PPC Publishes Information on the Reiwa 8 Amended Personal Information Protection Act

The Act on the Protection of Personal Information (APPI) contains a review clause, added by the 2020 amendment, under which the government examines the Act every three years in light of international trends and technological change. The Personal Information Protection Commission (PPC) began this review in 2023, held hearings with business and consumer groups and experts, published an interim summary for public comment in June 2024, and announced its policy for the legislative changes on 9 January 2026.

The House of Councillors' summary of the bill lists the main changes. Personal information may be provided without the individual's consent to a third party that prepares statistics and similar outputs, where the content of that statistics preparation has been made public; the PPC's later materials explain that this 'statistics preparation' can include AI development and that publicly available sensitive personal information may also be acquired for it. Rules are added on notifying the legal representative when handling personal information of persons under 16. Individuals may request that use of 'specified biometric personal information' (information containing features of parts of the body, such as facial feature data) be stopped even when it has not been handled unlawfully.

The bill also prohibits inappropriate use and improper acquisition of 'contactable personal-related information' (information such as phone numbers, addresses, email addresses or cookie IDs that can be used to contact a specific individual), creates an administrative surcharge that the PPC may order a business to pay where it obtained a financial gain through unlawful handling of personal information, and raises the statutory penalties for unlawfully providing personal information databases. Parallel changes on notifying the legal representatives of persons under 16 are made to the My Number Act and to the act on anonymised and pseudonymised medical information.

Sources: [3] [6] [7]

The Cabinet decided on the bill and submitted it to the Diet on 7 April 2026. In the House of Representatives it was examined by a special committee on regional revitalisation, children's policy and the digital society, which attached a supplementary resolution, and the House passed it on 26 May 2026. In the House of Councillors it was examined by the special committee on the digital society and the use of artificial intelligence and passed on 10 July 2026, which enacted it. It was promulgated on 17 July 2026 as Act No. 56 of 2026.

The supplementary resolution asks the government, among other things, to hear stakeholders before making Commission rules, to keep the system consistent with foreign regimes such as the EU General Data Protection Regulation, and to avoid unduly discouraging research and development, including AI development; such resolutions are not legally binding. After promulgation the PPC adopted a roadmap (31 July 2026) and an overview of the matters to be set by Cabinet Order, Commission rules and guidelines (26 August 2026). On 9 September 2026 it decided how the rules will be prepared: it presents a 'basic approach' theme by theme, holds exchanges of views with groups representing individuals and businesses and secretariat hearings, then presents the specific content and draft texts, and then runs a public comment procedure.

The PPC has since presented three sets of basic approaches. On 16 September 2026 it covered handling that is clearly not contrary to the individual's will in view of how the data was obtained (for example, data passed between a hotel booking site and a hotel), children's personal information and facial feature data. On 1 October 2026 it covered the statistics exception (including AI development), proper handling by service providers to whom data is entrusted, and data breach reporting and notification. On 14 October 2026 it covered contactable personal-related information, a strengthened opt-out system, and the administrative surcharge.

1. 2026-04-07 — Cabinet decision and submission to the Diet [1] [2]
2. 2026-05-26 — Passed by the House of Representatives [2]
3. 2026-07-10 — Passed by the House of Councillors; enacted [1] [2]
4. 2026-07-17 — Promulgated as Act No. 56 of 2026 [1] [2]
5. 2026-09-09 — PPC decides the process for preparing the Cabinet Order, rules and guidelines [7]
6. 2026-10-14 — PPC presents its third set of basic approaches (surcharge, opt-out, contact information) [7]
7. 2027-01-17 — First amendments take effect (per e-Gov Law Search) [5]

The timeline of related official records below lists the records this dashboard has matched.

Sources: [1] [2] [4] [7]

Confirmed next steps

• 2027-01-17 — e-Gov Law Search lists amendments to the Act taking effect on 17 January 2027; the PPC roadmap states that the provisions digitalising service of documents by public notice take effect six months after promulgation. [4] [5]
• Under the process the PPC decided on 9 September 2026, the specific content and draft texts of the Cabinet Order and Commission rules will be presented to the Commission after stakeholder exchanges and hearings, and will then be put to public comment; guidelines and Q&A are to follow theme by theme. [7]

Expected procedural steps

The usual procedure for this kind of instrument; not a forecast for this reform.

• Draft Cabinet Orders and Commission rules are normally published on e-Gov for a public comment period, usually of at least 30 days, before adoption.

Outstanding uncertainties

• The date on which the main provisions take effect has not been set; under the Act it can be no later than two years after promulgation (July 2028).
• The PPC's basic approaches are discussion materials, not final rules. The final content of the Cabinet Order, Commission rules and guidelines, including how the surcharge is calculated and what qualifies for the statistics exception, had not been decided when this explainer was verified.

Businesses that handle personal information in Japan may be affected in several ways once the main provisions take effect. Sharing data for statistics or AI development may become possible without consent if the statutory conditions, including publication, are met; certain transfers that are clearly consistent with how data was obtained may also no longer need consent. Services used by minors, facial or other biometric data processing, outsourcing arrangements, breach response and the use of contact identifiers such as cookie IDs may need review against the new rules.

The new administrative surcharge adds a financial consequence for unlawful handling that produced a gain, alongside higher criminal penalties for unlawfully providing databases. The precise obligations depend on the Cabinet Order, Commission rules and guidelines, which are still being prepared and will be put to public comment.

Points to check

• Identify processing that relies on consent and could fall within the statistics or 'clearly not contrary to the individual's will' exceptions, and what would have to be published.
• Identify services or data sets involving persons under 16 and processes for notifying legal representatives.
• Inventory facial or other biometric processing and how a request to stop use would be handled.
• Review outsourcing contracts, breach response procedures and the acquisition and use of contact identifiers.
• Follow the PPC's basic approaches and the forthcoming draft Cabinet Order, rules and guidelines, including public comment periods.

Sources: [3] [4] [7]