Japan's main privacy law, the Act on the Protection of Personal Information (APPI), has been amended again, following the review the law requires every three years. The Diet passed the amendment on July 10, 2026, and it was promulgated on July 17. It does two things at once: it makes it easier to use personal data, particularly for statistics and AI development, and it gives the regulator, the Personal Information Protection Commission (PPC), stronger tools, including Japan's first administrative fines for privacy violations.
This explainer covers what changes, when, and what it means for companies, including foreign ones that serve people in Japan.
Key takeaways
- Fines: for the first time, the PPC can order businesses to pay administrative fines equal to the money they made from certain serious violations, such as selling data to people likely to misuse it, where more than 1,000 people are affected. Breaches caused by attackers are not the target.
- AI and statistics: personal data can be shared, and publicly available sensitive data collected, without consent when it is used only to produce statistics, including AI development that fits that description, under strict conditions.
- Children: for under-16s, companies must involve parents or guardians in consent and notices, and children's data becomes easier to have deleted.
- Face data: companies using facial recognition data must publish details of what they do with it, and cannot share it under Japan's opt-out system.
- Contractors: companies that process data on someone else's behalf must not use it beyond the task.
- New crime: obtaining personal information through deception, theft or unauthorized access becomes a separate offense, from January 17, 2027.
- Not included: a proposal to let consumer organizations sue on behalf of people affected by privacy violations was dropped for now.
- Most changes take effect within two years, around July 2028. The PPC is now writing the detailed rules.
When it takes effect#
| Date | What happens |
|---|---|
| Apr 7, 2026 | Cabinet approves the bill |
| Jul 10, 2026 | Diet passes the amendment |
| Jul 17, 2026 | Promulgated |
| From Aug 2026 | PPC drafts cabinet orders, rules, guidelines and Q&A, with public consultations |
| Jan 17, 2027 | Criminal penalties change, including the new offense of obtaining personal information unlawfully |
| By Jul 2028 | Everything else, on a date set by cabinet order. The PPC's roadmap points to around July 2028 |
Many details, such as exactly which uses count as "statistics" or how fines are calculated, are left to PPC rules and cabinet orders that are still being written. The PPC has published an overview of what those rules must cover and is holding hearings with businesses and consumer groups.
Easier data use#
Statistics and AI development#
Under the current law, sharing personal data with another company, or collecting sensitive personal information (要配慮個人情報) such as health or criminal records, generally needs the person's consent. The amendment removes that requirement when the data is used only to create statistical information, which the PPC says includes AI development that can be framed that way.
The conditions are strict. The companies involved must publish who is sharing or collecting the data and what statistics they are producing, sign a written agreement that the data is only for that purpose, and must not use or pass it on for anything else. Breaking those conditions is one of the violations that can lead to a fine.
Sharing that people would expect#
Consent will also not be needed where, given how the data was collected, sharing it clearly does not go against the person's wishes. The PPC's examples are a hotel booking site passing a guest's name to the hotel, and a bank passing a sender's details to the receiving bank for an international transfer.
Health and research#
Two exceptions are widened. Data can be used without consent to protect life or for public health not only when consent is "difficult to obtain", but also when there are other reasonable grounds, such as a confidentiality agreement. And hospitals and clinics are explicitly counted as "academic research institutions", so they can rely on the research exception for clinical studies.
Stronger protection#
Children under 16#
Japan's law has had no specific rules for children; guidance only said that young children's parents should give consent. The amendment sets an age: for anyone under 16, consent and notices must involve a legal representative, usually a parent. Children's data also becomes easier to have stopped or deleted, without having to show that the company broke the law. And businesses must give priority to the best interests of minors.
Face recognition data#
Face feature data, the measurements used by facial recognition systems, is singled out because it can be collected without people noticing and identifies them for life. Companies that handle it must make public their name and address, that they use face data, what for, what it was taken from, and how to ask them to stop. People can ask them to stop without proving a violation, and face data can no longer be passed to third parties under the opt-out system, which otherwise allows sharing without consent if people are told and can object.
Contractors#
Companies increasingly hand personal data to contractors, from cloud services to call centers. The amendment makes it an explicit duty for contractors not to use the data beyond the task they were given. At the same time, a contractor that only processes data exactly as instructed can be largely exempted from the law's other duties, if its contract fixes how the data is handled and requires it, among other things, to report breaches to the client promptly. Its security duties still apply.
Breach reporting#
The amendment also adjusts how breaches are reported and how people are told. We cover those changes, and the current rules, in our explainer on breach notification.
Tackling misuse#
Contact details that are not "personal information"#
An email address, phone number or cookie ID on its own may not count as personal information under Japanese law. But it can still be used to reach someone, for example with a phishing email or an investment scam ad. The amendment bans improper use and improper acquisition of such contactable information, as it already does for personal information.
List brokers#
Japan's opt-out system lets registered businesses sell lists of personal data without consent. Some lists have ended up with criminal groups. Brokers using the system must now check the identity and purpose of every buyer, and lying in that check is punishable by a fine.
Enforcement: orders, crimes and fines#
Faster, broader orders#
The PPC can issue an emergency order without first giving a recommendation not only when serious harm has already happened, but also when it is imminent. Its orders can require a company to notify or tell the public about a violation, not just stop it. And it gets a legal basis to ask third parties, such as cloud, hosting or search providers, to help stop a violation, for example by suspending service, with protection from the violator's claims for damages if they do.
