--- title: "Japan Data Protection & Privacy Regulation | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/japan-data-protection-privacy-regulation/ source_html: /jurisdictions/japan/index.html description: "Japan data protection and privacy regulation: 10 categories, 124 claims, updated 2026-11-04. Lawful processing, data subject rights, cross-border transfer…" generated_at: 2026-11-07T14:58:19Z content_sha256: 540a84cad3ecac82b2a7e7d91878d95052e9b43017be66f776def46ef1c75d7d generator: "fe-fleet/md-twin@1.0" --- # Japan Data Protection & Privacy Regulation | Data Protection Monitor Not every instrument is backed by its official text yet. At least one law or rulebook covered here has no official source (tier 1) retrieved for it yet. No finding on this page is shown with confidence above “Probable” until stronger sources are retrieved. # Japan Data Protection & Privacy Regulation schema gdpri-v2 trajectory: not yet assessed regulated (omnibus) overlaps: [Sentinel (AML/CFT)](https://sentinel.gi/jurisdictions/japan/), [World Payments](https://payments.gi/jurisdictions/japan/), artificial-intelligence Last updated 2026-11-04 · 10 categories · 124 claims · 82 sources in the cumulative register Download report (PDF) Expand all Japan's APPI amendment bill has passed a decisive milestone this cycle. Data collected 2026-11-02 · Data published 2026-11-04 AI-assembled from cited sources Not fully checked this cycle: Regulator & Framework, Data Subject Rights, Children & Vulnerable Groups (3 open gaps). Evidence re-verified: 2026-11-04 · Position last changed: 2026-11-04 · Record history & provenance ▾ Methodology & record provenance: Module confidence is derived from the underlying claims (source tier and primary excerpt retention), while statutory legal force is tracked independently. Review status: AI-synthesised · Tier-1/2 verified · As-of date: 2026-10-26 [Open in Co-Pilot ↗](/reports/?type=copilot&j=JAPAN)[Build Report](/reports/?j=JAPAN)[Compare](/compare/?j=JAPAN) Framework posture Regulated (omnibus) 10 of 10 modules populated · AI-synthesised · Tier-1/2 verified Lead supervisory authority Personal Information Protection Commission (PPC) Primary statutory & supervisory perimeter Next milestone (> 2026-10-26) None scheduled No dated future statutory milestone on record Module coverage & confidence 10 / 10 modules assessed 0 Confirmed · 10 Probable · 0 Uncertain 10 Categories 1 Red categories 57 Sub-modules 124 Claims 6 Tier-1 sources Traffic-light mix 3 green 6 amber 1 red (sums to 10 rendered categories; click to filter) 1 category flagged red ## Jurisdiction brief Jurisdiction lead brief 1,406 Full executive summary 755 ###### Latest update · 25 October 2026 #### Lead Signal Japan's data-protection regime is shaped principally by the continuing implementation picture of Act No. 56 of 2026, a substantial amendment to the Act on the Protection of Personal Information passed 10 July 2026 and promulgated 17 July 2026, whose main body is understood to enter into force on a date fixed by Cabinet order within two years of promulgation, placing commencement at approximately mid-2028. The amendment is reported to be the most significant expansion of the Personal Information Protection Commission's enforcement power since the APPI's enactment: it grants the PPC, for the first time, the power to order an administrative surcharge equal to the financial gain derived from certain serious APPI violations affecting more than 1,000 individuals, excluding breaches caused by external attackers, and it separately relaxes the threshold for the PPC to issue a standard order by removing the requirement that harm be "imminent" under amended Article 148(2), while introducing a new emergency-order power where the PPC recognises a risk of infringement to significant rights or interests. Alongside this enacted-but-not-yet-effective legislative change, the PPC is understood to have acted in the present tense: on 7 October 2026 it published a formal alert titled "Response to Large-Scale Leakage Incidents," addressed to personal-information-handling business operators following a cluster of unauthorised-access breaches at widely-used consumer services. The alert urges operators to review safety-management measures and to delete personal data no longer needed, and is understood to pre-empt a forthcoming revision to the PPC's Guidelines. This is a Confirmed, primary-sourced development, distinguishing it from the surrounding body of enacted-but-not-yet-effective statutory change: the PPC is not waiting for Act No. 56/2026 to commence before raising its expectations of controllers' security-measure practice. #### Other Developments New statutory bases touching consent and data-sharing for statistical and AI-development purposes. Act No. 56/2026 introduces a consent exemption permitting the sharing of personal information for statistical analysis purposes, including AI-development data-sharing, limited to recipients handling personal information or administrative organs, with PPC-regulation-compliant safeguards required for foreign recipients. This provision is enacted but not yet effective. Relaxed consent requirements tied to contract performance. Revised Article 20(2)(vii) and Article 27(1)(viii) relax consent requirements for processing that is clearly necessary and unavoidable for contract performance, with the PPC expected to specify further qualifying cases by regulation once the provision commences; not yet in force. New biometric-data transparency and deletion rights. Act No. 56/2026 subjects biometric data used for identification purposes to heightened transparency requirements and an expanded deletion-request right, and prohibits third-party provision of such data via the opt-out mechanism; not yet in force. First statutory provisions on minors' personal data. For the first time, Act No. 56/2026 introduces statutory provisions addressing the treatment of minors' personal data and defines a relevant age threshold, an area the PPC had previously addressed only through non-binding Q&A guidance treating children aged 12-15 or younger as generally lacking decision-making capacity on a case-by-case basis; the statutory provision is not yet in force. A risk-based exemption from individual breach notification. Act No. 56/2026 revises Article 26(2) to exempt businesses from directly notifying affected individuals of a breach where PPC regulations designate the breach as low-risk, provided alternative protective measures are taken; commencement for this and related provisions is reported variously, with some provisions reported as early as January 2027 and the main body expected around 2028, a discrepancy not resolved against a primary cabinet-order source. #### Cross-Monitor Connections The PPC's expanded administrative-surcharge and relaxed order-issuance powers, together with its direct breach alert of 7 October 2026, are relevant to financial-integrity monitoring insofar as personal-data security failures at consumer-facing services can intersect with financial-sector customer data handling, though this brief addresses the development from the data-protection regulator's own enforcement-architecture perspective rather than re-analysing any financial-sector-specific angle, which remains financial-integrity's own domain. No world-payments-specific or crypto-specific cross-reference arises from the data-protection findings. #### Outlook The precise cabinet-order commencement date for Act No. 56/2026's administrative-surcharge and related enforcement provisions remains unresolved against a primary source, with reporting diverging between an early-2027 commencement for some provisions and a main-body commencement around mid-2028; clarification of this timeline is the single clearest open item for the enforcement-and-redress picture. Separately, it is not yet established whether the PPC's 7 October 2026 breach alert maps to a specific draft Guidelines revision, nor when such a revision might be finalised; this is a distinct, second open item relevant to controller and processor security-measure obligations going into subsequent cycles. Pending resolution of the main body's Cabinet-order commencement date generally, businesses operating in Japan face enacted-but-not-yet-effective change across a wide span of the APPI's architecture, from lawful-processing bases and biometric rules to minors' data and enforcement powers, while the PPC's live, in-force breach alert signals that current security-measure expectations are already being raised ahead of that broader commencement. 3 earlier updates not shown here. ###### Standing brief · as of 29 July 2026 Written before the update above. Where they differ, the update is the more recent position. #### Lead Signal Japan's APPI amendment bill has passed a decisive milestone this cycle. The bill, approved by Cabinet on 7 April 2026, is understood to have passed both houses of the Diet on 10 July 2026 and been promulgated on 17 July 2026. That sequence moves the reform from proposed status to enacted law that is not yet in force, correcting an earlier reading of the bill as still pending before the Diet. Entry into force is expected by cabinet order within two years of promulgation, meaning the changes could take effect as late as 2028. Among the provisions queued for that later effective date, the amendment extends APPI's extraterritorial reach to foreign operators that receive Japan-based data subjects' personal information even indirectly, and gives the PPC new powers to compel reports from and issue orders against overseas companies. The same bill is understood to create a 'Specific Biometric Personal Information' category for facial-recognition data, carrying a notice duty and an unconditional right for individuals to demand that its use be suspended. #### Other Developments Elsewhere in Japan's data-protection architecture, the picture this cycle is one of stability rather than acceleration. The Personal Information Protection Commission continues to rely more on non-coercive guidance and advice than on binding orders, and the APPI still gives it no power to impose administrative fines directly — sanctions for violations remain criminal penalties imposed by courts. The EU-Japan mutual adequacy arrangement, the first two-way adequacy finding of its kind, remains in force, with the European Commission's 2023 review having reconfirmed Japan's adequacy status and extended the review cycle from two years to four. Children's-data protections remain at the proposal stage: Japan's APPI still contains no statutory definition of a child, no parental-consent mechanism and no minor-profiling ban, though a reform under PPC consideration would formally define those under 16 as children and add a best-interests safety standard. Reports also suggest sectoral coverage gaps persist: no dedicated telecoms/ePrivacy-style cookie statute, education-sector statute or insurance-sector statute appears to have been identified, leaving those areas governed only by the general APPI regime. #### Cross-Monitor Connections Two threads this cycle intersect with adjacent monitors rather than sitting solely within data protection. Japan's Act on Promotion of Research and Development, and Utilization of AI-related Technology, in force since September 2025, together with the non-binding AI Business Operator Guidelines, are AI-governance instruments best tracked in depth on the artificial-intelligence monitor; the data-protection angle retained here is the continued absence of comprehensive APPI provisions on automated decision-making and profiling. The My Number Act's stricter handling duties for employees' specific personal information, and the Financial Services Agency's sectoral guidelines for financial-industry operators, carry AML/KYC-adjacent significance for the financial-integrity monitor. METI's dedicated credit-card-industry guidelines and the APPI's consent-or-equivalent-protection gate for cross-border transfers are relevant to payments-specific data flows tracked on the world-payments monitor. #### Outlook The near-term marker to watch is not a compliance deadline but a commencement date: the amended APPI's extraterritorial-scope, PPC-compulsion and biometric-category provisions take effect only once a cabinet order is issued, which the enacted text allows to occur any time up to mid-2028. The European Commission's next periodic review of the Japan adequacy