AI Regulation Tracker / New law

Japan Enacts Its First Privacy Surcharge and a Consent Exception for Statistics and AI Data

Regulatory summary: Japan's Diet has passed a sweeping amendment to the Personal Information Protection Act. Two provisions matter most for data and AI teams: the country's first administrative surcharge for serious violations, and a consent exception that lets personal data flow into statistics creation and AI model development without individual consent.

Primary source

By Anthony Guerriero, Founder, The Leveraged Years · Reviewed by The Leveraged Years Editorial Desk · Published July 9, 2026 · Last updated July 9, 2026

Japan Enacts Its First Privacy Surcharge and a Consent Exception for Statistics and AI Data regulation briefing

The Leveraged Years AI Regulation Tracker

Key takeaways

The amendment adds two net-new mechanisms on top of the existing APPI. It establishes a surcharge system under which the Personal Information Protection Commission (PPC) can order payment by an operator that obtained financial gain through illegal handling of personal information, and it raises the statutory penalties for improper provision of personal information databases. Separately, it creates an exception to the consent requirement for providing personal data to a third party for the creation of statistics and similar purposes, where the content of that statistics creation is publicly disclosed. Reporting indicates the amendment extends the data-use exception to AI model development and to sensitive personal information (要配慮個人情報), and that the surcharge is aimed at serious violations affecting large numbers of individuals.
Data protection officers and legal teams at companies operating in Japan; AI developers training or fine-tuning models on Japanese personal data; data brokers and analytics providers; and any operator whose past enforcement calculus assumed the PPC could only issue guidance and orders rather than monetary penalties.
Status: Enacted.
Identify any current or planned use of personal data for statistics or AI model development that has been blocked by the consent requirement, and separately stress-test where a serious mishandling event could now trigger a surcharge, then start building the disclosure and controls each path requires before the Cabinet Order sets the effective date.

Regulatory Briefing

Bindingness: Enacted primary legislation amending the Personal Information Protection Act and related laws. Passed both houses of the Diet; the House of Councillors plenary approved it on July 10, 2026. It is binding law once promulgated, with the operative provisions phased in by Cabinet Order.
Scope: Business operators handling personal information of individuals in Japan (personal information handling business operators under the APPI), including operators that provide or receive personal data for statistics creation or model development, and operators whose serious violations produce financial gain.
What Changed: The amendment adds two net-new mechanisms on top of the existing APPI. It establishes a surcharge system under which the Personal Information Protection Commission (PPC) can order payment by an operator that obtained financial gain through illegal handling of personal information, and it raises the statutory penalties for improper provision of personal information databases. Separately, it creates an exception to the consent requirement for providing personal data to a third party for the creation of statistics and similar purposes, where the content of that statistics creation is publicly disclosed. Reporting indicates the amendment extends the data-use exception to AI model development and to sensitive personal information (要配慮個人情報), and that the surcharge is aimed at serious violations affecting large numbers of individuals.
Who This Affects: Data protection officers and legal teams at companies operating in Japan; AI developers training or fine-tuning models on Japanese personal data; data brokers and analytics providers; and any operator whose past enforcement calculus assumed the PPC could only issue guidance and orders rather than monetary penalties.
Current Status: Enacted. The House of Representatives passed the bill on May 26, 2026 and the House of Councillors passed it on July 10, 2026 by a majority electronic vote. Awaiting promulgation; the promulgation date was not yet recorded on the Diet bill page at time of writing.
Effective Date: Except for some provisions, the Act comes into force on a date fixed by Cabinet Order within a period not exceeding two years from the date of promulgation, which points to roughly 2028.
Primary Source: https://www.sangiin.go.jp/japanese/joho1/kousei/gian/221/meisai/m221080221054.htm
Secondary Analysis: Reporting from Jiji Press and Nikkei on the surcharge and the AI and statistics data-use exception, and Personal Information Protection Commission materials on the amendment.
Workflow Impact: Compliance programs need to reprice the cost of a serious violation now that a monetary surcharge is possible, and data governance teams need a documented basis, including the required public disclosure, before relying on the new statistics and model-development exception to use personal data without consent.
Operational Next Step: Identify any current or planned use of personal data for statistics or AI model development that has been blocked by the consent requirement, and separately stress-test where a serious mishandling event could now trigger a surcharge, then start building the disclosure and controls each path requires before the Cabinet Order sets the effective date.
Last Verified: July 10, 2026