Criminal penalties#
From January 17, 2027, penalties go up, and a new offense is added:
| Offense | Now | From Jan 17, 2027 |
|---|---|---|
| Employee or ex-employee leaking a company's personal database for gain | Up to 1 year or ¥500,000 | Up to 2 years or ¥1 million. Leaking to cause harm is also covered. Companies can still be fined up to ¥100 million |
| Public official leaking a file of personal secrets | Up to 2 years or ¥1 million | Up to 3 years or ¥1.5 million |
| Obtaining personal information by deception, violence, threats, theft, trespass, wiretapping, unauthorized access or other acts that undermine the holder's control, for gain or to cause harm | No specific offense | New: up to 2 years or ¥1 million |
Administrative fines#
The biggest change is the administrative fine (課徴金). Until now, a company that broke the law could stop when ordered and keep whatever it had earned. Now the PPC must order it to pay an amount equal to the money it received, when:
- it provided personal data to a third party likely to use it illegally or for unfair discrimination, or used data at such a party's request;
- it shared personal data without consent in breach of the law;
- it broke the conditions of the new statistics exception; or
- it obtained personal information improperly and then used it;
and it was paid for doing so. There are limits. No fine is imposed if 1,000 people or fewer are affected, or if the harm is otherwise small, as set by cabinet order, or if the company had taken due care throughout. The fine rises to 1.5 times for a repeat offense within ten years, and is halved for a company that reports the violation itself before an investigation begins.
Who it applies to#
The APPI applies to any business that handles personal information in Japan, and also to foreign businesses that handle the personal information of people in Japan in connection with supplying them goods or services. A foreign app, online store or AI developer serving Japanese users is covered, including by the new rules on children, face data and fines.
Our analysis#
More data use, paired with sharper teeth#
The amendment is a trade. Business groups and the government wanted data, especially for AI, to flow more easily, and the statistics exception gives them that. In return, the PPC gets the fines and faster orders it lacked. Whether the balance holds will depend on rules not yet written: how narrowly "statistics" is defined, and how the PPC uses its new powers.
Fines aimed at misuse, not at breaches#
In our reading, the fines are aimed at companies that profit from misusing data, such as list brokers and businesses that sell or share data they should not. They do not cover companies whose data is stolen in an attack. For this autumn's wave of breaches, the consequences for the breached companies remain the PPC's guidance and orders, and claims from the people affected. The new crime of obtaining personal information through unauthorized access points the other way: at the attackers, giving prosecutors a privacy-specific offense alongside the Unauthorized Access Act.
What it leaves out: group lawsuits#
The amendment also shows what Japan decided not to do. In its review, the PPC had proposed letting qualified consumer organizations, groups already authorized to bring certain consumer cases, seek injunctions and compensation on behalf of people whose data was mishandled. In its policy of January 2026, it dropped the idea for this amendment, citing the need for cooperation among the parties involved and questions about how such a system would fit a privacy law. It said instead that it wants consumer groups to act as a channel for people's concerns, and that it will improve its own consultation line.
The Times Car breach shows what that leaves. After the theft of data on 6.6 million accounts, a lawyer opened a website to gather plaintiffs for a lawsuit against the company, and about 64,000 people had registered by October 7, according to TBS. Registration only signals interest, and no lawsuit had been filed as of mid-October. In our view, this is how compensation for a mass breach works in Japan for now: people who want it must find a lawyer and join a suit themselves, and the regulator's new fines go to the state, not to them. A group action system would not have prevented the breach, but it would give the millions of people affected a way to seek redress without each having to act alone.
Contractors move to the center#
Many of this year's largest breaches, from the i-ask FAQ system to the email services on IDCF Cloud, happened at contractors. The amendment does not make clients any less responsible for their contractors. But it does write into law that contractors must stay within their task, and it ties the lighter regime for pure processors to a contractual duty to report breaches promptly to the client. In our view, that makes the contract the place where much of Japan's data protection will now be decided.
What this means for readers#
- If you run a business that serves people in Japan, from abroad or locally, start mapping where you handle children's data, face data, data you share with partners, and data you give to contractors. The rules take effect around mid-2028, but contracts and systems take time to change.
- If you develop AI with Japanese data, watch the PPC's draft rules on the statistics exception. They will decide what you can use without consent and what you must publish.
- If you are a contractor or cloud provider to Japanese companies, expect contracts to spell out how you handle data and require prompt breach reports, if they do not already.
- If you are a person in Japan, the changes give you new rights over your children's data and your face data, and make it a crime to obtain your information through hacking or deception.
Japanese terms at a glance#
| Japanese | Reading | Meaning |
|---|---|---|
| 個人情報保護法 | Kojin Jōhō Hogo Hō | Act on the Protection of Personal Information (APPI) |
| 改正法 | kaisei hō | Amendment, amended law |
| 課徴金 | kachōkin | Administrative fine |
| 統計情報等の作成 | tōkei jōhō-tō no sakusei | Creating statistical information (the new exception) |
| 顔特徴データ | kao tokuchō dēta | Face feature data |
| 法定代理人 | hōtei dairinin | Legal representative, such as a parent |
| 委託先 | itakusaki | Contractor |
| オプトアウト | oputo auto | Opt-out (sharing without consent if people can object) |
| 3年ごと見直し | sannen-goto minaoshi | The review of the law required every three years |