ブログ
Overview of the 2026 Amendments to the Act on the Protection of Personal Information
2026.06.05
SHARE
On April 7, 2026, the “Bill for the Act Partially Amending the Act on the Protection of Personal Information and Other Related Acts” (hereinafter referred to as the “Bill”) was approved by the Cabinet, and the proposed amendments to the Act on the Protection of Personal Information included therein (hereinafter referred to as the “2026 Amended APPI” or the “Amended Act”) were made public.
The Bill provides for necessary measures to further strengthen the protection of personal information while giving consideration to the usefulness of personal information, in light of the fact that, with the rapid advancement of digital technologies, demand for the utilization of data including personal information has increased, while, at the same time, the risk of infringement of individuals’ rights and interests due to unlawful handling of personal information has also increased. The Bill has been submitted to the 221st Extraordinary Session of the Diet.
In this article, we explain the outline of the 2026 Amended APPI based on the information currently available.[i]
[i] The materials relating to the 2026 Amended APPI published on the website of the Personal Information Protection Commission are as follows:
- Outline Materials
- Outline of the Bill
- Bill and Reasons
- Comparison Table of Current and Amended Provisions
- Referenced Provisions
Legislative Background of the 2026 Amended APPI
Pursuant to Article 10 of the Supplementary Provisions of the 2020 Amended Act,[ii] the Personal Information Protection Commission has been conducting discussions since November 2023 regarding the so-called “review every three years” of the Act on the Protection of Personal Information[iii] (hereinafter referred to as the “Current APPI” or the “Current Act”), and, in March 2025, published the document entitled "Approach to Institutional Issues under the Act on the Protection of Personal Information[iv]" (hereinafter referred to as the “Approach”).
Thereafter, although there was no progress in the discussions regarding the “review every three years” for a period of ten months, in January 2026, the Personal Information Protection Commission published the “Policy for Institutional Revisions under the Act on the Protection of Personal Information in Connection with the So-Called Review Every Three Years[v]" (hereinafter referred to as the “Revision Policy”), thereby clarifying the direction of the 2026 Amended APPI.
Subsequently, on April 7, 2026, the Bill was approved by the Cabinet and its contents were disclosed, thereby clarifying the contents of the 2026 Amended APPI submitted to the 221st Extraordinary Session of the Diet. The Extraordinary Session is scheduled to be held from February 18 through July 17 of 2026, and, if the proposed amendments are enacted during such session, the proposed amendments to the Act on the Protection of Personal Information included in the Bill will become the “2026 Amended APPI.”
As a general rule, the 2026 Amended APPI will come into effect on a date specified by Cabinet Order within a period not exceeding two years from the date of promulgation (main clause of Article 1 of the Supplementary Provisions of the Amended Act).
[ii] Article 10 of the Supplementary Provisions provides as follows: “The government shall, every three years after the enforcement of this Act, review the status of enforcement of the New Act on the Protection of Personal Information, taking into consideration international trends concerning the protection of personal information, developments in information and communications technology, and the status of creation and development of new industries utilizing personal information accompanying such developments, and, where it finds it necessary, shall take necessary measures based on the results of such review.”
[iii] Act on the Protection of Personal Information (Act No. 57 of 2003)
[iv] Personal Information Protection Commission, “Approach to Institutional Issues under the Act on the Protection of Personal Information” (March 5, 2025).
[v] Personal Information Protection Commission, “Policy for Institutional Revisions under the Act on the Protection of Personal Information in Connection with the So-Called Review Every Three Years” (January 9, 2026).
