AI Regulation Tracker / New law

Japan Enacts Its First Privacy Surcharge and a Consent Exception for Statistics and AI Data

On July 10, 2026, Japan's Diet passed a revision to the Act on the Protection of Personal Information that opens a narrow, sole-purpose path to share sensitive personal data, including medical and criminal history, for AI development. It is enacted, not yet in force.

Regulatory summary: Japan's Diet has passed a sweeping amendment to the Personal Information Protection Act. Two provisions matter most for data and AI teams: the country's first administrative surcharge for serious violations, and a consent exception that lets personal data flow into statistics creation and AI model development without individual consent.

Primary source

By Anthony Guerriero, Founder, The Leveraged Years · Published July 9, 2026 · Last updated August 4, 2026

Japan Enacts Its First Privacy Surcharge and a Consent Exception for Statistics and AI Data regulation briefing

The Leveraged Years AI Regulation Tracker

Key takeaways

What changed: the amendment adds two net-new mechanisms on top of the existing APPI. It establishes a surcharge system under which the Personal Information Protection Commission (PPC) can order payment by an operator that obtained financial gain through illegal handling of personal information, and it raises the statutory penalties for improper provision of personal information databases. Separately, it creates an exception to the consent requirement for providing personal data to a third party for the creation of statistics and similar purposes, where the content of that statistics creation is publicly disclosed.
The AI path is narrow: the exception is a sole-purpose carve-out. It applies where the only purpose of providing the data is developing an AI model or producing statistics, and reporting indicates it reaches sensitive personal information (要配慮個人情報), the category that covers medical and criminal history, rather than excluding it.
Who it affects: data protection officers and legal teams at companies operating in Japan; AI developers training or fine-tuning models on Japanese personal data; data brokers and analytics providers; and any operator whose past enforcement calculus assumed the PPC could only issue guidance and orders rather than monetary penalties.
Status: enacted, not yet in force. Most provisions take effect on a date fixed by Cabinet Order within two years of promulgation, which points to roughly 2028.
Next step: identify any current or planned use of personal data for statistics or AI model development that has been blocked by the consent requirement, and separately stress-test where a serious mishandling event could now trigger a surcharge, then start building the disclosure and controls each path requires before the Cabinet Order sets the effective date.

Regulatory Briefing

The short version

Bottom line. On July 10, 2026, Japan's Diet passed a revision to the Act on the Protection of Personal Information that opens a narrow, sole-purpose path to share sensitive personal data, including medical and criminal history, for AI development. It is enacted, not yet in force.

Current status. Enacted. The House of Representatives passed the bill on May 26, 2026 and the House of Councillors passed it on July 10, 2026 by a majority electronic vote. Awaiting promulgation; the promulgation date was not yet recorded on the Diet bill page at time of writing.

Effective date. Except for some provisions, the Act comes into force on a date fixed by Cabinet Order within a period not exceeding two years from the date of promulgation, which points to roughly 2028.