arrangement is expected around 2027, testing whether the mutual finding endures through this period of domestic reform. Several reform elements, including an under-16 statutory child-age threshold, a best-interests safety standard, a collective-redress mechanism, and restrictions on opt-out-scheme abuse, were described in PPC interim materials, but whether they survive unchanged in the Diet-passed text has not yet been independently confirmed. Read full brief · 1406 words ###### Latest update · 4 November 2026 #### Regulatory Status Japan's data protection framework entered a period of active structural change. The amendment to the Act on the Protection of Personal Information is understood to have been promulgated on 17 July 2026 as Act No. 56 of 2026, with commencement phased across several dates and criminal-penalty changes expected to take effect from 17 January 2027. The Personal Information Protection Commission is additionally understood to have opened two new regulatory processes in October 2026: an expert panel, announced 28 October 2026 and convening for the first time in November 2026, tasked with reviewing central and local government data-protection practice (with interim proposals not expected before autumn 2027), and a public consultation, announced 22 October 2026 and running through late November 2026, on draft amendments to implementing regulations under the Act and under the My Number law, with promulgation and implementation planned for mid-January 2027. Taken together, the amendment is understood to combine two distinct thrusts: an easing of the conditions under which personal data may be used for statistics and AI development, and a tightening of the Commission's enforcement toolkit, including Japan's first administrative-fine power. Lawful-processing conditions for general use are reported to be relaxing, while breach-notification duties are reported to gain a new low-risk waiver, a narrower form of relief than a wholesale lawful-basis liberalisation. On the governance of automated and AI-facing processing, the same easing is understood to extend to AI-development uses of personal data, one of the amendment's two principal thrusts alongside the strengthened enforcement tools. Guidance bearing on children's data is understood to treat those aged 12 to 15 or younger as generally lacking, on a case-by-case basis, the capacity needed to give valid consent, though whether this threshold survived unchanged from the pre-enactment bill into the Act as promulgated has not been independently confirmed. On enforcement, the amendment is understood to remove the current 'imminent' threshold that constrains the Commission's standard order-making power, and to give the Commission a statutory basis to compel third parties who facilitate a violation to take steps to stop it, alongside the pending administrative-fine power; both represent a widening of the Commission's practical reach, with sanctions for now remaining criminal in character until the fine provision commences. None of this displaces Japan's long-standing mutual adequacy arrangement with the European Union, in force since 23 January 2019 and unaffected by the amendment. #### Outlook The period ahead is dense with scheduled milestones: the implementing-regulation consultation closes in the fourth quarter of 2026 with promulgation and implementation targeted for mid-January 2027, the criminal-penalty provisions are expected to commence from 17 January 2027, and the Commission's government-practice review panel is not expected to produce interim proposals before autumn 2027 at the earliest. Firms operating in Japan should expect the practical shape of both the AI-data-use easing and the administrative-fine power to firm up only once the implementing regulations are promulgated; most of the detail reported rests on secondary legal commentary rather than the Commission's own gazetted text, so the final wording of several provisions, including the children's consent-age threshold, remains to be confirmed against the Act as enacted. 1 earlier update not shown here. ###### Standing brief · as of 29 July 2026 #### Regulatory Status Japan's Personal Information Protection Commission is the independent supervisory authority for the Act on the Protection of Personal Information, holding exclusive oversight of both private-sector operators and public-sector bodies since 1 April 2022. Japan's data-protection architecture is structurally distinct from the GDPR: there is no enumerated Article 6-style lawful basis, no mandatory DPIA, no DPO requirement, and the PPC cannot impose administrative fines directly — sanctions remain criminal penalties imposed by courts. Cross-border transfers rely on a stable foundation: the EU-Japan mutual adequacy arrangement — the world's first two-way adequacy finding — remains in force, reconfirmed by the European Commission's 2023 review, which also extended the review cycle to four years. The amendment bill approved by Cabinet on 7 April 2026 has now passed the Diet (10 July 2026) and been promulgated (17 July 2026), moving to enacted-not-yet-effective status, with entry into force expected by cabinet order within two years of promulgation. #### Outlook Japan's risk trajectory is tightening: the enacted-but-not-yet-effective reform, once in force by cabinet order no later than 2028, will extend extraterritorial reach, add PPC compulsion powers over overseas operators, and create the APPI's first biometric-data category, while children's-data protections and the administrative-fine question remain the two open threads to watch. Read full brief · 755 words Key regulatory facts for Japan Regulatory Dimension Japan Standing Position Jurisdiction Japan (JP) Regulatory Scope Data Protection & Privacy Regulation (10 modules, 124 sourced findings) Regulator & Framework A mature, PPC-enforced omnibus statute is in force with EU/UK mutual adequacy recognition; amber-adjacent risk stems only from the pending 2026 reform bill not yet enacted. Lawful Processing & Special Data Core consent/sensitive-data rules are settled and in force, but the absence of a GDPR Art 6-style lawful-basis architecture and the unresolved biometric/AI carve-outs create interpretive gaps pending the 2026 reform. Data Subject Rights Core access/rectification/erasure/objection rights are codified and were substantially strengthened by the 2020/2022 amendments; residual amber factor is the absence of a fixed response-time statute and of an... Controller/Processor Duties Breach-notification and security-measure duties are robust and in force, but the absence of DPO, formal DPIA, and general ROPA requirements — core GDPR-analogue accountability tools — represents a structural gap... Primary Instruments Cited PPC, EUR-Lex, EUR-Lex, OneTrust DataGuidance, IAPP Last Confirmed / Updated 2026-11-04 (82 sources in cumulative register) 10 of 10 categories Signal Red Amber Green Density Comfortable Compact Expand all sources Reset all Selections OR within a group, AND across groups. Press / to search. ### Japan: D1 Regulator & Framework5 sub-modulesGreenEnacted in forceModule confidence: Probable▾ A mature, PPC-enforced omnibus statute is in force with EU/UK mutual adequacy recognition; amber-adjacent risk stems only from the pending 2026 reform bill not yet enacted. Primary framework Act on the Protection of Personal Information (APPI), Act No. 57 of 2003, as amended Supervisory authority [Personal Information Protection Commission (PPC)](https://www.ppc.go.jp/en/) Traffic-light rationale — Green A mature, PPC-enforced omnibus statute is in force with EU/UK mutual adequacy recognition; amber-adjacent risk stems only from the pending 2026 reform bill not yet enacted. #### Sub-modules (5) #### Regulator And AuthorityGreen The PPC is Japan's independent data protection authority with exclusive oversight of both private- and public-sector personal information handling since the 2021 amendment. Claims (4): - The Personal Information Protection Commission (PPC) is Japan's independent supervisory authority responsible for oversight and enforcement of the APPI. - Following the 2021 APPI amendment, the PPC has exclusive supervisory authority over both private-sector business operators and public-sector Administrative Organs and Incorporated Administrative Agencies. - Personal Information Protection Commission (PPC) — The PPC established an expert panel (announced 28 October 2026) to review central and local government data-protection practice, first meeting November 2026, interim proposals expected autumn 2027 or later. - Personal Information Protection Commission (PPC) — PPC is Japan's independent data-protection authority enforcing the APPI. #### Act And InstrumentsGreen The APPI is complemented by its Cabinet Enforcement Order, PPC Enforcement Rules, PPC Guidelines/Q&As, and EU/UK-specific Supplementary Rules. Claims (5): - The APPI regime is composed of the Act itself plus a Cabinet Enforcement Order, PPC Enforcement Rules, and PPC Guidelines/Q&As that provide authoritative interpretation of the statute. - Act on the Protection of Personal Information (APPI), Japan — The triennial-review amendment to the APPI was promulgated on 17 July 2026 as Act No. 56 of 2026; phased commencement includes criminal-penalty changes from 17 January 2027. - APPI Amendment Act — Cabinet-approved 7 April 2026, Diet passage 10 July 2026, promulgated 17 July 2026; commencement by Cabinet order no later than July 2028. - Personal Information Protection Commission (PPC) — implementing regulations consultation — The PPC announced (22 October 2026) a public consultation through late November 2026 on draft amendments to implementing regulations under the APPI and the My Number law, with promulgation and implementation planned for mid-January 2027. - Act No. 56 of 2026 — Act Partially Amending the Act on the Protection of Personal Information and Other Laws, passed 10 July 2026, promulgated 17 July 2026 #### Material ScopeGreen The APPI applies to 'personal information handling business operators' (PIHBOs) processing personal information databases in the course of business, covering personal information, retained personal data, pseudonymised information and anonymously processed information. Claims (3): - The APPI applies to personal information handling business operators (PIHBOs) — persons providing a personal information database for use in business — covering personal information, retained personal data, pseudonymised information and anonymously processed information. - APPI — Applies to any Personal Information Handling Business Operator processing data of individuals in Japan; no size threshold; extraterritorial reach to foreign operators. - Act on the Protection of Personal Information — no minimum size threshold since 2017-05-30 #### Territorial ScopeAmber Current law already applies extraterritorially to foreign operators acquiring data of Japan-based individuals in connection with supplying goods/services; the pending amendment would broaden this to indirectly-acquired data and add enforcement powers over overseas entities. Claims (3): - The APPI already applies extraterritorially to foreign business operators that acquire personal information directly from data subjects in relation to supplying goods or services to persons in Japan and handle that information abroad. - The pending APPI amendment bill would expand extraterritorial application to foreign operators that handle personal information of Japan-based data subjects even where acquired indirectly, and would empower the PPC to compel reports from and issue orders to overseas companies. - APPI territorial scope — Companies located outside Japan to the extent they handle data on individuals in Japan in connection with providing goods or services to persons in Japan; unaltered by the 2026 amendment #### Regulator Registration And FilingAmber There is no general controller registration regime; the principal filing obligation is notification to the PPC when relying on the opt-out mechanism for third-party data provision. Claims (2): - There is no general controller registration regime under the APPI; the main filing duty is notifying the PPC when a business relies on the opt-out scheme to provide personal data to third parties without consent. - Act on the Protection of Personal Information — no general registration duty Japan operates a comprehensive omnibus data