Items Covered by the 2026 Amended APPI
The document published by the Personal Information Protection Commission entitled “Bill for the Act Partially Amending the Act on the Protection of Personal Information and Other Related Acts (Outline)” (hereinafter referred to as the “Outline Materials”) explains the amendments under four categories: “Promotion of Appropriate Data Utilization,” “Rules Corresponding Appropriately to Risks,” “Prevention of Improper Use, etc.,” and “Rules for Securing the Effectiveness of Compliance” (Outline Materials, “Details of Amendments,” Items 1 through 4). These four categories of amendments include the following twelve amendment items under the 2026 Amended APPI.
|
Amendment Category |
Amendment Item |
|
Promotion of Appropriate Data Utilization |
1. Exemption from the obligation to obtain consent for purposes of statistical compilation, etc. 2. Relaxation of requirements for exceptions relating to the obligation to obtain consent |
|
Rules Corresponding Appropriately to Risks |
3. Clarification and strengthening of regulations concerning children’s personal information 4. Establishment of regulations concerning facial feature data, etc. 5. Development of regulations applicable to entrusted business operators 6. Relaxation of the obligation to notify data subjects in the event of leakage, etc. |
|
Prevention of Improper Use, etc. |
7. Strengthening of regulations concerning information enabling approaches to specific individuals 8. Mandatory confirmation of the identity of recipients and purposes of use in connection with opt-out provision |
| Rules for Securing the Effectiveness of Compliance |
9. Greater flexibility in the exercise of recommendations and orders 10. Legalization of measures against third parties assisting, etc. violations 11. Strengthening and expansion of criminal penalties 12. Introduction of an administrative surcharge system |
In this article, we explain the outline of the 2026 Amended APPI by organizing the information currently available regarding each of the above items 1 through 12 (note that the 2026 Amended APPI includes amendments relating to both the private sector and the public sector; however, the discussion below addresses amendments relating to the private sector rules).
Contents of the 2026 Amended APPI
1. Exemption from the Obligation to Obtain Consent for Purposes of Statistical Compilation, etc.
Under the Current APPI, even where personal data is used solely for the preparation of statistical information, etc., obtaining consent is, in principle, required for the provision of personal data to third parties and the acquisition of special care-required personal information (Articles 27, 28, and 20, Paragraph 2 of the Current APPI).
With respect to this point, the Approach noted that there is an increasing need for multiple business operators to share and analyze data across organizations for the purpose of preparing statistical information, etc., and that the preparation and use of statistical information, etc. from which correspondence relationships with specific individuals have been excluded present a low risk of infringing individuals’ rights and interests. Accordingly, it had been proposed that the provision of personal data, etc. to third parties and the acquisition of publicly disclosed special care-required personal information without obtaining the data subject’s consent be permitted, subject to conditions including assurance that such information will be used solely for the preparation of such statistical information, etc. (Approach, pp. 1–2). Based on such discussions, the Revision Policy indicated a policy of exempting consent requirements for the provision of personal data, etc. to third parties and the acquisition of publicly disclosed special care-required personal information, subject to conditions including assurance that the information will be used solely for the preparation of statistical information, etc. (including AI development, etc. that can be categorized as statistical compilation, etc.) (Revision Policy, pp. 1–2).
The 2026 Amended APPI establishes the following rules concerning exemptions from the obligation to obtain consent where information is used solely for the preparation of statistical information, etc.
|
Subject of Amendment |
vSpecific Details of Amendment |
|
Definitions of “Statistical Compilation, etc.” and “Purpose of Statistical Compilation, etc.” |
|
|
Conditions for Exemption from the Obligation to Obtain Consent under the Special Provisions for Statistical Compilation, etc. |
|
|
Continuous Publication Obligation |
|
|
vProhibition on Use for Purposes Other than Intended Purposes and Prohibition on Third-Party Provision[xii] |
|
[vi] This is limited to cases where all purposes for handling the special care-required personal information are for purposes of statistical compilation, etc. or for the purpose of making the relevant provision (Article 30-2, Paragraph 1 of the Amended Act).
[vii] Where the matters subject to public disclosure are to be changed, such fact and the details of such changes must be publicly disclosed in advance (main clause of Article 30-2, Paragraph 3 of the Amended Act); provided, however, that, where certain publicly disclosed matters (e.g., the name or designation of the acquirer) are to be changed, it is sufficient to publicly disclose such matters promptly after such change has been made (proviso to Article 30-2, Paragraph 3 of the Amended Act).
v[viii] It should be noted that personal information or personally referable information received through third-party provision pursuant to the special provisions for statistical compilation, etc. may not again be provided to a third party pursuant to the special provisions for statistical compilation, etc. (proviso to the introductory clause of Article 30-2, Paragraph 5 and proviso to the introductory clause of Article 31-3, Paragraph 1 of the Amended Act).