Bindingness: Enacted primary legislation amending the Personal Information Protection Act and related laws. Passed both houses of the Diet; the House of Councillors plenary approved it on July 10, 2026. It is binding law once promulgated, with the operative provisions phased in by Cabinet Order.
Scope: Business operators handling personal information of individuals in Japan (personal information handling business operators under the APPI), including operators that provide or receive personal data for statistics creation or model development, and operators whose serious violations produce financial gain.
What Changed: The amendment adds two net-new mechanisms on top of the existing APPI. It establishes a surcharge system under which the Personal Information Protection Commission (PPC) can order payment by an operator that obtained financial gain through illegal handling of personal information, and it raises the statutory penalties for improper provision of personal information databases. Separately, it creates an exception to the consent requirement for providing personal data to a third party for the creation of statistics and similar purposes, where the content of that statistics creation is publicly disclosed. Reporting indicates the amendment extends the data-use exception to AI model development and to sensitive personal information (要配慮個人情報), and that the surcharge is aimed at serious violations affecting large numbers of individuals. The data-use exception is framed as a sole-purpose carve-out: it applies where the only purpose of providing the data to a third party is developing an AI model or producing statistics. The amendment also reworks the penalty regime and adds provisions on biometric data and the protection of minors.
Who This Affects: Data protection officers and legal teams at companies operating in Japan; AI developers training or fine-tuning models on Japanese personal data; data brokers and analytics providers; and any operator whose past enforcement calculus assumed the PPC could only issue guidance and orders rather than monetary penalties.
Current Status: Enacted. The House of Representatives passed the bill on May 26, 2026 and the House of Councillors passed it on July 10, 2026 by a majority electronic vote. Awaiting promulgation; the promulgation date was not yet recorded on the Diet bill page at time of writing.
Effective Date: Except for some provisions, the Act comes into force on a date fixed by Cabinet Order within a period not exceeding two years from the date of promulgation, which points to roughly 2028.
Primary Source: https://www.sangiin.go.jp/japanese/joho1/kousei/gian/221/meisai/m221080221054.htm
Secondary Analysis: Reporting from Jiji Press and Nikkei on the surcharge and the AI and statistics data-use exception, and Personal Information Protection Commission materials on the amendment.
Workflow Impact: Compliance programs need to reprice the cost of a serious violation now that a monetary surcharge is possible, and data governance teams need a documented basis, including the required public disclosure, before relying on the new statistics and model-development exception to use personal data without consent.
Operational Next Step: Identify any current or planned use of personal data for statistics or AI model development that has been blocked by the consent requirement, and separately stress-test where a serious mishandling event could now trigger a surcharge, then start building the disclosure and controls each path requires before the Cabinet Order sets the effective date.
Last Verified: August 4, 2026

Date	Jurisdiction	Rule	Affected professionals	Status or effective date
2026-07-09	Japan	The amendment adds two net-new mechanisms on top of the existing APPI. It establishes a surcharge system under which the Personal Information Protection Commission (PPC) can order payment by an operator that obtained financial gain through illegal handling of personal information, and it raises the statutory penalties for improper provision of personal information databases. Separately, it creates an exception to the consent requirement for providing personal data to a third party for the creation of statistics and similar purposes, where the content of that statistics creation is publicly disclosed. Reporting indicates the amendment extends the data-use exception to AI model development and to sensitive personal information (要配慮個人情報), and that the surcharge is aimed at serious violations affecting large numbers of individuals.	Data protection officers and legal teams at companies operating in Japan; AI developers training or fine-tuning models on Japanese personal data; data brokers and analytics providers; and any operator whose past enforcement calculus assumed the PPC could only issue guidance and orders rather than monetary penalties.	Enacted. The House of Representatives passed the bill on May 26, 2026 and the House of Councillors passed it on July 10, 2026 by a majority electronic vote. Awaiting promulgation; the promulgation date was not yet recorded on the Diet bill page at time of writing.

Japan spent the last decade tightening consent around personal data. This amendment moves in the other direction for one specific use. On July 10, 2026, the House of Councillors passed the bill to revise the Act on the Protection of Personal Information, which completed enactment after the measure had already cleared the House of Representatives. The government framed it as removing friction from AI development. Privacy groups read it as loosening a rule that used to be close to absolute.

The AI path is narrow and sole-purpose

The core change is a new exception to the consent rule for providing personal data to a third party. Under the current APPI, handing personal data to another party generally requires the individual's consent, and sensitive personal data, the category Japanese law calls 要配慮個人情報, carries even stricter handling. The amendment creates a carve-out: where the sole purpose is developing an AI model or producing statistics, an organization may provide that data without obtaining consent first.

Read the qualifier carefully, because the scope lives in it. This is not blanket permission to trade medical records. It is a narrow exception, limited to cases where the sole purpose is AI development or statistical use. Sensitive data, including medical and criminal history, falls inside the exception rather than being excluded from it, which is the part that drew opposition during the vote. The primary text also attaches a public-disclosure condition to the statistics-creation path. The amendment separately revises the penalty regime and adds provisions covering biometric data and the protection of minors.

Enacted is not the same as in force

This is the distinction that matters for planning. Passage on July 10 makes the amendment law, but it does not switch on the new rules. Japanese amendments of this kind are promulgated within a few weeks, then phased in on a schedule fixed by Cabinet Order, here within two years of promulgation. In practice that points to full enforcement around 2028. Anyone telling you that Japanese firms can already share medical data for AI without consent is describing a rule that has not yet taken effect.

Why a US professional should track this

The direct audience is any organization that processes personal data inside Japan for model training, which includes US health-technology and AI companies with Japanese operations, data partnerships, or Japanese subsidiaries. If that is you, the compliance runway starts now, not in 2028. The work is mapping which of your Japanese data flows would rely on the new exception, confirming that each one truly meets the sole-purpose test, and watching for the PPC's implementing rules, which will define the guardrails around what qualifies.

There is a second reason to watch it. Japan is a major economy publicly choosing to relax consent to speed AI development. Other jurisdictions that are weighing the same tradeoff will study how the PPC draws the line. That makes this an early data point on where the global consent-versus-innovation debate is heading, not just a domestic Japanese rule.

Source File

Instrument: Act for Partial Amendment of the Personal Information Protection Act and related laws (個人情報の保護に関する法律等の一部を改正する法律案), Cabinet Bill No. 54, 221st Diet session
Authority: National Diet of Japan; Personal Information Protection Commission (PPC) as enforcing authority
Date: Passed House of Representatives May 26, 2026; passed House of Councillors July 10, 2026; awaiting promulgation
Citation: House of Councillors bill record, Cabinet Bill No. 54, 221st Diet session
Primary Source: https://www.sangiin.go.jp/japanese/joho1/kousei/gian/221/meisai/m221080221054.htm
Corroboration: Jiji Press and Nikkei reporting on the surcharge and the statistics and AI model-development data-use exception; Personal Information Protection Commission materials on the amendment. NHK and Asahi Shimbun reporting on the enacted amendment.
How to verify: Open the House of Councillors bill record and confirm the bill title and the 成立 (enactment) status; the operative provisions and effective dates will be fixed in the promulgated text and PPC implementing rules.

Frequently Asked Questions

Has Japan's APPI amendment actually become law?

Yes. The House of Representatives passed it on May 26, 2026 and the House of Councillors passed it on July 10, 2026, completing enactment. It awaits promulgation, and most provisions take effect on a date fixed by Cabinet Order within two years of promulgation.

What is the new surcharge, and who can impose it?

The amendment creates Japan's first administrative surcharge for privacy violations. The Personal Information Protection Commission can order a business operator that gained financially from illegal handling of personal information to pay a surcharge, and the amendment also raises statutory penalties for improper provision of personal information databases.

Can companies now use personal data for AI without consent?

The amendment creates an exception to the consent requirement for providing personal data for the creation of statistics and similar purposes, with a public-disclosure condition in the primary text. Reporting ties this exception to AI model development and, under conditions, to sensitive personal data, so organizations should confirm the exact scope against the enacted text before relying on it.

Does the exception cover sensitive personal information?

The primary Diet summary confirms the statistics-creation exception and its disclosure condition. Japanese reporting indicates the amendment extends the data-use exception to sensitive personal information such as medical, criminal record, race, and belief data under conditions. That reach should be verified against the full bill text and PPC materials.

When do organizations need to be ready?

The operative provisions come into force on a date set by Cabinet Order within two years of promulgation, which points to roughly 2028. Because both the surcharge and the data-use exception require preparation, teams should begin building controls and documentation now rather than waiting for the effective date.

Can companies in Japan now share medical data for AI without consent?

Not yet. The amendment was enacted on July 10, 2026, but it is not in force. The new exception is expected to become operative around 2028, on a schedule set by cabinet order, and its exact scope will depend on the PPC's implementing rules.

What is the sole-purpose exception, in plain terms?

It lets an organization provide personal data to a third party without the individual's consent when the only purpose is developing an AI model or producing statistics. It is narrow by design, and it reaches sensitive data such as medical and criminal history rather than excluding it.

Does this affect a US company?

It affects US organizations that process personal data inside Japan for AI training, through Japanese operations, subsidiaries, or data partnerships. The practical step now is to map which Japanese data flows would rely on the exception and to watch for the PPC's rules.