AI Regulation Tracker  /  Data protection

Japan's APPI amendment is on the books as Act No. 56. Its duties do not bite yet.

The amendment package was promulgated on 17 July 2026. Commencement was left to a Cabinet Order to be fixed within two years, which makes this a planning horizon rather than a compliance deadline.

By Anthony Guerriero  ·  Published July 28, 2026  ·  Last updated July 28, 2026  ·  Standard news article

What actually happened on 17 July?

A publication step, and nothing more. The Commission put out a short notice the same day. Here is the operative sentence:

令和８年４月７日に第221回国会（特別会）に提出されました「個人情報の保護に関する法律等の一部を改正する法律案」は、令和８年７月10日の国会において可決、成立し、本日（令和８年７月17日）公布されました。改正法は、一部を除き、公布日から起算して２年以内で政令で定める日から施行されます。

PPC press release, 17 July 2026

In English: the bill partially amending the Act on the Protection of Personal Information and related acts, submitted to the 221st Diet (Special Session) on 7 April 2026, was passed and enacted by the Diet on 10 July 2026, and was promulgated today, 17 July 2026. The amending Act will, with certain exceptions, come into force on a date to be specified by Cabinet Order within two years from the date of promulgation.

Two sentences, two different legal facts. The first closes the parliamentary stage. The second opens an empty box where the effective date will eventually go.

Why does promulgation not start the clock on your duties?

In the Japanese system, 公布 (promulgation) is the formal publication of an enacted law in the official gazette. It fixes the text and gives the law its number. 施行 (commencement) is the separate moment the law starts operating, and Japanese drafters commonly hand that date to a 政令, a Cabinet Order, rather than writing it into the statute.

So the Diet decided what the law says. The Cabinet will decide when it starts. Until that order is signed, nothing in the amendment imposes a duty on anyone.

This is where a lot of coverage will go wrong. A headline reading as though Japan has just imposed new obligations on AI training data is describing a law that is real but dormant. If a memo lands on your desk with a date attached to these provisions, ask which primary source the date came from. Today the answer cannot be the Act, because the Act does not contain one.

What can a compliance calendar hold today, and what can it not?

Four layers of Japanese instrument sit between the 17 July announcement and an operating rule you can build a control around. Only one of them exists.

The Commission was explicit about the bottom three rows. Its notice says it will now proceed to examine the Cabinet Order, Commission Rules, guidelines and so on (今後、政令、委員会規則、ガイドライン等の検討を行ってまいります). That is a work programme, not a schedule. It comes with no consultation dates and no target month.

Who should be paying attention now?

The affected population is wider than it looks, because the package amends the APPI and related acts together. Personal information handling businesses (個人情報取扱事業者) are the core group. Beyond them sit AI and machine learning teams relying on large volumes of personal data for model training and statistical processing, healthcare data controllers operating under the Next Generation Medical Infrastructure Act, and administrators working under the My Number Act.

For a US company the trigger is not incorporation in Japan. It is handling personal information of people in Japan, through a subsidiary, a customer base, or a vendor relationship that puts Japanese personal data into your systems. If any of that is true, this package eventually reaches you, and the two year window is your lead time.

What should a privacy officer do before the Cabinet Order lands?

Treat this as a scoping period, not a remediation period. The useful work now is the work that stays useful whatever date the Cabinet picks.

• Record the promulgation itself in your regulatory register with the number, Act No. 56 of 2026, and the status field set to promulgated and not commenced. Registers that only carry effective dates tend to drop items like this entirely, and then rediscover them late.
• Set a watch on the PPC site for the commencement order and the draft Commission Rules rather than a calendar reminder for a date nobody has published.
• Map which of your Japanese data flows would be touched by the substantive changes, using the enacted text. That inventory is the long pole and it does not depend on the commencement date.
• Push back internally on any plan that treats an unfixed commencement as a reason to do nothing for eighteen months. Japanese commencement orders have a habit of arriving with less runway than the outer statutory limit suggests.

The risk worth flagging to leadership is not enforcement this year. It is a compressed implementation once a date is named, because the Commission Rules and guidelines that tell you what to build will land close behind the order, not two years ahead of it.

What is still unknown?

Everything operational. The commencement date is unknown. Which provisions fall under the exceptions in the phrase with certain exceptions is not stated in the notice. The implementing Cabinet Order, the Commission Rules and the guidelines are unknown because the Commission says it has not drafted them. Any article assigning a specific compliance date, a penalty figure or a settled carve out for AI training to this amendment today is going beyond what the primary source supports.

One documentary caveat worth stating plainly. The PPC page announcing the promulgation does not itself give the law number. The number, 令和8年法律第56号, comes from the Cabinet Legislation Bureau promulgation register entry for 17 July, which lists the Act under the Cabinet as submitting body. Both links are in the source file below.

Frequently asked questions

When does Japan's 2026 APPI amendment take effect?

Is the APPI amendment law right now?

What is the official number of the Japanese APPI amendment act?

What happens next before the amendment commences?

Last verified: July 28, 2026