Japan 2026 Act Partially Amending the Act on the Protection of Personal Information

The new exception permits third-party provision of personal data, and acquisition of publicly available sensitive information, without consent, provided the data is secured for use solely in creating statistical information — expressly including AI development that can be characterised as statistics creation. The accompanying controls are: publication of specified items (the name of the acquirer, or of the provider and recipient, and the content of the intended statistics creation); for third-party provision, a written agreement between provider and recipient that the provision is solely for statistics creation; and a prohibition on the acquirer and recipient using or re-providing the data for any other purpose. The precise scope and publication items are to be set by PPC rules.

Applies when

Chinese AI companies planning to share data with Japanese companies for model training or to receive data from Japanese partners for model development, and those acquiring publicly available sensitive information by scraping for training.

Deadline: Must be in place before the commencement date fixed by Cabinet Order; commencement in principle within two years of 17 July 2026

Evidence to retain

• · Published page stating the statistics-creation purpose, with archived copies
• · Written provider-recipient agreement limiting the provision to statistics creation
• · Technical and process controls preventing use or re-provision for other purposes
• · Description of the statistical processing pipeline with output samples
• · Internal legal assessment memo on the scope of the exception

Estimated first-time effort: 10–25 person-days (estimate, not a commitment)

Operators handling face-feature data must publicise specified items: the operator’s name, address and representative, the fact that face-feature data is handled, the purpose of use, the bodily characteristics the data derives from, and the procedure for responding to suspension requests. The grounds for an individual to demand suspension are relaxed so that no unlawful act need be shown, and providing face-feature data to third parties under the opt-out regime is prohibited. The method of publicity and the precise scope are to be set by cabinet order and PPC rules.

Applies when

Chinese companies selling or deploying facial recognition, identity verification, access control, retail footfall analytics or embodied-AI vision products in Japan, and Chinese vendors processing face-feature data for Japanese customers.

Evidence to retain

• · Text of the face-feature-data notice and record of where it is published
• · Register of face-feature data processing: source characteristics, purpose, retention period
• · Records of suspension requests received and executed
• · System configuration evidence blocking opt-out third-party provision

Estimated first-time effort: 10–25 person-days (estimate, not a commitment)

Where the individual is under 16, consent and notification must be directed to their legal representative, subject to exceptions (the operator has a legitimate reason for not knowing the individual is under 16; the representative has authorised the individual’s business and the data was acquired in connection with it; the individual has no legal representative). The grounds for that individual to demand suspension of use of retained personal data are relaxed, and a new duty requires operators handling minors’ personal information to give priority to the minor’s best interests according to age and stage of development and to endeavour to take the measures necessary to avoid harming their rights and interests.

Applies when

Chinese companies operating education, companion, gaming, social or consumer AI applications in Japan whose users may include people under 16.

Evidence to retain

• · Age-assurance mechanism and accuracy assessment records
• · Legal-representative consent workflow and records
• · Best-interests assessment documentation for minors
• · Description of feature restrictions and default settings applied to minors

Estimated first-time effort: 8–20 person-days (estimate, not a commitment)

The amendment imposes an express duty on contractors not to handle entrusted personal data beyond the scope necessary to perform the entrusted work, save where required by law or where urgently necessary for saving life, disaster relief or responding to an emergency. In parallel, where the entrustment contract agrees the entirety of the handling method and the measures enabling the entrusting operator to keep track of the contractor’s handling, that contractor is in principle exempted from the Chapter 4 obligations — but the no-excess-scope duty and the security control duty continue to apply.

Applies when

Chinese vendors providing data annotation, fine-tuning, inference hosting or support outsourcing to Japanese customers. Reusing a Japanese customer’s data to improve one’s own model is the paradigm case of excess-scope handling.

Evidence to retain

• · Entrustment contract fully specifying the handling method and the monitoring measures
• · Evidence of technical segregation between entrusted data and the vendor’s own data
• · Internal controls and access logs preventing own-purpose use
• · Records of any reliance on the emergency exception

Estimated first-time effort: 8–20 person-days (estimate, not a commitment)

Personally referable information containing descriptions that allow contact with a specific individual — location such as residence or workplace, telephone number, email address, Cookie ID and the like — becomes subject to the same prohibitions on improper use and improper acquisition as personal information, as do pseudonymously and anonymously processed information containing such descriptions. Acquiring such data by deception, or using it to facilitate unlawful acts, is therefore unlawful even where the data is not “personal information” in the holder’s hands.

Applies when

Chinese companies running advertising, lead generation, user identification, cross-device attribution or data trading that handle Cookie IDs, email addresses or device identifiers in Japan.

Evidence to retain

• · Lawfulness checks on the source of personally referable information
• · Supplier due diligence and contractual undertakings
• · Permitted-use and prohibited-use list including a ban on facilitating unlawful acts
• · Description of the acquisition method and the user-facing notice

Estimated first-time effort: 6–15 person-days (estimate, not a commitment)

Before providing personal data to a third party under the notified opt-out regime, the provider must first confirm the recipient’s identity (name, address and representative) and purpose of use. Making false statements about the matters confirmed is subject to a non-penal fine. Exceptions apply where, at the time of acquisition, the data had been made public by the individual, a national body or a local government.

Applies when

Businesses that supply personal data as lists or datasets in Japan. Chinese companies buying list data in Japan should require the supplier to evidence that this verification was performed.

Evidence to retain

• · Records confirming the recipient’s identity and purpose of use
• · Opt-out notification filing
• · Recipient due diligence and contract clauses
• · Evidence supporting reliance on the public-source exception

Estimated first-time effort: 3–8 person-days (estimate, not a commitment)

The surcharge is calculated on the financial benefit obtained from the violating conduct, and is limited by whether the operator failed to exercise due care. Companies should therefore build and retain evidence of due care — compliance reviews, source-of-data checks, internal approvals; maintain a dedicated register for processing touching Arts. 19, 20(1) and 27(1) and the statistics exception; and be able to separate revenue related to the conduct from unrelated revenue in an investigation. The official outline uses a benchmark of 1,000 data subjects for the large-scale condition.

Applies when

Chinese AI companies processing personal information at scale in Japan whose business model is directly tied to that processing — advertising, recommendation, data services, model training.

Evidence to retain

• · Due-care evidence pack: reviews, approvals, training
• · Dedicated register of high-risk processing activities
• · Revenue attribution methodology and working papers for the processing concerned
• · Records of suspension and remediation once an issue is found

Estimated first-time effort: 8–20 person-days (estimate, not a commitment)