protection regime centred on the Act on the Protection of Personal Information (APPI, Act No. 57 of 2003, as substantially amended in 2015, 2020 and 2021), overseen exclusively by the Personal Information Protection Commission (PPC), an independent supervisory authority. The 2021 amendment harmonised previously separate public- and private-sector regimes under the PPC's exclusive supervision. The APPI applies extraterritorially to foreign operators supplying goods/services to persons in Japan, and a pending 2026 amendment bill (Cabinet-approved 7 April 2026, before the Diet) would further extend extraterritorial reach and give the PPC new powers to compel reports and issue orders to overseas companies. Periodic update · new data 2026-11-04 #### Regulator & Framework The Act on the Protection of Personal Information's triennial-review amendment is understood to have been promulgated on 17 July 2026 as Act No. 56 of 2026, with commencement phased and criminal-penalty changes due to take effect from 17 January 2027. This is reported on secondary commentary rather than the Commission's own gazette text, which was not independently retrieved. The Personal Information Protection Commission is understood to have opened two further regulatory processes in parallel. First, an expert panel, announced 28 October 2026, has been established to review data-protection practice across central and local government, holding its first meeting in November 2026, with interim proposals not expected before autumn 2027 or later. Second, the Commission announced on 22 October 2026 a public consultation, running through late November 2026, on draft amendments to implementing regulations under both the Act and the My Number law, with promulgation and implementation planned for mid-January 2027. #### Outlook The consultation's close in the fourth quarter of 2026 and the targeted mid-January 2027 promulgation of implementing regulations are the near-term events to track; the government-practice review panel operates on a longer horizon and is unlikely to yield substantive proposals before late 2027. Because the Commission's own primary texts were not directly retrieved, the precise scope of the implementing-regulation changes should be treated as provisional pending the Commission's gazetted publication. 3 earlier distinct update(s) Periodic update · new data 2026-10-18 #### Regulator & Framework Japan's data-protection framework is anchored, as before, in the Act on the Protection of Personal Information, overseen by the Personal Information Protection Commission, but the framework is now in a defined period of pending structural change. Act No. 56 of 2026 was passed by the Diet on 10 July 2026 and promulgated on 17 July 2026. Its main body is understood to enter into force on a date fixed by Cabinet order within two years of promulgation, placing likely commencement at approximately mid-2028. This two-year ceiling on the commencement window is a standard legislative-drafting device in Japan for substantial statutory amendments, giving the government flexibility to coordinate subordinate regulations, PPC guidelines, and industry transition arrangements before the amendment takes legal effect, while fixing an outer limit beyond which delay is not permitted. The amendment is reported, across multiple independent law-firm sources, as a wide-ranging revision touching lawful-processing bases, breach-notification exemptions, biometric-data rules, minors' data provisions, and PPC enforcement powers, several of which are addressed in their own right elsewhere in this brief. Because the main body has not yet commenced, the current operative version of the APPI, including its existing consent, breach-notification, and enforcement provisions, remains in force unchanged in the interim, and businesses operating in Japan continue to be assessed against the pre-amendment statutory text for the time being. The precise source document establishing promulgation and the two-year commencement ceiling is secondary law-firm commentary rather than the Official Gazette text itself, a limitation that applies across the structural facts summarised in this section; the core facts of passage, promulgation, and the two-year ceiling are nonetheless consistently reported. #### Outlook The principal outstanding item for this module is the specific Cabinet order date fixing the main body's commencement within the two-year window running from 17 July 2026. Until that order is issued, the operative APPI framework remains the pre-amendment text, and firms assessing their compliance posture against Act No. 56/2026's various new provisions are necessarily doing so on a forward-looking, not-yet-binding basis. Subsequent cycles may surface the specific Cabinet order date, or interim PPC guidance clarifying the implementation timetable for particular provisions, including those reported as commencing earlier than the main body. Periodic update · new data 2026-10-06 #### Regulator & Framework The Personal Information Protection Commission (PPC) is Japan's single national data-protection supervisory authority under the APPI, holding investigatory, guidance, recommendation, and order powers, and gaining administrative-fine powers once Act No. 56 of 2026 commences. Act No. 56 of 2026 was passed by the Diet on 10 July 2026 and promulgated on 17 July 2026. It is not yet in force; implementation is expected by Cabinet Order within two years of promulgation, no later than July 2028. On 7 September 2026 the PPC discussed its basic concept for developing the implementing rules for the amended APPI, with a stated focus on data-utilisation rulemaking and youth-data protection, giving an early indication of how the PPC intends to approach the rulemaking process ahead of the statutory deadline. This is Japan's most significant data-protection reform since the 2020 and 2022 APPI amendments, introducing the PPC's first administrative-fine power, the APPI's first minors-specific provision, and heightened biometric-data governance, all on a multi-year implementation runway extending to no later than July 2028. #### Outlook The exact Cabinet Order commencement date or dates for Act No. 56/2026's various provisions have not yet been published. The PPC's September 2026 discussion of its implementing-rules basic concept is the clearest early signal of direction, but the specific rulemaking timetable, and whether the administrative-fine, biometric, and minors provisions will commence together or in phases, remains to be determined ahead of the July 2028 outer deadline. Periodic update · new data 2026-09-21 #### Regulator & Framework The Personal Information Protection Commission (PPC) is Japan's independent data-protection authority enforcing the Act on the Protection of Personal Information (APPI). The APPI Amendment Act was Cabinet-approved on 7 April 2026, passed the Diet on 10 July 2026, and promulgated on 17 July 2026, with commencement by Cabinet order due no later than July 2028; until then, the current APPI framework continues to govern day-to-day compliance obligations. The APPI applies to any Personal Information Handling Business Operator processing the data of individuals in Japan, with no size threshold and extraterritorial reach to foreign operators. #### Outlook The defining variable for this module over the next two years is the timing of the Cabinet order that will actually commence the amendment. No exact date has been fixed within the July 2028 outer limit, and the PPC's institutional role as enforcer is set to expand materially once that order takes effect. Sources and claims (17) - [PPC](https://www.ppc.go.jp/en/) — The Personal Information Protection Commission (PPC) is Japan's independent supervisory authority responsible for oversight and enforcement of the APPI. - [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:52023DC0275) — Following the 2021 APPI amendment, the PPC has exclusive supervisory authority over both private-sector business operators and public-sector Administrative Organs and Incorporated Administrative Agencies. - [EUR-Lex](https://eur-lex.europa.eu/eli/dec_impl/2019/419/oj/eng) — The APPI regime is composed of the Act itself plus a Cabinet Enforcement Order, PPC Enforcement Rules, and PPC Guidelines/Q&As that provide authoritative interpretation of the statute. - [OneTrust DataGuidance](https://www.dataguidance.com/notes/japan-data-protection-financial-sector-0) — The APPI applies to personal information handling business operators (PIHBOs) — persons providing a personal information database for use in business — covering personal information, retained personal data, pseudonymised information and anonymously processed information. - [IAPP](https://iapp.org/news/a/practical-notes-for-japans-important-updates-of-the-appi-guidelines-and-qas) — The APPI already applies extraterritorially to foreign business operators that acquire personal information directly from data subjects in relation to supplying goods or services to persons in Japan and handle that information abroad. - [IAPP](https://iapp.org/news/a/practical-notes-for-japans-important-updates-of-the-appi-guidelines-and-qas) — The pending APPI amendment bill would expand extraterritorial application to foreign operators that handle personal information of Japan-based data subjects even where acquired indirectly, and would empower the PPC to compel reports from and issue orders to overseas companies. - [IAPP](https://iapp.org/news/a/analysis-of-japans-approved-bill-to-amend-the-appi) — There is no general controller registration regime under the APPI; the main filing duty is notifying the PPC when a business relies on the opt-out scheme to provide personal data to third parties without consent. - [Mori Hamada & Matsumoto](https://www.morihamada.com/en/insights/newsletters/138006) — Act on the Protection of Personal Information (APPI), Japan — The triennial-review amendment to the APPI was promulgated on 17 July 2026 as Act No. 56 of 2026; phased commencement includes criminal-penalty changes from 17 January 2027. - [A&O Shearman](https://www.aoshearman.com/en/insights/ao-shearman-on-data/amendments-to-the-act-on-the-protection-of-personal-information-promulgated) — Personal Information Protection Commission (PPC) — The PPC established an expert panel (announced 28 October 2026) to review central and local government data-protection practice, first meeting November 2026, interim proposals expected autumn 2027 or later. - [Chambers and Partners](https://practiceguides.chambers.com/practice-guides/data-protection-privacy-2026/japan/trends-and-developments) — Personal Information Protection Commission (PPC) — PPC is Japan's independent data-protection authority enforcing the APPI. - [Recording Law](https://www.recordinglaw.com/world-laws/world-data-privacy-laws/japan-data-privacy-laws/) — APPI Amendment Act — Cabinet-approved 7 April 2026, Diet passage 10 July 2026, promulgated 17 July 2026; commencement by Cabinet order no later than July 2028. - [Vucense](https://vucense.com/tech-guides/security-101/japan-appi/) — APPI — Applies to any Personal Information Handling Business Operator processing data of individuals in Japan; no size threshold; extraterritorial reach to foreign operators. - [https://www.morihamada.com/en/insights/newsletters/138006](https://www.morihamada.com/en/insights/newsletters/138006) — Personal Information Protection Commission (PPC) — implementing regulations consultation — The PPC announced (22 October 2026) a public consultation through late November 2026 on draft amendments to implementing regulations under the APPI and the My Number law, with promulgation and implementation planned for mid-January 2027. - [Endpoint Protector (CoSoSys)](https://www.endpointprotector.com/blog/data-protection-in-japan-appi/) — Act on the Protection of Personal Information — no minimum size threshold since 2017-05-30 - [Atsumi & Sakai](https://www.aplawjapan.com/archives/pdf/data-protection-202009.pdf) — Act on the Protection of Personal Information — no general registration duty - [Legal 500](https://www.legal500.com/guides/hot-topic/japan-proposed-amendments-to-the-act-on-the-protection-of-personal-information-appi/) — Act No. 56 of 2026 — Act Partially Amending the Act on the Protection of Personal Information and Other Laws, passed 10 July 2026, promulgated 17 July 2026 - [A&O