[ix] Under the special provisions for statistical compilation, etc., the regulations concerning the provision of personal data or personally referable information to third parties located in foreign countries (Article 28 and Article 31, Paragraph 1, Item 2 of the Current APPI) are not excluded from application. Accordingly, it should be noted that, in relation to third parties located in foreign countries, it is necessary to establish a so-called “system conforming to standards” (Article 30-2, Paragraph 5 and Article 31-3, Paragraph 1 of the Amended Act). Where information subject to the special provisions for statistical compilation, etc. is provided to a third party located in a foreign country that has established a system conforming to standards, necessary measures must be taken to ensure the continuous implementation of equivalent measures by such third party, and information concerning such necessary measures must also be publicly disclosed (Article 30-2, Paragraph 13 and Article 31-3, Paragraph 9 of the Amended Act).
[x] This is limited to cases where all purposes for handling the personal information or personally referable information are for purposes of statistical compilation, etc. (Article 30-2, Paragraph 5 and Article 31-3, Paragraph 1 of the Amended Act).
[xi] Where the matters subject to public disclosure are to be changed, both the relevant business operator and the relevant third party must publicly disclose in advance such fact and the details of such changes (main clause of Article 30-2, Paragraph 7 and main clause of Article 31-3, Paragraph 3 of the Amended Act); provided, however, that, where certain publicly disclosed matters (e.g., the name or designation of the recipient) are to be changed, it is sufficient for the relevant third party to publicly disclose such matters promptly after such change has been made (proviso to Article 30-2, Paragraph 7, Paragraph 8 of the same Article, proviso to Article 31-3, Paragraph 3, and Paragraph 4 of the same Article of the Amended Act).
[xii] It should be noted that information subject to the special provisions for statistical compilation, etc., where it constitutes personal data, remains subject to the applicable rules in the ordinary manner, and, even where it does not constitute personal data, becomes subject, pursuant to mutatis mutandis application provisions, to the obligation to take security control measures (Article 23 of the Current APPI), the obligation to supervise employees (Article 24 of the Current APPI), and the obligation to supervise contractors (Article 25 of the Current APPI) (Article 30-2, Paragraph 14 and Article 31-3, Paragraph 10 of the Amended Act. In addition, where the obligation to take security control measures applies mutatis mutandis, “leakage, loss, or damage” is deemed to be replaced with “leakage.”).
[xiii] The phrase “information subject to the exception for statistical compilation, etc. or information concerning individuals obtained by reproducing or processing such information” as used herein is intended to refer to statistical compilation-use special care-required personal information, etc., provision statistical compilation-use personal information, etc., and provision statistical compilation-use personal data, etc. The definitions of each term are as follows:
- “Statistical Compilation-Use Special Care-Required Personal Information, etc.”: Special care-required personal information acquired pursuant to Article 30-2, Paragraph 1 of the Amended Act, or information concerning a living individual obtained by reproducing or processing all or part thereof (Article 30-2, Paragraph 4 of the Amended Act).
- “Provision Statistical Compilation-Use Personal Information, etc.”: Personal information received pursuant to the main clause of Article 30-2, Paragraph 5 of the Amended Act, or information concerning a living individual obtained by reproducing or processing all or part thereof (Article 30-2, Paragraph 6 of the Amended Act).
- “Provision Statistical Compilation-Use Personal Data, etc.”: Personally referable information received pursuant to the main clause of Article 31-3, Paragraph 1 of the Amended Act, or information concerning a living individual obtained by reproducing or processing all or part thereof (Article 31-3, Paragraph 2 of the Amended Act).
2. Relaxation of Requirements for Exceptions Relating to the Obligation to Obtain Consent
Under the Current APPI, in cases involving use for purposes other than intended purposes, acquisition of special care-required personal information, and provision to third parties, obtaining the data subject’s consent is generally required (Articles 18, 20, Paragraph 2, 27, and 28 of the Current APPI). As relaxation measures concerning these consent requirements, the 2026 Amended APPI establishes the following three revisions.
