What does Japan's Whistleblower Protection Act require of employers?

Japan's regime has three layers: the Whistleblower Protection Act (Kōeki Tsūhōsha Hogo Hō, Act No. 122 of 2004), statutory Guidelines issued under Article 11(4) of the Act, and a Commentary that explains how to meet the Guidelines. The Consumer Affairs Agency (CAA) administers all three (CAA overview).

The Guidelines are formally a Cabinet Office Notification (Cabinet Office Notification No. 118 of 2021). They set out the measures a business operator must take to comply with Article 11. The Commentary (kaisetsu) is not binding in the same way: it gives the CAA's reasoning and examples of how to meet each measure, and it is where most of the detail on education and training sits.

Some terms matter for international readers. A whistleblowing disclosure (kōeki tsūhō) is a report, made without a wrongful purpose, that a reportable fact has occurred or is about to occur. Reportable facts are criminal offenses or facts subject to non-penal fines under the Act and the laws listed in its schedule; the CAA says about 500 laws are covered. A business operator (jigyōsha) is any corporation, other organization or individual carrying on business. The Guidelines state that this includes nonprofits, unincorporated associations, and national and local government bodies.

The Act protects reports made through three channels, often called type 1, type 2 and type 3 reports: to the business operator itself, to an administrative body with authority over the matter, and to other persons such as the media where stricter conditions are met (Article 3). The protected persons currently include workers, dispatched workers, former workers who left within one year before the report, and officers.

Business operators that regularly employ more than 300 workers must set up a whistleblowing system; those with 300 or fewer must endeavor to. Article 11(3) of the Act converts "must designate" and "must establish" into "must endeavor to" for a business operator that regularly employs 300 or fewer workers.

These Article 11 duties came from an amendment enacted in 2020 (Act No. 51 of 2020). The CAA's summary of the amended Guidelines records that the Guidelines have applied since June 1, 2022.

The protections in the Act apply to every business operator regardless of size. Dismissal because of a protected report is void (Article 3), other disadvantageous treatment such as demotion or pay cuts is prohibited (Article 5), and a business operator cannot claim damages from a whistleblower for loss caused by a protected report (Article 7). Smaller employers therefore still need managers who understand what they must not do, even if their system duties are effort based.

As at September 28, 2026, Article 11 requires two things: designating the people who handle whistleblowing, and establishing the system and other measures needed to respond properly to internal reports. Article 11(1) requires a business operator to designate persons engaged in the work of receiving internal reports, investigating the reported facts and taking corrective measures. Article 11(2) requires the operator to establish a system, and take other necessary measures, to respond to internal reports appropriately.

The Guidelines turn those duties into specific measures. Part 3 requires designation in a way that makes the role clear to the person, such as in writing. Part 4 then lists the system measures:

• an internal contact point that receives reports across departments, with a named department and person responsible for investigation and correction
• independence from the head of the organization and other executives for cases that involve them
• investigation of reports unless there is just cause not to, correction of any violation found, and follow up to confirm the correction works
• exclusion of people involved in a case from handling it (conflict of interest)
• measures to prevent disadvantageous treatment, sharing of identifying information beyond the minimum necessary, and searching for the whistleblower, with disciplinary action where these occur
• education and dissemination for workers, officers and retirees, and a way to answer their questions
• notice to the whistleblower of corrective action or findings, record keeping, periodic evaluation of the system, disclosure of an outline of operating results, and internal rules covering all of the above

Designated persons carry a personal duty. Article 12 prohibits a current or former designated person from divulging, without just cause, information learned in that work that would identify the whistleblower. Under Article 21 of the Act as currently in force, breaching Article 12 is punishable by a fine of up to 300,000 yen.

Enforcement of the system duties is administrative. The CAA, exercising the Prime Minister's powers, may request reports and give advice, guidance or recommendations (Article 15), and may publish the name of an operator that ignores a recommendation (Article 16). Failing to report, or reporting falsely, carries a non-penal fine of up to 200,000 yen (Article 22).

The current Guidelines make education a required measure for everyone who can use the internal system, and a heightened requirement for designated persons. Part 4, section 3(1) states, in the unofficial English translation: "The enterprise must provide education and disseminate information about the Act and the system for dealing with internal whistleblowing disclosures to the enterprise's workers or corresponding persons, and officers and retirees. The enterprise must particularly provide a person engaged in the activity of dealing with whistleblowing disclosure with sufficient education on the handling of information that allows the identification of whistleblowers."

