Act on the Protection of Personal Information and AI (Japan)

What it is

The Act on the Protection of Personal Information (APPI, Act No. 57 of 2003) is Japan’s general data protection law. It has no chapter on AI, but it governs any personal information an AI system collects, receives, processes or outputs. The Personal Information Protection Commission (PPC) supervises it.

Two pieces of PPC material matter most for AI. The first is the June 2023 caution on the use of generative AI services. The second is the 2026 amendment package from the APPI’s triennial review, which includes provisions designed to make AI development easier.

Who it applies to

The APPI applies to business operators handling personal information, and to government agencies and other public bodies through its public-sector provisions. The 2023 caution is addressed to businesses, to government bodies and, as reference, to members of the public who use generative AI services.

What it requires

The 2023 generative AI caution

On 2 June 2023 the PPC issued a caution on the use of generative AI services. For businesses it made two points.

• When a business enters a prompt containing personal information into a generative AI service, it must make sure that doing so is within the scope necessary to achieve the purpose it specified for that information.
• If a business enters personal data into a prompt without the individual’s prior consent and the data is handled for any purpose other than producing the response, the business may breach the APPI. Before entering such prompts it should confirm that the service provider does not use the personal data for machine learning.

Government bodies were given equivalent cautions, framed around necessary minimum use. The PPC issued a separate caution to OpenAI on the same day about collecting sensitive personal information and notifying purposes of use, and said it might take further action.

For governance teams, the practical consequences are a clear rule on what personal data may go into which AI services, and vendor due diligence that confirms whether a provider trains on customer inputs.

The 2026 amendments

The APPI is reviewed every three years. The PPC published its policy for this review on 9 January 2026. The Cabinet approved the bill on 7 April 2026, the Diet passed it on 10 July 2026 and it was promulgated on 17 July 2026. The PPC groups the changes into four areas.

Promoting appropriate data use. Consent is no longer needed for third-party provision of personal data, or for collecting published sensitive personal information, where the data is used only to create statistical information. The PPC states this includes AI development that can be treated as statistical work. Safeguards apply. Certain details must be published, provider and recipient must agree in writing that the data is only for that purpose, and other uses and onward provision are prohibited. Further changes ease consent requirements where handling clearly does not go against the individual’s wishes, and for protecting life or public health.

Rules matched to risk. Where the individual is under 16, consent and notices are directed to the legal representative, and businesses must give priority to the child’s best interests. Facial feature data gets new notice duties, easier stop-use requests and a ban on opt-out third-party provision. Obligations on processors handling entrusted personal data are revised.

Preventing improper use. Information that is not personal information but can be used to contact or influence a specific person cannot be used improperly or obtained unlawfully. Opt-out providers must confirm the identity and purpose of recipients.

Making the rules effective. The PPC’s order powers are revised, criminal penalties are strengthened, and an administrative surcharge is introduced for serious violations involving large volumes of personal information with an economic motive.

Key dates

• 2 June 2023. PPC caution on generative AI services.
• 9 January 2026. PPC policy for the triennial review amendments.
• 7 April 2026. Bill approved by Cabinet.
• 10 July 2026. Amending Act passed.
• 17 July 2026. Amending Act promulgated. Commencement is in principle within two years.

The PPC is now preparing the cabinet orders, rules and guidelines. Its published schedule shows public consultation on them from January 2027.

How it relates to other frameworks

The AI Guidelines for Business list privacy protection as one of their ten common guiding principles and point to the APPI as the binding law. The AI Basic Plan adopted under the AI Promotion Act called for the APPI amendment on AI development and statistical work, so the three instruments now form one picture.

Compared with the GDPR, the APPI has no general right not to be subject to automated decisions. The new statistical-purpose route is closer to the GDPR’s research and statistics provisions, but with its own publication and contract conditions.

A note on this page

This is Aicura’s reading of the APPI and the PPC’s materials, written to help you find your way around them. It is not legal advice. Read the primary sources from the PPC, most of which are in Japanese, and take advice on how they apply to your organisation.