Japan: compliance overview
3 regulations, 17 mapped obligations and 1 data-transfer routes, organised by when they start to bind you and what you have to do.
Regulatory timeline: what comes next
2025-06-04
Act promulgated and, on the same day, in force (Act No. 53 of 2025)
Japan AI Promotion Act2025-09-01
Chapter 3 (AI Basic Plan) and Chapter 4 (AI Strategy Headquarters) commence
Japan AI Promotion Act2025-12-23
Cabinet adopts the AI Basic Plan (“Japan’s revival through trustworthy AI”)
Japan AI Promotion Act2026-04-07
The bill is approved by Cabinet and submitted to the 221st (special) session of the Diet
Japan 2026 Act Partially Amending the Act on the Protection of Personal Information2026-07-10
The bill is passed by the Diet
Japan 2026 Act Partially Amending the Act on the Protection of Personal Information2026-07-17
The Act Partially Amending the APPI etc. is promulgated, starting the transition period
Japan Act on the Protection of Personal Information (APPI)2026-07-17
The amending Act is promulgated; commencement in principle within two years of promulgation
Japan 2026 Act Partially Amending the Act on the Protection of Personal Information2026-07-31
PPC adopts its post-enactment work programme including the implementation roadmap
Japan 2026 Act Partially Amending the Act on the Protection of Personal Information2026-09-09
PPC decides the process for developing cabinet orders, rules and guidelines (multi-stakeholder engagement)
Japan 2026 Act Partially Amending the Act on the Protection of Personal Information
Applicable regulations (3)
Japan Act on the Protection of Personal Information (APPI)
A Chinese AI company falls within the APPI where it: (1) supplies products or services to users in Japan through app stores, websites or APIs and thereby handles their account, conversation, location, image or voice data — Article 171 applies even if all servers sit outside Japan; (2) incorporates or employs staff in Japan; (3) takes on data annotation, fine-tuning or operations outsourcing from a Japanese customer and becomes its contractor within the Article 25 supervision chain; or (4) routes Japanese customer data back to China, triggering the consent and information-provision duties of Article 28 for provision to a third party in a foreign country.
7 obligations · reviewed 2026-09-12
Japan 2026 Act Partially Amending the Act on the Protection of Personal Information
Four points matter most to Chinese AI companies. First, the statistics-creation exception expressly covers AI development that can be characterised as statistics creation, making data sharing between Japanese companies for model training possible — but subject to publication, a written provider-recipient agreement and a prohibition on use beyond that purpose, with breaches listed as surcharge-eligible conduct. Second, the mandatory publicity duty for face-feature data and the ban on providing it to third parties under the opt-out regime directly affect how facial recognition, access control and retail footfall products are deployed in Japan. Third, consent and notification for individuals under 16 must run through the legal representative, with a new duty to give priority to the individual’s best interests, affecting AI products aimed at young people. Fourth, contractors are expressly barred from handling entrusted personal data beyond what the entrusted work requires — a Chinese vendor that retains data for its own use while annotating or running inference for a Japanese customer would be in direct breach.
7 obligations · reviewed 2026-09-12
Japan AI Promotion Act
The Act imposes no directly enforceable administrative duty on Chinese AI companies. Its practical significance is threefold: (1) the Art. 2 statutory definition of “AI-related technologies” — technologies needed to realise, by artificial means, functions substituting for human cognitive, reasoning and judgement capabilities, and technologies relating to information-processing systems that process input using them and output results — becomes the shared terminology for Japanese policy and contract drafting; (2) the Art. 7 responsibility of utilisation businesses means companies operating in Japan are expected to cooperate with government measures, in practice by responding to surveys, participating in guideline development and supplying information; and (3) the Art. 13 guidelines and the Art. 18 Basic Plan set out Japan’s stated expectations for AI governance, which public procurement and large-enterprise due diligence will probe. Any claim that Japan already has “AI Act penalties” or “high-risk AI obligations” is factually wrong.
3 obligations · reviewed 2026-09-12
Data transfer routes
Japan APPI restriction on providing personal data to third parties in foreign countries (Art. 28)
No volume threshold - any provision of personal data to a third party in a foreign country is caught, and under Japanese law "provision" includes making the data accessible to the foreign third party, while a separate legal entity in the same group is still a third party. There are three alternative routes: (1) the whitelist - where the destination is prescribed by PPC Rules as having a system with standards equivalent to Japan’s, the restriction does not apply. This pass did not verify the current list of whitelisted countries from an official source; check the PPC Rules text before relying on it. (2) The system route - the recipient has established a system conforming to the PPC Rules standards for continuously taking equivalent measures, implemented in practice through contract or intra-group rules; no separate cross-border consent is then needed, but the Art. 28(3) duties to ensure continued implementation and to provide information on request apply. (3) The consent route - obtain the individual’s prior consent to provision to a foreign third party, having first supplied the reference information required by Art. 28(2). The commonest error made by Chinese companies is conflating Arts. 27 and 28: where data is provided under Art. 28(1), Art. 27 does not apply, but the record-keeping duty in Art. 29 still applies subject to its provisos.
Lead time: Estimate: 3-6 weeks for the system route (contract plus the continuing-assurance mechanism); 2-4 weeks for the consent route including drafting the notice and reworking the consent flow. · Cost band Medium
What you can use right now
What has actually happened here
Sources (7)
- Act on the Protection of Personal Information (Act No. 57 of 2003), Japan — consolidated text via e-Gov Law APIe-Gov Law Search, Digital Agency of Japan · published 2003-05-30 · retrieved 2026-09-12
- Personal Information Protection Commission (Japan) — English legal texts indexPersonal Information Protection Commission, Japan · retrieved 2026-09-12
- PPC (Japan) — Outline of the Act Partially Amending the Act on the Protection of Personal Information etc. (PDF)Secretariat, Personal Information Protection Commission, Japan · published 2026-07-17 · retrieved 2026-09-12
- PPC (Japan) — 2026 (Reiwa 8) amendment to the Act on the Protection of Personal Information, official pagePersonal Information Protection Commission, Japan · published 2026-07-17 · retrieved 2026-09-12
- Act on Promotion of Research, Development and Utilisation of AI-Related Technologies (Act No. 53 of 2025), Japan — text via e-Gov Law APIe-Gov Law Search, Digital Agency of Japan · published 2025-06-04 · retrieved 2026-09-12
- e-Gov Law Search entry for the Japanese AI Promotion Act (Act No. 53 of 2025)e-Gov Law Search, Digital Agency of Japan · published 2025-06-04 · retrieved 2026-09-12
- Cabinet Order on the AI Strategy Headquarters (Cabinet Order No. 281 of 2025), Japan — text via e-Gov Law APIe-Gov Law Search, Digital Agency of Japan · published 2025-08-01 · retrieved 2026-09-12
Content as of 2026-09-12 · corpus 2026.09|Compiled from public official sources with links and review dates for compliance decision support. Rules change; have licensed professionals review before external disclosure, regulatory filing or contractual commitments.