Shearman](https://www.aoshearman.com/en/insights/ao-shearman-on-data/amendments-to-the-act-on-the-protection-of-personal-information-promulgated) — APPI territorial scope — Companies located outside Japan to the extent they handle data on individuals in Japan in connection with providing goods or services to persons in Japan; unaltered by the 2026 amendment ### Japan: D2 Lawful Processing & Special Data4 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Core consent/sensitive-data rules are settled and in force, but the absence of a GDPR Art 6-style lawful-basis architecture and the unresolved biometric/AI carve-outs create interpretive gaps pending the 2026 reform. Primary framework Act on the Protection of Personal Information (APPI) Supervisory authority [Personal Information Protection Commission (PPC)](https://www.ppc.go.jp/en/) Traffic-light rationale — Amber Core consent/sensitive-data rules are settled and in force, but the absence of a GDPR Art 6-style lawful-basis architecture and the unresolved biometric/AI carve-outs create interpretive gaps pending the 2026 reform. Periodic update · new data 2026-11-04 #### Lawful Processing & Special Data The 2026 amendment to the Act on the Protection of Personal Information is reported to make it easier to use personal data, in particular for statistics and for AI development, while simultaneously giving the Personal Information Protection Commission Japan's first power to impose administrative fines for privacy violations. The pinpoint provision describing exactly how the lawful-use test is revised, and the date on which the new administrative-fine power itself commences, were not independently retrieved, so the precise mechanics of the liberalisation remain to be confirmed against the promulgated text. #### Outlook This represents a loosening of the conditions attached to data use for statistical and AI-development purposes set against a tightening of the regulator's sanctioning power, a combination that firms processing data for these purposes in Japan will want to track as implementing detail emerges through the Commission's pending consultation. Periodic update · new data 2026-10-18 #### Lawful Processing & Special Data Act No. 56/2026 introduces two distinct changes to Japan's lawful-processing landscape, neither of which is yet in force. The first is a new consent exemption for sharing personal information for statistical analysis purposes, a category explicitly understood to include AI-development data-sharing. This exemption is limited to recipients that either handle personal information themselves or are administrative organs, and where the recipient is located outside Japan, the exemption is conditioned on safeguards that comply with PPC regulation. This is a notable accommodation for data flows supporting statistical and AI-model-development activity, an area where Japan's existing consent-centric framework has previously required a more case-by-case lawful-basis analysis; the new exemption, once effective, would give data holders and recipients a defined statutory pathway rather than relying solely on anonymisation or existing statistical-purpose carve-outs. The second change relaxes the consent requirement itself, through amendments to Article 20(2)(vii), governing acquisition of personal information, and Article 27(1)(viii), governing third-party provision, for processing that is clearly necessary and unavoidable for performance of a contract. The PPC is expected to specify further qualifying cases by regulation once this provision commences, meaning the practical scope of the relaxation will depend on forthcoming subordinate rulemaking rather than being fully determined by the statutory text alone. Both changes are enacted but not yet effective, tied to the main body's Cabinet-order commencement date discussed in the Regulator & Framework module, and both rest on law-firm secondary commentary rather than direct retrieval of the amendment's text or the PPC's own explanatory materials. #### Outlook The practical significance of the contract-necessity consent relaxation will turn substantially on the content of the PPC's forthcoming implementing regulation specifying qualifying cases, which has not yet been published or characterised in detail. Similarly, the scope of the new statistical/AI-development consent exemption, in particular what counts as a qualifying "recipient handling personal information" and what PPC-regulation-compliant safeguards will be required for foreign recipients, remains to be clarified by subordinate rulemaking. Both items are worth tracking as the main body's commencement date approaches and as the PPC publishes further implementing guidance. Periodic update · new data 2026-10-06 #### Lawful Processing & Special Data Act No. 56 of 2026 creates a new consent exemption under APPI Article 30-2(1), applicable once the amendment takes effect. Under this provision, businesses may collect publicly available sensitive personal data without obtaining prior consent, provided the sole purpose of the collection is statistical creation, or provision to a third party for that statistical purpose. This exemption is bounded by transparency measures and contractual safeguards rather than operating as an unconditional carve-out: businesses relying on it are understood to remain subject to disclosure obligations about the collection, and to contractual terms governing any onward provision to a third party for statistical use. This provision is enacted but not yet in force, part of the broader Act No. 56/2026 package expected to commence by Cabinet Order no later than July 2028. It represents a liberalising development within an otherwise tightening reform package, narrowing the consent requirement specifically for a defined statistical-purpose use case while the remainder of the amendment strengthens enforcement and governance obligations elsewhere in the Act. #### Outlook The scope of 'publicly available' sensitive personal data eligible for this exemption, and the precise content of the transparency measures and contractual safeguards required to rely on it, are expected to be clarified through the same Cabinet Order and implementing-rules process addressed under Regulator & Framework, with no later deadline than July 2028. Periodic update · new data 2026-09-21 #### Lawful Processing & Special Data The APPI Amendment Act materially widens lawful-processing grounds ahead of its eventual entry into force. A new consent exemption permits collection of publicly available sensitive data and third-party sharing of such data for statistical processing, including AI model development, subject to transparency requirements and contractual safeguards. Separately, the amendment adds a distinct consent exception for processing that "clearly does not prejudice" individuals' rights and interests, and lowers the threshold for invoking existing public-interest exceptions. #### Outlook Because both provisions are enacted but not yet in force, their practical effect awaits Cabinet-order commencement, due no later than July 2028. The AI-training consent exemption in particular positions Japan's regime to diverge somewhat from stricter consent-first approaches elsewhere, a divergence that will become concrete only once implementing guidance and commencement dates are set. D2 · Lawful Processing — Full Module Record 4 sub-modules · 108 words · 14 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login) [Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Japan: D3 Data Subject Rights5 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Core access/rectification/erasure/objection rights are codified and were substantially strengthened by the 2020/2022 amendments; residual amber factor is the absence of a fixed response-time statute and of an explicit portability right. Primary framework Act on the Protection of Personal Information (APPI) Supervisory authority [Personal Information Protection Commission (PPC)](https://www.ppc.go.jp/en/) Traffic-light rationale — Green Core access/rectification/erasure/objection rights are codified and were substantially strengthened by the 2020/2022 amendments; residual amber factor is the absence of a fixed response-time statute and of an explicit portability right. #### Sub-modules (5) #### Access RightGreen Data subjects may demand disclosure of retained personal data; businesses must respond without delay, subject to limited harm-based exceptions. Claims (3): - Data subjects have the right to demand disclosure of retained personal data held by a business operator. - A business operator must disclose retained personal data to a data subject without delay, subject to statutory exceptions such as risk of harm to life or improper interference with business operations. - Act on the Protection of Personal Information (APPI) Art 33(1) — A data subject may request disclosure of retained personal data identifying them; the operator must respond within a reasonable time, with practitioner guidance citing two weeks as the point at which suit may be brought for non-response. #### Rectification And ErasureGreen Rights to correction, addition or deletion of retained personal data exist; erasure/cessation-of-use rights were expanded by the 2020/2022 amendment beyond the original narrow trigger conditions. Claims (4): - Data subjects may demand correction, addition or deletion of the content of retained personal data. - The 2020/2022 amendment expanded data subjects' rights to demand cessation of use, deletion, or cessation of third-party provision of retained personal data to cases where a data subject's rights or legitimate interests are likely to be infringed, beyond the prior narrow grounds of purpose-violation, improper collection, or unlawful third-party provision. - APPI Amendment Act — Requires parental consent for processing children's data under 16 and grants children enhanced deletion/suspension rights. - Act No. 56/2026 — Parental consent for processing personal data of children under 16; children gain enhanced deletion/suspension rights #### Restriction And ObjectionGreen Cessation of use/third-party provision functions as the APPI's restriction/objection mechanism, now exercisable wherever rights or legitimate interests are likely to be infringed. Claims (1): - The 2020/2022 amendment expanded data subjects' rights to demand cessation of use, deletion, or cessation of third-party provision of retained personal data to cases where a data subject's rights or legitimate interests are likely to be infringed, beyond the prior narrow grounds of purpose-violation, improper collection, or unlawful third-party provision. #### Data PortabilityAmber No explicit portability right analogous to GDPR Art 20 exists; the amendment's electronic-disclosure entitlement is the closest functional equivalent. Claims (2): - The 2020/2022 amendment allows data subjects to require that their retained personal data be disclosed to them electronically, whereas the prior law did not expressly permit electronic-format disclosure demands. - The APPI does not contain a distinct data-portability right equivalent to GDPR Article 20; electronic disclosure of retained personal data is the closest functional analogue. #### Deadlines And Response WindowsAmber The APPI imposes a 'without delay' response standard for disclosure requests rather than a fixed statutory number of days. Claims (2): - A business operator must disclose retained personal data to a data subject without delay, subject to statutory exceptions such as risk of harm to life or improper interference with business operations. - APPI Amendment Act — Allows notification to affected individuals to be replaced with alternative measures where risk is low, versus current threshold-based mandatory notification. Data subjects hold rights to demand disclosure, correction/addition/deletion, and cessation of use or third-party provision of 'retained personal data.' The 2020/2022 amendments broadened these rights (removing the prior six-month retention carve-out, allowing exercise wherever rights/interests are 'likely to be infringed,' and permitting electronic-format disclosure demands). There is no dedicated GDPR Art 20-style portability right, though electronic disclosure functions similarly. Response timing is governed by a 'without delay' standard rather than a fixed statutory clock (contrast with the fixed breach-reporting deadlines under controller duties). Periodic update · new data 2026-09-21 #### Data Subject Rights The amendment package produces a mixed picture for data-subject rights. It grants children enhanced deletion and suspension rights alongside a new parental-consent requirement for processing the data of individuals under 16. It also relaxes breach-notification obligations owed to affected individuals: where risk is assessed as low, notification to the individual can be replaced with alternative measures, moving away from the current threshold-based mandatory-notification model. #### Outlook Neither change is yet operative. Once commenced, the relaxed breach-notification default will need to be read alongside the PPC's separate, currently in-force Article 26 reporting-to-PPC obligations, which are unaffected by this particular provision and continue under existing thresholds and online-submission procedures. Sources and claims (10) - [PPC](https://www.ppc.go.jp/files/pdf/APPI_english.pdf) — Data subjects have the right to demand disclosure of retained personal data held by a business operator. - [PPC](https://www.ppc.go.jp/files/pdf/APPI_english.pdf) — A business operator must disclose retained personal data to a data subject without delay, subject to statutory exceptions such as risk of harm to life or improper interference with business operations. - [IAPP](https://iapp.org/news/a/japan-enacts-the-act-on-the-protection-of-personal-information) — Data subjects may demand correction, addition or deletion of the content of retained personal data. - [IAPP](https://iapp.org/news/a/analysis-of-japans-approved-bill-to-amend-the-appi) — The 2020/2022 amendment expanded data subjects' rights to demand cessation of use, deletion, or cessation of third-party provision of retained personal data to cases where a data subject's rights or legitimate interests are likely to be infringed, beyond the prior narrow grounds of purpose-violation, improper collection, or unlawful third-party provision. - [IAPP](https://iapp.org/news/a/analysis-of-japans-approved-bill-to-amend-the-appi) — The 2020/2022 amendment allows data subjects to require that their retained personal data be disclosed to them electronically, whereas the prior law did not expressly permit electronic-format disclosure demands. - [IAPP](https://iapp.org/news/a/analysis-of-japans-approved-bill-to-amend-the-appi) — The APPI does not contain a distinct data-portability right equivalent to GDPR Article 20; electronic disclosure of retained personal data is the closest functional analogue. - [Mori Hamada & Matsumoto](https://www.morihamada.com/en/insights/newsletters/138006) — APPI Amendment Act — Requires parental consent for processing children's data under 16 and grants children enhanced deletion/suspension rights. - [Legal 500](https://www.legal500.com/guides/hot-topic/japan-proposed-amendments-to-the-act-on-the-protection-of-personal-information-appi/) — APPI Amendment Act — Allows notification to affected individuals to be replaced with alternative measures where risk is low, versus current threshold-based mandatory notification. - [Mori Hamada & Matsumoto](https://www.morihamada.com/en/insights/newsletters/138006) — Act No. 56/2026 — Parental consent for processing personal data of children under 16; children gain enhanced deletion/suspension rights - [Japanese Law Translation (Ministry of Justice)](https://www.japaneselawtranslation.go.jp/en/laws/view/4241/en) — Act on the Protection of Personal Information (APPI) Art 33(1) — A data subject may request disclosure of retained personal data identifying them; the operator must respond within a reasonable time, with practitioner guidance citing two weeks as the point at which suit may be brought for non-response. ### Japan: D4 Controller/Processor Duties7 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Breach-notification and security-measure duties are robust and in force, but the absence of DPO, formal DPIA, and general ROPA requirements — core GDPR-analogue accountability tools — represents a structural gap relative to omnibus peers. Primary framework Act on the Protection of Personal Information (APPI) Supervisory authority [Personal Information Protection Commission (PPC)](https://www.ppc.go.jp/en/) Traffic-light rationale — Amber Breach-notification and security-measure duties are robust and in force, but the absence of DPO, formal DPIA, and general ROPA requirements — core GDPR-analogue accountability tools — represents a structural gap relative to omnibus peers. Periodic update · new data 2026-11-04 #### Controller/Processor Duties The 2026 amendment to the Act on the Protection of Personal Information is understood to introduce a waiver from the duty to individually notify affected individuals of a data leakage, available where the Commission designates the leakage as low risk and alternative protective measures are in place. The Commission's own rules setting out how a leakage will be assessed as low risk, and the date this waiver takes effect, were not retrieved. #### Outlook This is a narrowing of the individual-notification duty rather than a change to the underlying breach-reporting obligation to the Commission itself; the scope of the waiver will depend on how the Commission defines "low risk" in rules that have not yet been published, which businesses handling personal data in Japan should watch for as the implementing-regulation consultation proceeds toward its planned mid-January 2027 promulgation. Periodic update · new data 2026-10-25 #### Controller/Processor Duties Two developments mark this module, one already in effect and one pending. The already-effective development is the Personal Information Protection Commission's formal alert of 7 October 2026, titled "Response to Large-Scale Leakage Incidents," issued directly to personal-information-handling business operators. The alert was prompted by a cluster of unauthorised-access breaches affecting widely-used consumer services, and it urges operators to review their safety-management measures and to delete personal data that is no longer needed. This is a primary-sourced, Confirmed development, and its significance lies in its timing relative to the pending statutory change discussed elsewhere in this brief: the PPC is acting now, under its existing powers, to raise expectations of controllers' security-measure practice, rather than waiting for Act No. 56/2026 or any associated Guidelines revision to take effect. The alert is understood to pre-empt a forthcoming revision to the PPC's Guidelines, suggesting that more detailed, binding or quasi-binding expectations may follow in due course, though the content and timing of that revision had not been established as. The pending development is Act No. 56/2026's introduction of a risk-based exemption from the requirement to directly notify affected individuals of a data breach. Under a revised Article 26(2), businesses would be exempted from direct individual notification where PPC regulations designate a particular breach as low-risk, provided alternative protective measures are taken instead. This is a meaningful adjustment to the current notification architecture, which otherwise generally requires both regulator notification and individual notification for qualifying breaches. Commencement for this exemption, and related provisions, has been reported variously: some reporting suggests certain provisions could commence as early as January 2027, while the main body of the Act is understood to commence around mid-2028. This discrepancy has not been resolved against a primary Cabinet-order source and should be treated as an open item. #### Outlook The immediate, practical item for controllers and processors is the PPC's live breach alert, which applies now under existing law regardless of Act No. 56/2026's commencement timetable; businesses handling consumer data, particularly in sectors recently affected by unauthorised-access incidents, should expect continued PPC attention to safety-management-measure adequacy. On the pending side, clarification of which specific provisions of the new breach-notification exemption commence on an accelerated timetable, as opposed to awaiting the main body's Cabinet-order date, together with the content of the PPC's anticipated Guidelines revision, are the two clearest open items to track in subsequent cycles. Periodic update · new data 2026-10-18 #### Controller/Processor Duties Two developments mark this module this cycle, one already in effect and one pending. The already-effective development is the Personal Information Protection Commission's formal alert of 7 October 2026, titled "Response to Large-Scale Leakage Incidents," issued directly to personal-information-handling business operators. The alert was prompted by a cluster of unauthorised-access breaches affecting widely-used consumer services, and it urges operators to review their safety-management measures and to delete personal data that is no longer needed. This is a primary-sourced, Confirmed development, and its significance lies in its timing relative to the pending statutory change discussed elsewhere in this brief: the PPC is acting now, under its existing powers, to raise expectations of controllers' security-measure practice, rather than waiting for Act No. 56/2026 or any associated Guidelines revision to take effect. The alert is understood to pre-empt a forthcoming revision to the PPC's Guidelines, suggesting that more detailed, binding or quasi-binding expectations may follow in due course, though the content and timing of that revision had not been established as at this cycle. The pending development is Act No. 56/2026's introduction of a risk-based exemption from the requirement to directly notify affected individuals of a data breach. Under a revised Article 26(2), businesses would be exempted from direct individual notification where PPC regulations designate a particular breach as low-risk, provided alternative protective measures are taken instead. This is a meaningful adjustment to the current notification architecture, which otherwise generally requires both regulator notification and individual notification for qualifying breaches. Commencement for this exemption, and related provisions, has been reported variously: some reporting suggests certain provisions could commence as early as January 2027, while the main body of the Act is understood to commence around mid-2028. This discrepancy has not been resolved against a primary Cabinet-order source this cycle and should be treated as an open item. #### Outlook The immediate, practical item for controllers and processors is the PPC's live breach alert, which applies now under existing law regardless of Act No. 56/2026's commencement timetable; businesses handling consumer data, particularly in sectors recently affected by unauthorised-access incidents, should expect continued PPC attention to safety-management-measure adequacy. On the pending side, clarification of which specific provisions of the new breach-notification exemption commence on an accelerated timetable, as opposed to awaiting the main body's Cabinet-order date, together with the content of the PPC's anticipated Guidelines revision, are the two clearest open items to track in subsequent cycles. Periodic update · new data 2026-10-06 #### Controller/Processor Duties Act No. 56 of 2026 makes two changes bearing on controller and processor duties, both enacted but not yet in force. First, entrusted data processors gain relief from most general APPI obligations, provided appropriate contractual safeguards are in place between the controller and the processor; this is a relaxation of the compliance burden for processors acting under contract, shifting more of the direct APPI compliance responsibility toward the controller relationship rather than duplicating it across both parties. Second, the PPC gains the power to issue a corrective order without first issuing a recommendation, where the PPC assesses that infringement risk is imminent. This removes the prior requirement that actual harm have already occurred before the PPC could act, giving the regulator a materially faster intervention tool. Separately, and unaffected by this amendment, the existing APPI Article 26 breach-notification duty remains in force: a business operator that becomes aware of an actual or suspected personal-data breach falling within PPC-specified categories must report to the