Japan. Comprehensive data protection. Act (amendment)

APPI Amendment 2026Act Partially Amending the Act on the Protection of Personal Information (Act No. 56 of 2026)

Enacted – not yet in force

§1Summary

Synopsis

Output of the PPC triennial review: adds an administrative surcharge system, rules for children under 16, new biometric data rules and stronger PPC powers. It also creates a consent exception for third-party provision solely for statistics creation (including AI training) and lets low-risk breaches skip individual notice.

Key themes

administrative surcharges
children under 16
biometrics
AI training / statistics exception
breach notice relief
criminal penalties

Unique features

Surcharge pegged to consideration received from violations affecting over 1,000 people; best-interests-of-the-child duty.

SaaS relevance

SaaS selling data-driven services in Japan face surcharges once commenced and new duties if users include under-16s; AI training data sharing gets a legal pathway.

§2Obligations

Extraterritorial: Yes
Maximum penalty: Surcharge calculated from consideration received (method set by Cabinet Order); higher corporate criminal fines

§3Dates

Key dates

Adopted 10 July 2026
In force 17 January 2027
Cabinet bill 2026-04-07; passed Diet 2026-07-10; promulgated 2026-07-17; criminal provisions 2027-01-17; main reforms by Cabinet Order no later than 2028-07-17

§4Text and authority

Text

Authoritative text ppc.go.jp

Authority

Personal Information Protection Commission (PPC)

§5Where it applies

Domestic law of: Japan

§6Sources and verification

Verification

High confidence.

date_in_force shows first phase only (criminal provisions). [Link: official Japanese amending Act text on PPC (landing: ppc.go.jp/personalinfo/legal/r8kaiseihogohou/); no English yet]