The Commentary explains what "education and dissemination" (kyōiku and shūchi) means in practice:

• Continuous, not formal. Contact points and reporting methods must be communicated sufficiently and continuously. Telling staff the content of the rules "for formality's sake" is not enough; the head of the organization should actively and repeatedly encourage use of the system.
• The whole system, not only the hotline number. Staff should learn that contact point staff are designated persons, that a report to a line manager can also be a whistleblowing disclosure, and that confidentiality rules differ between the two routes.
• The whole Act. Education on the Act should include the fact that reports to authorized administrative bodies are also protected.
• Tailored delivery. Suggested methods include job level training (kaisōbetsu kenshū), intranet pages, in house training, portable cards, posters, and an FAQ or guidebook with concrete examples of reportable matters.
• Executives. Organizational heads and executives should be taught where the system sits in internal control and how early risk information helps risk management.
• Retirees. One suggested method is telling staff while still employed that they can report after leaving.
• Group hotlines. Where a group wide hotline serves subsidiaries, it is desirable to educate all users of the system.

For designated persons, the Commentary expects education to be more effective than for ordinary staff, for example through regular sessions and tracking who has completed them. Content should cover the Article 12 confidentiality duty and practical skills for each stage: receiving reports, investigating and taking corrective measures. The Commentary adds that content may vary with how often a person actually handles reports.

The Act Partially Amending the Whistleblower Protection Act (Act No. 62 of 2025) takes effect on December 1, 2026. The CAA records that it was enacted on June 4, 2025, promulgated on June 11, 2025, and set to take effect on December 1, 2026 (CAA overview). The Cabinet Order fixing that date was promulgated on December 10, 2025 (CAA whistleblower protection system page). As at September 28, 2026, none of the changes below is yet in force.

The amending Act's supplementary provisions say that the criminal provisions do not reach acts committed before commencement. Training content that describes the new penalties should therefore date them clearly rather than present them as current law. The table is based on the CAA's amendment summary and the text of the amending Act.

The amended Guidelines split one education measure into two: awareness for everyone who can report, and education for designated persons. The CAA published the revision as Cabinet Office Notification No. 15 of March 31, 2026, applying from December 1, 2026 (amended Guidelines).

• Part 4, section 3(3): awareness (shūchi and keihatsu). Workers, officers, retirees, freelancers and former freelancers must be made aware of the Act and nine listed items: the contact point and how to reach it, independence measures, how reports are handled, conflict of interest exclusion, prevention of disadvantageous treatment, prevention of over sharing, obstruction and searching for whistleblowers, notice of outcomes, records and disclosure of results, and cooperation with investigations. The records and results item does not apply to retirees and former freelancers.
• Part 4, section 3(5): education for designated persons. Designated persons must receive particularly thorough education on the content of the response work and on handling information that identifies whistleblowers.
• Part 3: designation. The method of designation must make clear to the person that the role brings the Article 12 confidentiality duty and possible penalties under Article 22.

The amended Commentary adds comprehension tests (rikaido tesuto) to job level training as an example method, and adds screen savers on company PCs and videos made with external experts to the list of media. For freelancers, it suggests putting contact point details in contract documents or emails. It expects staff to be told that they must cooperate in good faith with investigations and must not obstruct them. For designated persons, it expects regular education, including at the time of designation.

The amended Guidelines also define disadvantageous treatment through four groups of examples: loss of status (such as dismissal or non-renewal of a fixed term contract), personnel treatment (such as demotion or unfavorable transfer), economic treatment (such as pay cuts or reduced freelance orders), and mental or daily life treatment such as de facto harassment. These examples give managers concrete scenarios to learn from, and they link naturally to training on power harassment prevention.

Each obligation has a different audience, so one annual module for all staff will not meet the Guidelines on its own. The mapping below is original and illustrative, not a CAA template. It follows the method in how to map training to compliance obligations, and each row could be an entry in a compliance obligations register.

A signed acknowledgement shows only that a person received the rules. Policy attestation explains why it should sit beside assessment rather than replace it, especially for the manager rows, where the risk is a wrong decision rather than a missing signature.

The Guidelines require periodic evaluation of the internal system, and the Commentary names the effect of dissemination and training as something to check. Suggested evaluation methods include an anonymous questionnaire on how well workers and officers know the system, discussion among designated persons about improvements, and review by internal audit or neutral external professionals of the system's operation, the effect of dissemination and training, and staff trust in the system.

In practice, that means keeping training data that can answer questions an evaluator or the CAA might ask:

1. Who is a designated person today, when each was designated, and when each last completed designated person training.
2. Which version of the internal rules and course content each worker, officer and freelancer received, kept as an audit trail.
3. Comprehension test results by audience, not only completion rates.
4. Awareness survey results over time, set against report volumes and the outline of operating results disclosed to staff.
5. A record of the content changes made for December 1, 2026, and the date each changed module went live.

The guide on preparing training records for an audit covers record structure, and updating training when a regulation changes covers the change process that the December 2026 commencement requires. Multinational groups can compare this regime with the EU Whistleblower Directive and Australia's whistleblower training expectations to build a shared core with a Japan specific insert.

Knowledge Foundry models Article 11, Article 12 and each measure in the Guidelines as an obligation linked to its audience, learning outcomes and assessment points before any compliance training content is written. Because the 2021 and 2026 versions of the Guidelines are held as dated obligations, the modules and assessments affected by the December 1, 2026 changes can be identified and reviewed rather than rebuilt.