What the law requires today
The Act on the Protection of Personal Information (APPI, Act No. 57 of 2003) is Japan’s general privacy law. The provisions that matter most for AI, from the official English translation:
| Article | Rule |
|---|---|
| 17(1) | Specify the purpose of use “as much as possible” |
| 18(1) | No handling beyond the scope necessary for that purpose without consent |
| 20(2) | Prior consent to acquire sensitive personal information |
| 27(1) | No third-party provision of personal data without prior consent, with exceptions |
| 28(1) | Consent for provision to a third party in a foreign country, unless equivalence applies |
The 2026 amendment
After the triennial review (draft reform policy on the PPC’s agenda on 9 January 2026), the amending law (Law No. 56 of 2026) was submitted on 7 April 2026, enacted on 10 July 2026, and promulgated on 17 July 2026. It enters into force in principle within two years, by Cabinet order.
Key points from the PPC overview:
- Statistics and AI development exception. Consent is not needed for third-party provision, or for acquiring publicly available sensitive information, when the data is used only to create statistical information, including AI development that counts as statistics creation. Recipients may not use it for other purposes, and the parties need a written agreement and must publish specified matters.
- Children under 16: consent and notices go to the legal representative, with the child’s best interests first.
- Facial feature data: opt-out third-party provision banned.
- Breach reporting relaxed, but unlawful third-party provision becomes reportable.
- Surcharge equal to gains from serious violations, and heavier criminal penalties.
The PPC is now drafting Cabinet orders, rules, and guidelines. Changes to cross-border transfer rules were not among the items we could confirm.
Where to find it
- e-Gov Law Search: the Japanese statute (the official source; we could not load it during research).
- Japanese Law Translation: the English text, reflecting amendments through Act No. 37 of 2021.
- PPC amendment page: dates and overview of the 2026 changes.
Reuse terms
Statutes are not copyrighted in Japan (Copyright Act Article 13). A 2017 MIC notice describes e-Gov law data as open data that is easy to reuse, with the Official Gazette prevailing if versions differ. PPC explanatory materials are under PDL1.0 with attribution.
Using the APPI in AI and RAG
- Document the purpose of use for every AI workflow that touches personal data.
- Keep consented and non-consented data apart in retrieval indexes.
- Treat the statistics exception carefully: it covers statistics creation only, with contracts and publication duties, and is not yet in force.
- Check cross-border transfers when AI vendors process data outside Japan.
- Store the law with its version date and update when the amendment takes effect.
Common mistakes
- Assuming the 2026 amendment already applies.
- Reading the statistics exception as a general AI training exemption.
- Using the 2021-based English text for amended provisions.
- Ignoring Article 28 for overseas AI services.
Checklist
- Purpose of use recorded per AI workflow
- Consent status tagged in indexes
- Cross-border transfers assessed
- Amendment effective dates tracked
- PPC guidelines monitored
How AskDona helps
AskDona checks your privacy notices, data maps, and vendor agreements against APPI articles you select and shows the article and your document passage behind each finding.
Run a sample APPI AI data-use check
AskDona shows the evidence; your privacy team decides.
Editor’s note. This article is general information, not legal advice. The “conditions to check” rating comes from our source list and is a first-pass judgment, not a legal opinion.
FAQ
Has Japan amended its privacy law for AI? Yes. The amendment was promulgated on 17 July 2026 and takes effect in stages within two years.
Can personal data be used to train AI without consent? The amendment allows it for statistics creation, including some AI development, under conditions, once in force.
Is the English APPI official? It is a government translation for reference; the Japanese text governs.
Do I need consent to send data to a US AI vendor? Article 28 generally requires consent for foreign third-party provision unless an equivalence route applies.
References
All pages opened and checked by October 26, 2026.
| Source | What it supports |
|---|---|
| Japanese Law Translation: APPI | Articles 17, 18, 20, 27, 28 |
| PPC: Meeting of 9 Jan 2026 | Triennial review policy draft |
| PPC: 2026 amendment page | Submission, enactment, promulgation |
| House of Councillors: bill record | Diet dates, Law No. 56 |
| PPC: Amendment overview (PDF) | Statistics and AI exception, other changes |
| MIC: e-Gov open data notice (PDF) | Law data as open data |
| Japanese Law Translation: Copyright Act | Art. 13 |