AI Regulation Tracker / Statute enacted
Japan enacts an APPI amendment that lets firms use sensitive personal data for AI without consent
On July 10, 2026, Japan's Diet passed a revision to the Act on the Protection of Personal Information that opens a narrow, sole-purpose path to share sensitive personal data, including medical and criminal history, for AI development. It is enacted, not yet in force.
Japan spent the last decade tightening consent around personal data. This amendment moves in the other direction for one specific use. On July 10, 2026, the House of Councillors passed the bill to revise the Act on the Protection of Personal Information, which completed enactment after the measure had already cleared the House of Representatives. The government framed it as removing friction from AI development. Privacy groups read it as loosening a rule that used to be close to absolute.
What the amendment actually does
The core change is a new exception to the consent rule for providing personal data to a third party. Under the current APPI, handing personal data to another party generally requires the individual's consent, and sensitive personal data, the category Japanese law calls 要配慮個人情報, carries even stricter handling. The amendment creates a carve-out: where the sole purpose is developing an AI model or producing statistics, an organization may provide that data without obtaining consent first.
Read the qualifier carefully, because the scope lives in it. This is not blanket permission to trade medical records. It is a narrow exception, limited to cases where the sole purpose is AI development or statistical use. Sensitive data, including medical and criminal history, falls inside the exception rather than being excluded from it, which is the part that drew opposition during the vote. The amendment also revises the penalty regime and adds provisions covering biometric data and the protection of minors.
Enacted is not the same as in force
This is the distinction that matters for planning. Passage on July 10 makes the amendment law, but it does not switch on the new rules. Japanese amendments of this kind are promulgated within a few weeks, then phased in on a schedule fixed by cabinet order, here within two years of promulgation. In practice that points to full enforcement around 2028. Anyone telling you that Japanese firms can already share medical data for AI without consent is describing a rule that has not yet taken effect.
Why a US professional should track this
The direct audience is any organization that processes personal data inside Japan for model training, which includes US health-technology and AI companies with Japanese operations, data partnerships, or Japanese subsidiaries. If that is you, the compliance runway starts now, not in 2028. The work is mapping which of your Japanese data flows would rely on the new exception, confirming that each one truly meets the sole-purpose test, and watching for the PPC's implementing rules, which will define the guardrails around what qualifies.
There is a second reason to watch it. Japan is a major economy publicly choosing to relax consent to speed AI development. Other jurisdictions that are weighing the same tradeoff will study how the PPC draws the line. That makes this an early data point on where the global consent-versus-innovation debate is heading, not just a domestic Japanese rule.
Questions professionals are asking
Can companies in Japan now share medical data for AI without consent?
Not yet. The amendment was enacted on July 10, 2026, but it is not in force. The new exception is expected to become operative around 2028, on a schedule set by cabinet order, and its exact scope will depend on the PPC's implementing rules.
What is the sole-purpose exception, in plain terms?
It lets an organization provide personal data to a third party without the individual's consent when the only purpose is developing an AI model or producing statistics. It is narrow by design, and it reaches sensitive data such as medical and criminal history rather than excluding it.
Does this affect a US company?
It affects US organizations that process personal data inside Japan for AI training, through Japanese operations, subsidiaries, or data partnerships. The practical step now is to map which Japanese data flows would rely on the exception and to watch for the PPC's rules.
RELATED BRIEFINGS
Browse the full AI Regulation News tracker
Informational analysis for working professionals, not legal advice. Confirm how any rule applies to your situation with qualified counsel in the relevant jurisdiction.