#
Core consent/sensitive-data rules are settled and in force, but the absence of a GDPR Art 6-style lawful-basis architecture and the unresolved biometric/AI carve-outs create interpretive gaps pending the 2026 reform.
Sub-modules (4)
Lawful BasesAmber
The APPI does not adopt a GDPR-style enumerated lawful-basis regime; lawfulness instead flows from purpose specification, notice, and targeted consent triggers.
Claims (1):
- Unlike the GDPR, the APPI does not require a legal basis for all processing of personal information, relying instead on purpose specification and consent only at specific junctures.
Consent ThresholdsGreen
Consent is required for provision of personal data to third parties (subject to opt-out and joint-use exceptions) and for cross-border transfers absent an equivalent-system safeguard.
Claims (1):
- Operators handling personal information are in principle required to obtain data subjects' prior consent before providing personal data to third parties, subject to opt-out and joint-use exceptions.
Special CategoriesAmber
'Special care-required personal information' requires data-subject consent for collection; biometric data is not yet a defined sensitive category but reform is proposed.
Claims (3):
- The current APPI generally requires data subjects' consent for the collection of special care-required (sensitive) personal information such as race and medical history.
- Biometric data is not currently categorised as sensitive personal information under Japanese law, and no dedicated biometric-handling rules yet exist.
- The pending APPI amendment bill would introduce a 'Specific Biometric Personal Information' category (facial recognition data) requiring notice to data subjects and granting an unconditional right to demand suspension of use.
Pseudonymisation And AnonymisationGreen
The 2020 amendment created a 'pseudonymised information' category (internal-use only, reduced obligations) alongside the pre-existing 'anonymously processed information' concept.
Claims (1):
- The 2020 APPI amendment introduced 'pseudonymised information,' a category limited to internal statistical use, exempting operators from certain obligations such as responding to disclosure or cessation-of-use demands for retained personal data.
Lawful Processing & Special Data
Act No. 56/2026 introduces two distinct changes to Japan's lawful-processing landscape, neither of which is yet in force. The first is a new consent exemption for sharing personal information for statistical analysis purposes, a category explicitly understood to include AI-development data-sharing. This exemption is limited to recipients that either handle personal information themselves or are administrative organs, and where the recipient is located outside Japan, the exemption is conditioned on safeguards that comply with PPC regulation. This is a notable accommodation for data flows supporting statistical and AI-model-development activity, an area where Japan's existing consent-centric framework has previously required a more case-by-case lawful-basis analysis; the new exemption, once effective, would give data holders and recipients a defined statutory pathway rather than relying solely on anonymisation or existing statistical-purpose carve-outs.
The second change relaxes the consent requirement itself, through amendments to Article 20(2)(vii), governing acquisition of personal information, and Article 27(1)(viii), governing third-party provision, for processing that is clearly necessary and unavoidable for performance of a contract. The PPC is expected to specify further qualifying cases by regulation once this provision commences, meaning the practical scope of the relaxation will depend on forthcoming subordinate rulemaking rather than being fully determined by the statutory text alone.
Both changes are enacted but not yet effective, tied to the main body's Cabinet-order commencement date discussed in the Regulator & Framework module, and both rest on law-firm secondary commentary rather than direct retrieval of the amendment's text or the PPC's own explanatory materials.
Outlook
The practical significance of the contract-necessity consent relaxation will turn substantially on the content of the PPC's forthcoming implementing regulation specifying qualifying cases, which has not yet been published or characterised in detail. Similarly, the scope of the new statistical/AI-development consent exemption, in particular what counts as a qualifying "recipient handling personal information" and what PPC-regulation-compliant safeguards will be required for foreign recipients, remains to be clarified by subordinate rulemaking. Both items are worth tracking as the main body's commencement date approaches and as the PPC publishes further implementing guidance.
2 earlier distinct update(s)
Lawful Processing & Special Data
Act No. 56 of 2026 creates a new consent exemption under APPI Article 30-2(1), applicable once the amendment takes effect. Under this provision, businesses may collect publicly available sensitive personal data without obtaining prior consent, provided the sole purpose of the collection is statistical creation, or provision to a third party for that statistical purpose. This exemption is bounded by transparency measures and contractual safeguards rather than operating as an unconditional carve-out: businesses relying on it are understood to remain subject to disclosure obligations about the collection, and to contractual terms governing any onward provision to a third party for statistical use.
This provision is enacted but not yet in force, part of the broader Act No. 56/2026 package expected to commence by Cabinet Order no later than July 2028. It represents a liberalising development within an otherwise tightening reform package, narrowing the consent requirement specifically for a defined statistical-purpose use case while the remainder of the amendment strengthens enforcement and governance obligations elsewhere in the Act.
Outlook
The scope of 'publicly available' sensitive personal data eligible for this exemption, and the precise content of the transparency measures and contractual safeguards required to rely on it, are expected to be clarified through the same Cabinet Order and implementing-rules process addressed under Regulator & Framework, with no later deadline than July 2028.
Lawful Processing & Special Data
The APPI Amendment Act materially widens lawful-processing grounds ahead of its eventual entry into force. A new consent exemption permits collection of publicly available sensitive data and third-party sharing of such data for statistical processing, including AI model development, subject to transparency requirements and contractual safeguards. Separately, the amendment adds a distinct consent exception for processing that "clearly does not prejudice" individuals' rights and interests, and lowers the threshold for invoking existing public-interest exceptions.
Outlook
Because both provisions are enacted but not yet in force, their practical effect awaits Cabinet-order commencement, due no later than July 2028. The AI-training consent exemption in particular positions Japan's regime to diverge somewhat from stricter consent-first approaches elsewhere, a divergence that will become concrete only once implementing guidance and commencement dates are set.
Sources and claims (6)
- ConfirmedIAPP — Unlike the GDPR, the APPI does not require a legal basis for all processing of personal information, relying instead on purpose specification and consent only at specific junctures.observed
- ConfirmedIAPP — Operators handling personal information are in principle required to obtain data subjects' prior consent before providing personal data to third parties, subject to opt-out and joint-use exceptions.observed
- ConfirmedIAPP — The current APPI generally requires data subjects' consent for the collection of special care-required (sensitive) personal information such as race and medical history.observed
- ConfirmedIAPP — Biometric data is not currently categorised as sensitive personal information under Japanese law, and no dedicated biometric-handling rules yet exist.observed
- ProbableIAPP — The pending APPI amendment bill would introduce a 'Specific Biometric Personal Information' category (facial recognition data) requiring notice to data subjects and granting an unconditional right to demand suspension of use.observed
- ConfirmedIAPP — The 2020 APPI amendment introduced 'pseudonymised information,' a category limited to internal statistical use, exempting operators from certain obligations such as responding to disclosure or cessation-of-use demands for retained personal data.observed