Date	Jurisdiction	Rule	Affected professionals	Status or effective date
2026-07-09	Japan	The amendment adds two net-new mechanisms on top of the existing APPI. It establishes a surcharge system under which the Personal Information Protection Commission (PPC) can order payment by an operator that obtained financial gain through illegal handling of personal information, and it raises the statutory penalties for improper provision of personal information databases. Separately, it creates an exception to the consent requirement for providing personal data to a third party for the creation of statistics and similar purposes, where the content of that statistics creation is publicly disclosed. Reporting indicates the amendment extends the data-use exception to AI model development and to sensitive personal information (要配慮個人情報), and that the surcharge is aimed at serious violations affecting large numbers of individuals.	Data protection officers and legal teams at companies operating in Japan; AI developers training or fine-tuning models on Japanese personal data; data brokers and analytics providers; and any operator whose past enforcement calculus assumed the PPC could only issue guidance and orders rather than monetary penalties.	Enacted. The House of Representatives passed the bill on May 26, 2026 and the House of Councillors passed it on July 10, 2026 by a majority electronic vote. Awaiting promulgation; the promulgation date was not yet recorded on the Diet bill page at time of writing.

Source File

Instrument: Act for Partial Amendment of the Personal Information Protection Act and related laws (個人情報の保護に関する法律等の一部を改正する法律案), Cabinet Bill No. 54, 221st Diet session
Authority: National Diet of Japan; Personal Information Protection Commission (PPC) as enforcing authority
Date: Passed House of Representatives May 26, 2026; passed House of Councillors July 10, 2026; awaiting promulgation
Citation: House of Councillors bill record, Cabinet Bill No. 54, 221st Diet session
Primary Source: https://www.sangiin.go.jp/japanese/joho1/kousei/gian/221/meisai/m221080221054.htm
Corroboration: Jiji Press and Nikkei reporting on the surcharge and the statistics and AI model-development data-use exception; Personal Information Protection Commission materials on the amendment.

Frequently Asked Questions

Has Japan's APPI amendment actually become law?

Yes. The House of Representatives passed it on May 26, 2026 and the House of Councillors passed it on July 10, 2026, completing enactment. It awaits promulgation, and most provisions take effect on a date fixed by Cabinet Order within two years of promulgation.

What is the new surcharge, and who can impose it?

The amendment creates Japan's first administrative surcharge for privacy violations. The Personal Information Protection Commission can order a business operator that gained financially from illegal handling of personal information to pay a surcharge, and the amendment also raises statutory penalties for improper provision of personal information databases.

Can companies now use personal data for AI without consent?

The amendment creates an exception to the consent requirement for providing personal data for the creation of statistics and similar purposes, with a public-disclosure condition in the primary text. Reporting ties this exception to AI model development and, under conditions, to sensitive personal data, so organizations should confirm the exact scope against the enacted text before relying on it.

Does the exception cover sensitive personal information?

The primary Diet summary confirms the statistics-creation exception and its disclosure condition. Japanese reporting indicates the amendment extends the data-use exception to sensitive personal information such as medical, criminal record, race, and belief data under conditions. That reach should be verified against the full bill text and PPC materials.

When do organizations need to be ready?

The operative provisions come into force on a date set by Cabinet Order within two years of promulgation, which points to roughly 2028. Because both the surcharge and the data-use exception require preparation, teams should begin building controls and documentation now rather than waiting for the effective date.