(1) Establishment of New Exceptions for Handling Clearly Not Contrary to the Data Subject’s Intentions and Clearly Not Harmful to the Data Subject’s Rights and Interests in Light of the Circumstances of Acquisition
Under the Current APPI, even where it is clear from the circumstances of acquisition that handling is not contrary to the data subject’s intentions and therefore clearly does not harm the data subject’s rights and interests, exemption from the obligation to obtain consent is not available. In contrast, the Revision Policy indicated a policy that consent should not be required where handling is clearly not contrary to the data subject’s intentions and clearly does not harm the data subject’s rights and interests in light of the circumstances of acquisition (Revision Policy, p. 2).
Under the 2026 Amended APPI, the obligation to obtain the data subject’s consent is exempted where it is clearly unavoidable and necessary for the performance of a contract with the data subject, or where it falls within cases specified by the rules of the Personal Information Protection Commission as being clearly not contrary to the data subject’s intentions and clearly not harmful to the data subject’s rights and interests in light of the circumstances of acquisition of the relevant personal information, etc. (Article 18, Paragraph 3, Item 7; Article 20, Paragraph 2, Item 7; and Article 27, Paragraph 1, Item 8 of the Amended Act).
Specific examples falling within this exception included, in the Approach: (i) where an individual makes a reservation for accommodation at a hotel operated by Business Operator B through a hotel reservation website operated by Business Operator A, and Business Operator A provides the individual’s name and related information to Business Operator B; and (ii) where a financial institution provides remitter information to the recipient financial institution in order to conduct an overseas remittance (Approach, p. 2).
(2) Relaxation of the Requirement of Difficulty in Obtaining Consent
Under the Current APPI, exceptions to the obligation to obtain consent include cases where “it is necessary for the protection of a person’s life, body, or property and it is difficult to obtain the consent of the individual,” and cases where “it is particularly necessary for improving public health or promoting the sound growth of children and it is difficult to obtain the consent of the individual” (Article 18, Paragraph 2, Items 2 and 3; Article 20, Paragraph 2, Items 2 and 3; and Article 27, Paragraph 1, Items 2 and 3 of the Current APPI), all of which require difficulty in obtaining consent.
With respect to this point, the Revision Policy indicated a policy of relaxing such difficulty-in-obtaining-consent requirements (Revision Policy, p. 2).
Under the 2026 Amended APPI, reliance on exceptions to the obligation to obtain consent is permitted not only where “it is difficult to obtain the consent of the individual,” but also where “there are otherwise reasonable grounds for not obtaining the consent of the individual” (Article 18, Paragraph 2, Items 2 and 3; Article 20, Paragraph 2, Items 2 and 3; and Article 27, Paragraph 1, Items 2 and 3 of the Amended Act).
Specific examples corresponding to “other reasonable grounds for not obtaining the consent of the individual” included, at the stage of the Approach, cases where necessary and appropriate measures to prevent infringement of the individual’s privacy, etc. (such as deletion of names and execution of confidentiality agreements with recipients) have been implemented, such that there is no risk of unjust infringement of the individual’s rights and interests (Approach, p. 3).
(3) Clarification that Entities Providing Medical Services Are Included within Academic Research Institutions, etc.
Under the Current APPI, “academic research institutions, etc.” refers to universities and other institutions or organizations whose purpose is academic research, or persons belonging thereto (Article 16, Paragraph 8 of the Current APPI), and therefore institutions or organizations whose purpose is providing medical services are not necessarily included.
With respect to this point, the Approach pointed out that, in medical and life sciences research, analysis of clinical cases concerning diagnostic and treatment methods that are the subject of research is indispensable, and that research activities by hospitals and other institutions or organizations providing medical services are widely conducted in practice (Approach, p. 3). Based on such observations, the Revision Policy indicated a policy of clarifying that institutions or organizations whose purpose is the provision of medical services are included within “academic research institutions, etc.” that are subject to exceptions relating to academic research (Revision Policy, p. 2).
vUnder the 2026 Amended APPI, by adding parenthetical language to the definition of “academic research institutions, etc.” stating “(including hospitals prescribed in Article 1-5, Paragraph 1 of the Medical Care Act … and other institutions or organizations whose purpose is the provision of medical services),” it was clarified that institutions or organizations whose purpose is the provision of medical services are included within the definition of “academic research institutions, etc.” (Article 16, Paragraph 9 of the Amended Act).