PPC and notify affected data subjects, with a preliminary report expected promptly and a final or supplementary report due within 30 days, extended to 60 days for breaches involving wrongful intent. #### Outlook The processor-relief and expedited-corrective-order provisions both depend on Act No. 56/2026's Cabinet Order commencement, expected no later than July 2028. Businesses relying on third-party processors should expect contractual-safeguard requirements to be specified in greater detail as the implementing rules develop, while the breach-notification regime itself continues unchanged under current law. Periodic update · new data 2026-09-21 #### Controller/Processor Duties The amendment exempts entrusted data processors from most of the APPI's general Chapter 4 obligations, provided the underlying processing agreement specifies prescribed matters, including breach-notification scope and use limitations. Under the current, already-in-force regime, APPI Article 26 requires business operators to report qualifying breaches to the PPC and notify affected individuals, and 2026 policy updates clarified reporting thresholds and introduced online-submission procedures for breach reports to the Commission. #### Outlook The processor exemption will not take effect until Cabinet-order commencement, due no later than July 2028, meaning entrusted-processor arrangements remain fully subject to Chapter 4 obligations in the interim. The Article 26 procedural clarifications, by contrast, are already operative. D4 · Controller & Processor — Full Module Record 7 sub-modules · 89 words · 16 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Japan: D5 Cross-Border & Adequacy6 sub-modulesGreenEnacted in forceModule confidence: Probable▾ A functioning, reviewed mutual adequacy arrangement with the EU/UK and codified transfer mechanisms place this module on solid footing; amber-adjacent nuance is the still-evolving TIA/monitoring guidance under the pending 2026 reform. Primary framework Act on the Protection of Personal Information (APPI); EU-Japan Mutual Adequacy Framework Supervisory authority [Personal Information Protection Commission (PPC)](https://www.ppc.go.jp/en/) Traffic-light rationale — Green A functioning, reviewed mutual adequacy arrangement with the EU/UK and codified transfer mechanisms place this module on solid footing; amber-adjacent nuance is the still-evolving TIA/monitoring guidance under the pending 2026 reform. Periodic update · new data 2026-09-21 #### Cross-Border & Adequacy The EU-Japan mutual adequacy decision remains stable this cycle, with the next scheduled Commission review set for 2027, timed to coincide with the expected implementation window of the 2026 APPI amendments. #### Outlook Whether the 2027 review proceeds smoothly will depend on the state of APPI Amendment Act commencement at that point, which is due no later than July 2028. D5 · Cross-Border & Adequacy — Full Module Record 6 sub-modules · 104 words · 14 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Japan: D6 Sectoral Watch7 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Financial-sector and My Number overlays are well-documented and in force; telecoms/ePrivacy, education and insurance sector-specific DP overlays are not clearly codified, producing residual coverage gaps. Primary framework APPI supplemented by FSA/METI sectoral guidelines and the My Number Act Supervisory authority [Personal Information Protection Commission (PPC)](https://www.ppc.go.jp/en/) Traffic-light rationale — Amber Financial-sector and My Number overlays are well-documented and in force; telecoms/ePrivacy, education and insurance sector-specific DP overlays are not clearly codified, producing residual coverage gaps. Periodic update · new data 2026-09-21 #### Sectoral Watch Sectoral coverage this cycle is thin and confined to insurance. Per the PPC's monitoring report covering October 2024 to September 2025, a non-life insurance company received policyholder data from other insurers via inappropriate methods, resulting in a PPC administrative order or recommendation. No other sectoral overlays — financial, health, telecoms, employment, credit-scoring, or education — were evidenced with material developments this cycle. #### Outlook This module carries a limited-signal flag this cycle: the insurance case is the only sectoral-specific finding, and broader sector-by-sector APPI compliance trends were not independently evidenced. D6 · Sectoral Watch — Full Module Record 7 sub-modules · 63 words · 8 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Japan: D7 AdTech & Commercial Privacy6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Opt-out and third-party data-provision rules are codified and enforceable, but dark-patterns, standardised opt-out signals, and clean-room-specific rules are absent, and reform of the opt-out scheme itself remains pending. Primary framework Act on the Protection of Personal Information (APPI) Supervisory authority [Personal Information Protection Commission (PPC)](https://www.ppc.go.jp/en/) Traffic-light rationale — Amber Opt-out and third-party data-provision rules are codified and enforceable, but dark-patterns, standardised opt-out signals, and clean-room-specific rules are absent, and reform of the opt-out scheme itself remains pending. D7 · AdTech & Marketing — Full Module Record 6 sub-modules · 94 words · 6 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Japan: D8 Algorithmic, Biometric & Surveillance Governance6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ AI-specific promotional legislation and sectoral biometric/genetic guidance exist, but core ADM/profiling and binding biometric protections remain in the proposal stage, and state-surveillance carve-outs limit PPC coercive reach over public bodies. Primary framework APPI (general); Act on Promotion of Research and Development, and Utilization of AI-related Technology (AI Promotion Act, 2025) Supervisory authority [Personal Information Protection Commission (PPC)](https://www.ppc.go.jp/en/) Traffic-light rationale — Amber AI-specific promotional legislation and sectoral biometric/genetic guidance exist, but core ADM/profiling and binding biometric protections remain in the proposal stage, and state-surveillance carve-outs limit PPC coercive reach over public bodies. Periodic update · new data 2026-11-04 #### Algorithmic, Biometric & Surveillance Governance The 2026 amendment to the Act on the Protection of Personal Information is reported to ease the use of personal data for statistics and for AI-development purposes, standing as one of the amendment's two principal thrusts alongside the strengthening of the Commission's enforcement tools. The specific provision governing AI-facing data use was not independently retrieved, so the operative detail of the easing, including any conditions or safeguards attached to it, is not yet confirmed. #### Outlook Organisations developing or deploying AI systems that rely on personal data obtained in Japan should expect more concrete guidance once the Commission's implementing-regulation consultation concludes; until the relevant provisions are promulgated, the scope of the easing should be treated as directional rather than settled. Periodic update · new data 2026-10-25 #### Algorithmic, Biometric & Surveillance Governance Act No. 56/2026 introduces heightened statutory treatment of biometric data used for identification purposes, a category not previously subject to bespoke statutory rules of this kind under the APPI. Three distinct elements are reported: first, heightened transparency requirements specific to biometric identification data; second, an expanded deletion-request right applicable to such data; and third, a prohibition on providing biometric identification data to third parties via the opt-out mechanism that otherwise allows certain categories of personal data to be shared with third parties absent individual consent, provided the data subject has not opted out. Removing the opt-out pathway specifically for biometric identification data means that, once this provision commences, third-party sharing of such data will generally require an affirmative lawful basis rather than reliance on a standing opt-out notice. This set of changes is reported consistently in secondary law-firm commentary, though the amendment's own text and any PPC explanatory guidance were not independently retrieved. The provision is enacted but not yet in force, tied to the same Cabinet-order commencement mechanism governing the main body of Act No. 56/2026 generally, with likely effect around mid-2028. No separate finding concerning algorithmic decision-making or automated-surveillance governance specifically was identified for Japan; the material secured concerns biometric data treatment within the forthcoming amendment. #### Outlook The practical significance of these biometric provisions, once in force, will depend substantially on how the PPC defines "biometric data used for identification purposes" in implementing guidance, and on the specific content of the heightened transparency requirements, neither of which has been established. Businesses deploying biometric identification systems in Japan, including in sectors such as finance, retail, and access control, would be the primary population affected once the provision commences, and the removal of the opt-out pathway for third-party sharing is the single most consequential practical change within this set of provisions. Periodic update · new data 2026-10-18 #### Algorithmic, Biometric & Surveillance Governance Act No. 56/2026 introduces heightened statutory treatment of biometric data used for identification purposes, a category not previously subject to bespoke statutory rules of this kind under the APPI. Three distinct elements are reported: first, heightened transparency requirements specific to biometric identification data; second, an expanded deletion-request right applicable to such data; and third, a prohibition on providing biometric identification data to third parties via the opt-out mechanism that otherwise allows certain categories of personal data to be shared with third parties absent individual consent, provided the data subject has not opted out. Removing the opt-out pathway specifically for biometric identification data means that, once this provision commences, third-party sharing of such data will generally require an affirmative lawful basis rather than reliance on a standing opt-out notice. This set of changes is reported consistently in secondary law-firm commentary, though the amendment's own text and any PPC explanatory guidance were not independently retrieved this cycle. The provision is enacted but not yet in force, tied to the same Cabinet-order commencement mechanism governing the main body of Act No. 56/2026 generally, with likely effect around mid-2028. No separate finding concerning algorithmic decision-making or automated-surveillance governance specifically was identified for Japan this cycle; the material secured concerns biometric data treatment within the forthcoming amendment. #### Outlook The practical significance of these biometric provisions, once in force, will depend substantially on how the PPC defines "biometric data used for identification purposes" in implementing guidance, and on the specific content of the heightened transparency requirements, neither of which has been established this cycle. Businesses deploying biometric identification systems in Japan, including in sectors such as finance, retail, and access control, would be the primary population affected once the provision commences, and the removal of the opt-out pathway for third-party sharing is the single most consequential practical change within this set of provisions. Periodic update · new data 2026-10-06 #### Algorithmic, Biometric & Surveillance Governance Act No. 56 of 2026 introduces heightened governance for facial-recognition-type biometric data, enacted but not yet in force. Once the amendment commences, facial-recognition-type biometric data becomes subject to heightened transparency requirements, an expanded individual right to request deletion, and a prohibition on third-party provision of such data via the opt-out mechanism that otherwise applies more generally under the APPI to certain categories of personal data. This is a targeted governance upgrade specific to one category