly: nothing in the definition turns on the source | Yes, decisively. Telephone-only or internet-only work is outside the Act |
| A purely open-source engagement | Inside the licensing regime | Outside the notification regime |
| Permission model | Licence, granted in advance | Notification, filed in advance, no grant |
| Professional exemptions | Advocates and solicitors, public accountants, insurance, credit-standing bureaux | Lawyers, CPAs, tax accountants, patent attorneys, journalists, academics |
The same desk-based engagement is licensable work in Singapore and unregulated work in Japan. That is the kind of asymmetry that is invisible until it is expensive, and it is why "we do OSINT, so we are fine" is not a portable answer. See Singapore for the other half of it.
Outside the Act is not outside the law. The exclusion is from the Detective Business Act only. The Act on the Protection of Personal Information applies to the handling of personal data regardless, and Art 6 of the Detective Business Act makes the general point explicitly for those inside the regime: the Act confers no special powers and does not make otherwise unlawful conduct lawful.
What the Act requires of a notified operator
The obligations are unusually concrete, and several have no equivalent in the ASEAN statutes on this registry.
| Article | Obligation |
|---|---|
| Art 3 | Disqualifications: undischarged bankrupt; a custodial sentence or a fine under this Act within 5 years; breach of a suspension or cessation order within 5 years; membership of an organised crime group, or fewer than 5 years since ceasing to be a member; incapacity; and corporations whose officers are disqualified. |
| Art 5 | No name-lending. A notified operator must not let another person trade under its name, and this applies even where the other person is itself notified. |
| Art 6 | Principle of conduct. The Act grants no special authority, and detective work is not a justification. The guide's own example: entering a neighbouring property without permission to observe a subject is trespass. Conduct that infringes rights includes civil wrongs, not only crimes. |
| Art 7 | The operator must obtain a written undertaking from the client that the results will not be used for criminal acts, unlawful discrimination or other unlawful purposes. This runs the other way from most regimes: the duty is to get something from the client, before starting. |
| Art 8 | A pre-contract written explanation of prescribed matters, and a post-contract written statement of the contract. Both must be on paper. The guide states that transmitting data over a network is not delivery. Blanket contracts covering future unspecified work are not permitted: each engagement must be specified. |
| Art 9(1) | The operator must not carry out the work if it knows the results will be used unlawfully. "Knows" extends to recognising the possibility and accepting it. Continuing regardless can make the operator an accessory to the client's offence. |
| Art 9(2) | No subcontracting to a person who has not notified, not even for a single stakeout or a single report. |
| Art 10 | Confidentiality, which survives the end of employment, and positive measures against misuse of materials: limiting who may handle them, controlling removal and copying, storage and disposal rules, information security, and restricting the use of personally owned devices for the work. |
| Art 11 | Mandatory staff education covering the Act, criminal law, the personal information statute, and proper method. |
| Art 12 | An employee register per office, including a photograph, kept for 3 years after a person leaves. The notification sign must be displayed at the office and on the operator's website, unless it has five or fewer regular staff or no website. A person who is not a notified operator must not display that sign or anything like it. |
| Art 13 | The Commission may require reports and documents, and police may enter a business office and inspect records and question people. |
| Arts 14 to 15 | Instructions to take measures; suspension of up to 6 months; and an order to cease business where a disqualification applies. |
Article 10's device restriction is worth pausing on if you are reading this as a technology question rather than a legal one. It is a statutory expectation that an investigation firm controls what its people put on their own hardware, which is a control most firms outside Japan implement, if at all, as policy rather than as law.
Open questions on this entry
1. The statute text was not separately retrieved. Every article number, obligation and penalty on this page comes from the Tokyo Metropolitan Police Department's official guide to the Act rather than from the Act as published. That is a government source describing its own regime, which is strong, but it is a secondary rendering of a primary instrument and the distinction matters. Read the statute before relying on an article number in a filing.
2. Whether a foreign firm with no Japanese business office must notify. Notification attaches to each 営業所. A firm operating from outside Japan appears to have no office to notify for, but nothing read here addresses extraterritorial application, and the answer would change if a Japanese client's premises or a co-working address were treated as an office. Requires Japanese counsel.
3. The interaction with the personal information statute was not read for this entry. The Detective Business Act exclusion for internet-only work says nothing about what the Act on the Protection of Personal Information requires of that same work, and the second question is the one that governs the data.
How this compares
| Jurisdiction | What the state regulates | The short answer |
|---|---|---|
| Singapore | Profession | Licensed, source-agnostic definition, two licences |
| Malaysia | Profession | Licensed under the Private Agencies Act 1971 |
| Philippines | Profession | Licensed under RA 11917 |
| Japan | Profession | Notification, not licence; internet-only work is excluded |
| Thailand | Neither | Guarding is licensed; investigation is not mentioned |
| Indonesia | Neither | Six licensed security categories; investigation is not one |
| Hong Kong | Neither | Guarding is licensed; the disclosure offence is the constraint |
| South Korea | Neither | No licence since the title was freed in 2020; the data law constrains |
| Laos | Neither | Guarding is licensed; the data law is the constraint |
| Vietnam | Activity | Data analysis and processing become conditional business lines |
Primary sources
- 探偵業の業務の適正化に関する法律 (Act on Proper Operation of Detective Business), Act No. 60 of 2006
- Tokyo Metropolitan Police Department, 探偵業ガイド (guide to the Act), thirteen pages
Other jurisdictions
- Singapore · Private Investigation Licensing
- Hong Kong · Investigation Is Not Licensed
- South Korea · Not Licensed, and the Data Law Is the Constraint
- Asia-Pacific Private Investigation Registry
General information for practitioners, not legal advice. Engage Japanese counsel before relying on this reading for a live matter. The English on this page is our own translation from the Japanese; the Japanese governs. Falling outside the Detective Business Act does not put an engagement outside the personal information statute.
AI9OS turns public information into verified, chain-of-custody findings for licensed investigation agencies, law firms and corporate risk teams.
Request a demo