3. Clarification and Strengthening of Regulations Concerning Children’s Personal Information
Under the Current APPI, the age threshold for children subject to consent acquisition and notification is not specified at the statutory level, and the Q&A published by the Personal Information Protection Commission merely states that consent should be obtained from a statutory representative, etc. for children approximately between the ages of 12 and 15 or younger.[xiv]
In addition, the Current APPI does not contain provisions specific to children with respect to requests for suspension of use, etc. of retained personal data. Furthermore, there are no provisions establishing a duty to prioritize consideration of the best interests of the child.
With respect to these points, the Approach pointed out that, because children are in developmental stages physically and mentally and therefore possess insufficient judgment capacity and are more susceptible to adverse effects arising from inappropriate handling of personal information, it is necessary to establish certain rules from the perspective of appropriately protecting children’s development and rights and interests (Approach, p. 2). Based on such observations, the Revision Policy indicated the following policies: (i) expressly providing that consent acquisition, notifications, etc. concerning persons under 16 years of age shall be directed to their statutory representatives; (ii) relaxing the requirements for requests for suspension of use, etc. of retained personal data by persons under 16 years of age; and (iii) adding provisions establishing a duty to prioritize consideration of the best interests of minors with respect to the handling of personal information, etc. of minors (Revision Policy, p. 2).
The 2026 Amended APPI establishes the following rules concerning the handling of children’s personal information.
|
Subject of Amendment |
Specific Details of Amendment |
|
Clarification that consent acquisition, notifications, etc. concerning persons under 16 years of age shall be directed to their statutory representatives |
|
|
Relaxation of requirements for requests for suspension of use, etc. of retained personal data by persons under 16 years of age |
|
| Addition of provisions establishing a duty to prioritize consideration of the best interests of minors with respect to the handling of personal information, etc. of minors |
|
[xiv] Personal Information Protection Commission, “Q&A Concerning the ‘Guidelines for the Act on the Protection of Personal Information’” (July 1, 2025), A1-62.
4. Establishment of Regulations Concerning Facial Feature Data, etc.
Under the Current APPI, facial feature data, etc. may constitute personal identification codes (Article 2, Paragraph 2 of the Current APPI and Article 1, Item 1(b) of the Order for Enforcement of the Current APPI); however, no requirements specifically applicable to facial feature data, etc. are prescribed.
With respect to this point, the Approach pointed out that, amid the expanding use of biometric technologies such as camera systems equipped with facial recognition functions, facial feature data, etc. among biometric data possess the characteristics that they can easily (and therefore massively) be obtained without the knowledge of the individual, and that they have high uniqueness and immutability such that their effect in identifying specific individuals continues semi-permanently. Accordingly, facial feature data, etc. have characteristics making their handling more likely than other biometric data to lead typologically to infringement of individuals’ privacy, etc. (Approach, p. 6). Based on such observations, the Revision Policy indicated the following amendment policies: (i) mandating notification of certain matters relating to the handling of facial feature data, etc.; (ii) relaxing the requirements for requests for suspension of use, etc. of facial feature data, etc.; and (iii) prohibiting third-party provision of facial feature data, etc. through the opt-out mechanism (Revision Policy, p. 2).
The 2026 Amended APPI establishes the following rules concerning regulations applicable to facial feature data, etc.
|
Subject of Amendment |
Specific Details of Amendment |
| Definitions of “Specified Biometric Personal Identification Code” and “Specified Biometric Personal Information” |
|
| Mandatory notification of certain matters relating to the handling of facial feature data, etc. |
|
| Relaxation of requirements for requests for suspension of use, etc. of facial feature data, etc. |
|
| Prohibition of third-party provision of facial feature data, etc. through the opt-out mechanism |
|
5. Development of Regulations Applicable to Entrusted Business Operators
Under the Current APPI, where the handling of personal data is entrusted to another party, the entrusting business operator is required to exercise necessary and appropriate supervision over the entrusted business operator (Article 25 of the Current APPI). However, apart from this requirement, no provisions specifically applicable to entrusted business operators are prescribed, and the general rules applicable to business operators handling personal information apply.
With respect to this point, the Approach proposed examining the appropriate framework of regulations applicable to entrusted business operators in light of the expanding number of cases in which business operators handling personal information, etc., in connection with the advancement of DX, substantially depend on third parties for the handling of personal data, etc. (Approach, p. 5). In response to such discussions, the Revision Policy indicated the following policies: (i) expressly providing that entrusted business operators must not handle personal data, etc. beyond the scope necessary for the performance of entrusted operations; and (ii) establishing conditions under which obligations otherwise applicable to entrusted business operators are exempted (Revision Policy, p. 2).
The 2026 Amended APPI newly establishes the following obligations and exemptions concerning regulations applicable to entrusted business operators.
|
Subject of Amendment |
Specific Details of Amendment |
| Express clarification that entrusted business operators must not handle personal data, etc. beyond the scope necessary for the performance of entrusted operations |
|
| Establishment of conditions under which obligations applicable to entrusted business operators are exempted |
|
6. Relaxation of the Obligation to Notify Data Subjects in the Event of Leakage, etc.
Under the Current APPI, where a business operator handling personal information is subject to the obligation to report leakage, etc., the business operator is uniformly required to notify the individual unless notification to the individual is difficult and alternative measures have been taken (Article 26, Paragraph 2 of the Current APPI).
With respect to this point, the Revision Policy indicated a policy of relaxing the obligation to notify individuals in cases of leakage, etc. where there is little risk of inadequate protection of the individual’s rights and interests, from the perspective of rationalizing the notification obligation (Revision Policy, p. 2).
The 2026 Amended APPI adds, as an exception to the obligation to notify individuals, “cases specified by the rules of the Personal Information Protection Commission as cases where there is little risk of inadequate protection of the individual’s rights and interests even if notification to the individual is not made” (proviso to Article 26-2 of the Amended Act).
As specific examples falling under the above exception, the Approach had cited cases where only information that, by itself, has virtually no meaning to the acquirer of the leaked information—such as internal identifiers (IDs) of service users—has been leaked (Approach, p. 3).
7. Strengthening of Regulations Concerning Information Enabling Approaches to Specific Individuals
Under the Current APPI, prohibitions on improper use and improper acquisition are prescribed for personal information (Articles 19 and 20, Paragraph 1 of the Current APPI); however, no such provisions are prescribed for personally referable information, pseudonymously processed information, or anonymously processed information.
With respect to this point, the Approach pointed out that, even where information including telephone numbers, email addresses, Cookie IDs, and other descriptions, etc. enabling contact with specific individuals does not constitute personal information, infringement of the privacy, property rights, and other rights and interests of such individuals may nevertheless occur through contact with such individuals. In addition, by linking together information including highly confidential descriptions, etc. through such descriptions, etc., there is a risk that privacy, etc. may be infringed or that infringements of individuals’ rights and interests through such contact may become more serious (Approach, p. 5). Based on such observations, the Revision Policy indicated a policy of prohibiting improper use and improper acquisition of personally referable information, etc. enabling approaches to specific individuals (Revision Policy, p. 2).
The 2026 Amended APPI establishes the following rules as regulations concerning information enabling approaches to specific individuals.
|
Subject of Amendment |
Specific Details of Amendment |
| Definition of “Contactable Personally Referable Information” |
|
| Prohibition of improper handling of information enabling approaches to specific individuals |
|
[xv] Limited to information usable for postal delivery, correspondence delivery service, telegram delivery, or visits directed to specific individuals (Article 2, Paragraph 8, Item 1 of the Amended Act).
[xvi] Limited to information usable for telephone calls or facsimile transmissions directed to specific individuals (Article 2, Paragraph 8, Item 2 of the Amended Act).
[xvii] Refers to email addresses under the Act on Regulation of Transmission of Specified Electronic Mail and is limited to information usable for transmission of electronic mail prescribed under such Act to specific individuals (Article 2, Paragraph 8, Item 3 of the Amended Act).
[xviii] Limited to information usable for transmission of information through telecommunications directed to specific individuals (Article 2, Paragraph 8, Item 4 of the Amended Act).
8. Mandatory Confirmation of the Identity and Purpose of Use of Recipients under the Opt-Out Mechanism
Under the Current APPI, where personal data is provided to third parties pursuant to the opt-out mechanism, confirmation of the identity and purpose of use of the recipient is not required (Article 27, Paragraph 2 of the Current APPI).
With respect to this point, the Approach pointed out that, amid the recent worsening of the so-called “black market list” problem, cases have occurred in which list brokers that were opt-out notification business operators provided lists while recognizing that the recipients were malicious list brokers (i.e., entities reselling lists even to persons engaging in unlawful acts), and that personal data provided pursuant to the opt-out mechanism currently serves as one of the sources used in the creation of such “black market lists” (Approach, p. 7). Based on such observations, the Revision Policy indicated a policy of mandating confirmation of the identity and purpose of use of recipients at the time of third-party provision pursuant to the opt-out mechanism (Revision Policy, p. 2).
The 2026 Amended APPI establishes the following rules concerning mandatory confirmation of the identity and purpose of use of recipients under the opt-out mechanism.
|
Subject of Amendment |
Specific Details of Amendment |
| Obligation to confirm recipients under the opt-out mechanism |
|
| Prohibition of false statements concerning confirmation of recipients under the opt-out mechanism |
|
| Recordkeeping obligation concerning confirmation of recipients under the opt-out mechanism |
|
9. Greater Flexibility in the Exercise of Recommendations and Orders
Under the Current APPI, an “order” requiring prior recommendation may be issued only “where it is recognized that infringement of a significant right or interest of an individual is imminent,” meaning that imminence of infringement is required (Article 148, Paragraph 2 of the Current APPI). In addition, an “emergency order” not requiring prior recommendation may be issued only “where it is recognized that urgent measures are necessary because there exists a fact harming a significant right or interest of an individual,” meaning that actual infringement of a significant right or interest must exist (Article 148, Paragraph 3 of the Current APPI). Further, recommendations may only require “cessation of the violation and other measures necessary to correct the violation” (Paragraph 1 of the same Article) and cannot require affirmative measures intended to make individuals aware that problematic handling has occurred (e.g., notification to individuals or public disclosure).
In light of such circumstances, the Revision Policy indicated the following amendment policies from the perspective of introducing greater flexibility in the exercise of recommendations and orders: (i) revising the requirements for orders so as to enable prompt correction of violations; and (ii) introducing greater flexibility in the contents of recommendations and orders so as to enable measures necessary for the protection of rights and interests, such as notification or public disclosure of facts relating to violations (Revision Policy, p. 2).
The 2026 Amended APPI establishes the following rules from the perspective of introducing greater flexibility in the exercise of recommendations and orders.
|
<strong>Subject of Amendment |
Specific Details of Amendment |
| Relaxation of requirements for orders enabling prompt correction of violations |
|
| Greater flexibility in the contents of recommendations and orders enabling measures necessary for protection of rights and interests, such as notification or public disclosure of facts relating to violations |
|
10. Legalization of Measures Against Third Parties Assisting Violations, etc.
Under the Current APPI, orders may be issued only against business operators handling personal information, etc. that have violated obligations under the APPI (Article 148, Paragraphs 2 and 3 of the Current APPI), and no orders may be issued to third parties involved in such violations requiring suspension of services provided to such business operators handling personal information, etc. In addition, no statutory basis exists even for voluntary requests.
In light of such circumstances, the Revision Policy indicated a policy of establishing statutory provisions serving as the basis for requesting third parties assisting violations, etc. to take measures necessary to cease such violations (Revision Policy, p. 2).