of biometric data, facial recognition, rather than a general biometric-data regime covering all biometric identifiers; the amendment does not establish a broader algorithmic-governance framework beyond this specific biometric category based on the evidence available this cycle. #### Outlook Commencement is expected by Cabinet Order no later than July 2028, alongside the other Act No. 56/2026 provisions. The practical reach of the expanded deletion right and the opt-out prohibition for facial-recognition data will depend on implementing guidance from the PPC, whose basic-concept discussion in September 2026 signalled a continuing focus on data-utilisation rulemaking alongside youth-data protection, though biometric-specific implementing detail was not addressed in the evidence available this cycle. Periodic update · new data 2026-09-21 #### Algorithmic, Biometric & Surveillance Governance The APPI Amendment Act establishes "Specific Biometric Personal Information" as a distinct regulated category for the first time, subject to heightened transparency obligations, expanded deletion rights, and a prohibition on third-party provision via opt-out. This marks a structural addition to Japan's special-category data architecture, bringing biometric data under materially tighter handling rules once the provision takes effect. #### Outlook The biometric category will not apply until Cabinet-order commencement, due no later than July 2028. Organisations handling biometric identifiers in Japan face a defined but not-yet-active compliance shift; the opt-out prohibition in particular removes a sharing pathway that exists for other categories of personal data under the current regime. D8 · AI, Biometrics & Automated — Full Module Record 6 sub-modules · 114 words · 13 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Japan: D9 Children & Vulnerable Groups5 sub-modulesRedEnacted in forceModule confidence: Probable▾ No codified statutory age-of-consent, parental-consent mechanism, minor-profiling ban, or dependent-adults regime currently exists; all children's-data protections are at the proposal stage pending the 2026/2027 reform. Primary framework Act on the Protection of Personal Information (APPI) — children's provisions pending Supervisory authority [Personal Information Protection Commission (PPC)](https://www.ppc.go.jp/en/) Traffic-light rationale — Red No codified statutory age-of-consent, parental-consent mechanism, minor-profiling ban, or dependent-adults regime currently exists; all children's-data protections are at the proposal stage pending the 2026/2027 reform. Periodic update · new data 2026-11-04 #### Children & Vulnerable Groups Commission guidance is understood, on a case-by-case basis, to treat children aged 12 to 15 or younger as generally lacking the decision-making capacity needed to give valid consent under the Act as reformed. This reporting describes a pre-enactment bill summary, and whether the same age threshold survived unchanged into Act No. 56 of 2026 as promulgated has not been independently re-verified. #### Outlook Businesses that process the personal data of minors in Japan should treat the 12-to-15 threshold as indicative rather than settled until the enacted text, or implementing guidance issued under it, is confirmed; this is a sensitivity deliberately flagged for caution rather than a definitive rule in force. Periodic update · new data 2026-10-25 #### Children & Vulnerable Groups Act No. 56/2026 is reported to introduce, for the first time, statutory provisions specifically addressing the treatment of minors' personal data, together with a newly-defined relevant age threshold. This is a notable structural development because the APPI has not previously contained bespoke statutory provisions on minors' data; the PPC's prior approach relied on non-binding Q&A guidance, which treated children aged 12 to 15 or younger as generally lacking the capacity to consent on their own behalf, assessed case-by-case rather than by a fixed statutory age line. The move to a defined statutory age threshold, once Act No. 56/2026's main body commences, would replace this case-by-case guidance-based approach with a clearer, legislatively-fixed standard, though the precise age threshold adopted in the enacted text was not established in the material available. This development is reported in secondary law-firm commentary rather than the amendment's own text, and the practical content of the new minors'-data provisions, including what additional obligations or restrictions attach to processing a minor's personal data once the threshold is crossed or not crossed, was not established. The provision is enacted but not yet in force, subject to the same Cabinet-order commencement mechanism applicable to the amendment's main body generally, with likely effect around mid-2028. #### Outlook The specific statutory age threshold adopted by Act No. 56/2026, and the substantive content of the obligations or restrictions tied to it, remain to be established from the amendment's own text or from PPC explanatory guidance; this is the clearest open item for this module. Businesses operating services directed at or accessed by minors in Japan would be the primary population affected once these provisions commence, though the lack of detail on the threshold and substantive content limits what can currently be said about practical compliance implications. Periodic update · new data 2026-10-18 #### Children & Vulnerable Groups Act No. 56/2026 is reported to introduce, for the first time, statutory provisions specifically addressing the treatment of minors' personal data, together with a newly-defined relevant age threshold. This is a notable structural development because the APPI has not previously contained bespoke statutory provisions on minors' data; the PPC's prior approach relied on non-binding Q&A guidance, which treated children aged 12 to 15 or younger as generally lacking the capacity to consent on their own behalf, assessed case-by-case rather than by a fixed statutory age line. The move to a defined statutory age threshold, once Act No. 56/2026's main body commences, would replace this case-by-case guidance-based approach with a clearer, legislatively-fixed standard, though the precise age threshold adopted in the enacted text was not established in the material available this cycle. This development is reported in secondary law-firm commentary rather than the amendment's own text, and the practical content of the new minors'-data provisions, including what additional obligations or restrictions attach to processing a minor's personal data once the threshold is crossed or not crossed, was not established this cycle. The provision is enacted but not yet in force, subject to the same Cabinet-order commencement mechanism applicable to the amendment's main body generally, with likely effect around mid-2028. #### Outlook The specific statutory age threshold adopted by Act No. 56/2026, and the substantive content of the obligations or restrictions tied to it, remain to be established from the amendment's own text or from PPC explanatory guidance; this is the clearest open item for this module. Businesses operating services directed at or accessed by minors in Japan would be the primary population affected once these provisions commence, though the lack of detail on the threshold and substantive content limits what can currently be said about practical compliance implications. Periodic update · new data 2026-10-06 #### Children & Vulnerable Groups Act No. 56 of 2026 introduces new APPI Article 40-2, Japan's first-ever minors-specific provision under the Act. This provision requires that, where APPI consent or notification is required and concerns an individual under 16 years of age, it must in principle be obtained from, or given to, that individual's legal representative rather than the minor directly. The pre-amendment APPI contained no provision of this kind, making this a genuinely new structural feature of Japan's data-protection law rather than an adjustment to an existing minors framework. This provision is enacted but not yet in force, forming part of the broader Act No. 56/2026 package. The PPC's September 2026 discussion of its implementing-rules basic concept specifically flagged youth-data protection as a rulemaking focus area, suggesting that further implementing detail on how the legal-representative-consent requirement will operate in practice is likely to follow as the Cabinet Order process develops. #### Outlook Commencement is expected by Cabinet Order no later than July 2028. Given the PPC's stated focus on youth-data protection in its implementing-rules discussion, further guidance on the practical operation of the Article 40-2 legal-representative-consent requirement, including any age-verification expectations, is a likely area for near-term regulatory attention ahead of that deadline. Periodic update · new data 2026-09-21 #### Children & Vulnerable Groups The 2026 amendment introduces Japan's first dedicated statutory provisions for minors within the APPI: a parental-consent requirement for processing the personal data of individuals under 16, coupled with enhanced deletion and suspension rights specifically for children. #### Outlook These minors' protections await Cabinet-order commencement, due no later than July 2028. Once active, they will require operators serving Japanese users under 16 to establish parental-consent mechanisms where none were previously mandated under the APPI. D9 · Children's Privacy — Full Module Record 5 sub-modules · 85 words · 8 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Japan: D10 Enforcement & Redress6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Criminal-penalty enforcement architecture and civil tort redress are settled and in force, but the absence of PPC administrative fining power and of a codified collective-redress mechanism — both under active reform — constrain current enforcement intensity. Primary framework Act on the Protection of Personal Information (APPI); Civil Code Article 709 (tort) Supervisory authority [Personal Information Protection Commission (PPC)](https://www.ppc.go.jp/en/) Traffic-light rationale — Amber Criminal-penalty enforcement architecture and civil tort redress are settled and in force, but the absence of PPC administrative fining power and of a codified collective-redress mechanism — both under active reform — constrain current enforcement intensity. Periodic update · new data 2026-11-04 #### Enforcement & Redress The 2026 amendment to the Act on the Protection of Personal Information is understood to widen the Commission's order-making power by removing the current requirement that harm be "imminent" before a standard order may issue, and to give the Commission a new statutory basis to require third parties who facilitate a violation to take steps to stop it. The same amendment is reported to introduce Japan's first administrative-fine power for privacy violations, which is not yet in force: until that provision commences, sanctions for breaches of the Act remain criminal rather than administrative. The source describing the removal of the "imminent" requirement and the third-party compel power characterised these as features of the bill as proposed, and the final enacted Article 148(2) text has not been independently re-verified against the promulgated Act No. 56 of 2026. #### Outlook The combination of broadened order-making authority, a new compel power over third parties, and a pending administrative-fine power point to a materially strengthened enforcement posture for the Commission once the relevant provisions commence; the criminal-penalty changes are expected to take effect from 17 January 2027, giving a near-term marker for when part of this tightening becomes operative, while the commencement date for the administrative-fine power itself remains unconfirmed. Periodic update · new data 2026-10-25 #### Enforcement & Redress Act No. 56/2026 is reported to represent the most significant expansion of the Personal Information Protection Commission's enforcement powers since the APPI's enactment, through two distinct mechanisms, together with a separate, already-effective enforcement-adjacent intervention by the PPC. The first mechanism is a new administrative-surcharge power: for the first time, the PPC would be empowered to order a surcharge equal