Amendments to the Act on the Protection of Personal Information promulgated

The amendments apply to all personal information handling business operators subject to the APPI, including both Japanese companies and foreign companies that handle information relating to individuals in Japan in connection with the provision of goods or services to persons in Japan.

The reforms follow the Personal Information Protection Commission’s (PPC) triennial review policy direction published in January 2026 and address two broad themes: facilitating data utilization (particularly for statistical analysis and AI development) and strengthening enforcement.

Administrative surcharge regime

The Act introduces an administrative surcharge regime. The PPC previously had no power to impose monetary sanctions directly; criminal penalties applied only where a company continued to breach after receiving a PPC order. Under the new Article 148-3, the PPC may order a surcharge where five conditions are satisfied:

• The conduct falls within a specified category of violation (broadly, certain improper use or provision of personal information, breach of the third-party provision restrictions under Article 27(1), breach of the new statistical-creation regulations under Articles 30-2 and 31-3, or improper acquisition under Article 20(1)).
• The company received money or other consideration for the violating conduct or for ceasing that conduct.
• It failed to exercise reasonable care to prevent the violation.
• The harm to data subjects' rights and interests is significant.
• More than 1,000 individuals are affected.

The surcharge amount corresponds to the money or other consideration received; the precise calculation methodology will be set by Cabinet Order. The scope of the “reasonable care” condition is not yet settled and clarification is expected through PPC guidelines, though a failure to maintain an adequate compliance system may be treated as a relevant factor.

Criminal penalties for the unlawful provision of personal information databases are also increased, with heavier corporate fines and an extension of the offense to cover provision for the purpose of causing harm. The PPC's supervisory powers (reporting, on-site inspections, corrective orders) are restructured and expanded.

Two new category-specific regimes are also established. The APPI previously contained no child-specific provisions, and PPC guidelines offered only limited guidance. Under the amended Act, where consent or notification is needed, it must in principle be obtained from or given to the legal representative of an individual under 16 (Article 40-2). Minors may exercise suspension, erasure and cessation rights without the usual preconditions such as a prior APPI violation (Article 35(9)), and both companies and legal representatives must give primary consideration to the best interests of the child (Article 58-3).

A new category of “specified biometric personal information” covers biometric identifiers derived from physical characteristics obtainable without special technology or significant cost, where collection may not be readily noticeable to the individual (Article 16(5)). Operators must notify individuals in advance of specified matters including the purpose of use and the nature of the biometric characteristic (Article 21-2(1)). Individuals may request suspension of use even absent unlawful processing (Article 35(7)), and provision under the opt-out mechanism is prohibited (Article 27(2)).

Data utilization

Under the existing APPI framework, consent is not generally required for the collection and use of personal information, provided the operator specifies and notifies the individual of its purpose of use. However, consent is required for specific processing activities, including the acquisition of sensitive personal information, the provision of personal data to third parties, cross-border data transfers, and changes to the stated purpose of use. The amendments broaden the exceptions to these consent requirements, including where processing is clearly necessary for contractual performance or where the circumstances make clear it is not contrary to the individual's intentions.

A new exception permits the provision of personal information to third parties solely for “statistical creation,” a defined term covering the production of statistical or analytical outputs (including use of data as AI training data) from large datasets, where the risk to individuals is low and the activity is specified by PPC rules. This exception is subject to transparency and publication requirements; recipients may use the data only within the disclosed scope and onward disclosure is prohibited, with violations attracting surcharges.

The Act also creates a new term, “contactable personal related information,” covering contact identifiers such as addresses, phone numbers, email addresses, and telecommunication identifiers; misuse and improper acquisition of this category is prohibited (Article 31-2). Separately, businesses providing personal data under the opt-out mechanism must now verify the recipient's identity and purpose of use before doing so (Article 27(7)). Breach notification requirements are revised, with a potential exemption from direct individual notification where PPC rules designate the breach as low-risk, provided alternative protective measures are taken. Corresponding changes are made to the My Number Act and the Act on Anonymized Medical Data.

Commencement and enforcement

The Act enters into force in stages: strengthened criminal penalties and new offences relating to improper acquisition commence on January 17, 2027 (six months after promulgation), while the main body of the reforms (including the surcharge regime, consent exceptions, biometric and children's provisions, and revised PPC powers) will take effect on a date to be set by Cabinet Order, no later than July 17, 2028.

The APPI does not have a “legitimate interests” basis equivalent to GDPR Article 6(1)(f) for third-party provision of personal data, and compliance with the GDPR alone will not satisfy APPI requirements in a number of areas. Organizations with operations or data flows touching Japan should review their practices ahead of these commencement dates.

Further reading

• The promulgated Act (in Japanese)
• The PPC's triennial review policy direction (English outline)