The 2026 Amended APPI establishes the following rules concerning measures against third parties assisting violations, etc.
|
Subject of Amendment |
Specific Details of Amendment |
| Requests to “Handling-Related Service Providers” |
|
| Requests to “Specified Telecommunications Service Providers” |
|
| Immunity where measures are taken in response to requests |
|
[xix] Act Partially Amending the Act on Limitation of Liability for Damages of Specified Telecommunications Service Providers and Disclosure of Sender Information (Act No. 25 of 2024).
11. Strengthening and Expansion of Criminal Penalties
Under the Current APPI, criminal penalties relating to wrongful provision, etc. of personal information databases, etc. apply only where the relevant act is conducted “for the purpose of obtaining unlawful gain,” and do not apply where the relevant act is conducted “for the purpose of causing harm” (Article 179 of the Current APPI).
With respect to this point, the Approach pointed out that, in terms of the degree of harm to the rights and interests of the individual, there is no meaningful difference between acts conducted for the purpose of obtaining unlawful gain and acts conducted for the purpose of causing harm (Approach, p. 10). Based on such observations, the Revision Policy indicated a policy of expanding the scope of punishable conduct relating to wrongful provision, etc. of personal information databases, etc. so as to include acts conducted for the purpose of causing harm, and of increasing the statutory penalties therefor (Revision Policy, p. 3).
In addition, under the Current APPI, criminal penalties relating to wrongful provision, etc. of personal information databases, etc. apply to acts of provision or misappropriation, and do not apply to acquisition itself (Article 179 of the Current APPI).
With respect to this point, the Approach pointed out that personal information improperly acquired is highly likely to be improperly used, and that acts of acquiring personal information through fraudulent acts, unauthorized access, or other conduct impairing the management of persons possessing personal information should therefore be made directly punishable (Approach, p. 10). Based on such observations, the Revision Policy indicated a policy of establishing criminal penalties for acts of improperly acquiring personal information through fraudulent acts, etc. (Revision Policy, p. 3).
The 2026 Amended APPI establishes the following revisions from the perspective of strengthening and expanding criminal penalties.
|
Subject of Amendment |
Specific Details of Amendment |
| Expansion of punishable conduct and increase of statutory penalties relating to wrongful provision, etc. of personal information databases, etc. |
|
| Establishment of new criminal penalties for acts of improperly acquiring personal information through fraudulent acts, etc. |
|
12. Introduction of an Administrative Surcharge System
Under the Current APPI, monetary sanctions for violations of the APPI are limited to criminal fines, and administrative surcharges cannot be imposed.
With respect to this point, the Approach pointed out that administrative surcharges are imposed flexibly as administrative measures and are introduced for the purpose of deterring violations by reducing the economic incentives for such violations, and that they play an important role in law enforcement in modern market-based societies oriented toward ex post facto review (Approach, p. 10). In addition, from the perspective of conducting careful discussions regarding the surcharge system, deliberations were conducted from July 2024 by the “Study Group on the So-Called Review Every Three Years of the Act on the Protection of Personal Information,” and a report [xx] was compiled at the end of December of the same year.
Based on such observations, the Revision Policy indicated a policy that, in order to effectively deter malicious violations involving the handling of large volumes of personal information for economic incentives, where individuals’ rights and interests are infringed by serious violations, payment of an administrative surcharge equivalent to the amount of financial gain, etc. obtained through such violations shall be ordered (Revision Policy, pp. 3 and 6).
The 2026 Amended APPI introduces the following administrative surcharge system.
|
Subject of Amendment |
Specific Details of Amendment |
| Surcharge payment orders |
|
| Estimation of surcharge calculation amounts |
|
| Surcharge increase based on prior surcharge payment orders |
|
| Surcharge reduction/exemption (leniency) system |
|
[xx] Study Group on the So-Called Review Every Three Years of the Act on the Protection of Personal Information, “Report of the Study Group on the So-Called Review Every Three Years of the Act on the Protection of Personal Information” (December 25, 2024).
[xxi] “Money or other benefits” means money and other property benefits. The same shall apply hereinafter.
[xxii] “Requests for reports, etc.” means requests for reports or submission of materials, or on-site inspections, pursuant to Article 146, Paragraph 1 of the APPI. The same shall apply hereinafter.
Member
PROFILE
SHARE