to the financial gain derived from certain serious APPI violations, specifically those affecting more than 1,000 individuals, with violations caused by external attackers excluded from the surcharge's scope. This is a materially different enforcement tool from the existing order-and-criminal-sanction architecture, since it is calculated by reference to the gain realised from the violation rather than being a fixed penalty, giving the PPC a more calibrated and potentially more consequential sanction for serious, large-scale, non-breach-caused violations. The second mechanism relaxes the threshold for the PPC to issue its standard enforcement order. Amended Article 148(2) removes the requirement that harm be "imminent" before an order can issue, and the amendment separately introduces a new emergency-order power exercisable where the PPC recognises a risk of infringement to significant rights or interests. Together, these two changes lower the evidentiary and urgency bar the PPC must clear to act, materially broadening the circumstances in which it can intervene relative to the current, imminent-harm-dependent standard. Separately, and already in effect under existing law, the PPC issued a direct breach alert on 7 October 2026, "Response to Large-Scale Leakage Incidents," following a cluster of unauthorised-access breaches, urging operators to review safety-management measures and delete unneeded data. This is a Confirmed, primary-sourced action, and read alongside the pending surcharge and order-threshold changes, it indicates that the PPC is raising its practical enforcement posture ahead of, and independently of, the new statutory powers it is due to acquire once Act No. 56/2026 commences. Finally, an earlier proposal, considered in the PPC's January 2026 Policy on Institutional Amendments process, to allow qualified consumer organisations to seek injunctive relief and collective damages recovery for APPI violations, was not carried forward into the enacted Act No. 56/2026. This means Japan's APPI enforcement architecture, even after the amendment's commencement, will not include a collective-redress or class-action-style mechanism of the kind considered during the reform process. Precise commencement dates for the surcharge and relaxed order-issuance provisions have not been resolved against a primary cabinet-order source; some reporting suggests certain provisions could take effect as early as January 2027, while the main body generally is expected to commence around mid-2028. #### Outlook The clearest open item for this module is resolving the specific commencement date, or dates, for the administrative-surcharge and order-threshold provisions against a primary Cabinet-order source, given the discrepancy between early-2027 reporting for some provisions and the main body's expected mid-2028 commencement. Separately, whether the PPC's 7 October 2026 breach alert is followed by a formal Guidelines revision, and what that revision specifies, is a second clear item to track. The confirmed absence of a collective-redress mechanism from the enacted text settles that particular question for the duration of the current statutory framework, absent a further legislative initiative. Periodic update · new data 2026-10-18 #### Enforcement & Redress Act No. 56/2026 is reported to represent the most significant expansion of the Personal Information Protection Commission's enforcement powers since the APPI's enactment, through two distinct mechanisms, together with a separate, already-effective enforcement-adjacent intervention by the PPC this cycle. The first mechanism is a new administrative-surcharge power: for the first time, the PPC would be empowered to order a surcharge equal to the financial gain derived from certain serious APPI violations, specifically those affecting more than 1,000 individuals, with violations caused by external attackers excluded from the surcharge's scope. This is a materially different enforcement tool from the existing order-and-criminal-sanction architecture, since it is calculated by reference to the gain realised from the violation rather than being a fixed penalty, giving the PPC a more calibrated and potentially more consequential sanction for serious, large-scale, non-breach-caused violations. The second mechanism relaxes the threshold for the PPC to issue its standard enforcement order. Amended Article 148(2) removes the requirement that harm be "imminent" before an order can issue, and the amendment separately introduces a new emergency-order power exercisable where the PPC recognises a risk of infringement to significant rights or interests. Together, these two changes lower the evidentiary and urgency bar the PPC must clear to act, materially broadening the circumstances in which it can intervene relative to the current, imminent-harm-dependent standard. Separately, and already in effect under existing law, the PPC issued a direct breach alert on 7 October 2026, "Response to Large-Scale Leakage Incidents," following a cluster of unauthorised-access breaches, urging operators to review safety-management measures and delete unneeded data. This is a Confirmed, primary-sourced action, and read alongside the pending surcharge and order-threshold changes, it indicates that the PPC is raising its practical enforcement posture ahead of, and independently of, the new statutory powers it is due to acquire once Act No. 56/2026 commences. Finally, an earlier proposal, considered in the PPC's January 2026 Policy on Institutional Amendments process, to allow qualified consumer organisations to seek injunctive relief and collective damages recovery for APPI violations, was not carried forward into the enacted Act No. 56/2026. This means Japan's APPI enforcement architecture, even after the amendment's commencement, will not include a collective-redress or class-action-style mechanism of the kind considered during the reform process. Precise commencement dates for the surcharge and relaxed order-issuance provisions have not been resolved against a primary cabinet-order source this cycle; some reporting suggests certain provisions could take effect as early as January 2027, while the main body generally is expected to commence around mid-2028. #### Outlook The clearest open item for this module is resolving the specific commencement date, or dates, for the administrative-surcharge and order-threshold provisions against a primary Cabinet-order source, given the discrepancy between early-2027 reporting for some provisions and the main body's expected mid-2028 commencement. Separately, whether the PPC's 7 October 2026 breach alert is followed by a formal Guidelines revision, and what that revision specifies, is a second clear item to track. The confirmed absence of a collective-redress mechanism from the enacted text settles that particular question for the duration of the current statutory framework, absent a further legislative initiative. Periodic update · new data 2026-10-06 #### Enforcement & Redress Act No. 56 of 2026 introduces direct administrative monetary fines for APPI violations for the first time, marking the most significant enforcement-power upgrade in the Act's history. Implementation is expected by Cabinet Order no later than July 2028. The same amendment allows the PPC to issue a corrective order without a prior recommendation where infringement risk is imminent, removing the previous requirement that actual harm have already occurred before the regulator could intervene. Under the current, unchanged enforcement regime, non-compliance with a PPC corrective order can result in imprisonment of up to one year, or fines of up to JPY 1,000,000 for individuals and up to JPY 100,000,000 for corporate entities. These criminal penalties remain in force independently of the pending administrative-fine reform. The PPC conducted 67 investigation actions, including on-site inspections and related measures, in fiscal year 2024; no updated fiscal year 2026 enforcement-activity count has been located this cycle. On 7 September 2026 the PPC discussed its basic concept for developing the implementing rules for the amended APPI, with data-utilisation rulemaking and youth-data protection as stated focus areas. #### Outlook The specific administrative-fine amount or turnover-percentage tiers under the new enforcement regime have not yet been published, and remain the most consequential open question for affected businesses ahead of the Cabinet Order's commencement, expected no later than July 2028. Whether an updated PPC investigation-activity count for fiscal year 2026 becomes available before then is a secondary item to track. Periodic update · new data 2026-09-21 #### Enforcement & Redress The APPI Amendment Act, enacted by the Diet on 10 July 2026 and promulgated on 17 July 2026, introduces the PPC's first-ever direct administrative monetary-penalty power; the provision is enacted but not yet in force, with commencement due no later than July 2028. Separately, under the current regime, the PPC's own monitoring report published five enforcement cases for the period October 2024 to September 2025, including a list broker suspected of selling personal-data lists to an organised-crime fraud group. #### Outlook Until Cabinet-order commencement, the PPC's enforcement toolkit remains limited to administrative orders, recommendations, and reputational or publication measures rather than direct fines. The activation of direct fining power, whenever it occurs within the window to July 2028, would represent a significant shift in Japan's enforcement posture. D10 · Enforcement & Redress — Full Module Record 6 sub-modules · 129 words · 18 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ## GDPR article map Cross-reference: which category/sub-module covers each UK GDPR article (37 mapped). Show article map GDPR article to category mapping Article Category Sub-module Art. 5 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 6 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) lawful bases Art. 7 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) consent thresholds Art. 9 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) special categories Art. 13 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 14 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 15 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 16 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 17 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 18 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 19 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 20 [Data Subject Rights](#sec-cat-data_subject_rights) data portability Art. 21 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 22 [Algorithmic, Biometric & Surveillance Governance](#sec-cat-algorithmic_biometric_and_surveillance_governance) automated decision making transparency Art. 25 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 28 [Controller/Processor Duties](#sec-cat-controller_processor_duties) joint controller arrangements Art. 30 [Controller/Processor Duties](#sec-cat-controller_processor_duties) ropa requirements Art. 32 [Controller/Processor Duties](#sec-cat-controller_processor_duties) security measures Art. 33 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 34 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 35 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 37 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 38 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 39 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 44 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 45 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) adequacy received Art. 46 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 47 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 48 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) data localisation Art. 49 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 77 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 78 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 79 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 80 [Enforcement & Redress](#sec-cat-enforcement_and_redress) collective redress and class actions Art. 82 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 83 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 84 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties