Cybersecurity Policy Report, Privacy Law Amendments Approved by Japanese Cabinet, (Apr 7, 2026)

By Tony Foley

The Cabinet of Japan has approved amendments to the country’s personal information protection law designed to provide additional consent exemptions, in particular regarding processing related to AI (artificial intelligence), and to strengthen protections for minors, among other changes.

In a news release today announcing the changes, the cabinet said the bill, which may be accessed from the release but is available only in Japanese, takes into account that, because of the rapid advancement of digital technology, the demand for utilization of personal data is increasing, along with the risk of infringement of individual rights due to the illegal handling of such information.

To further protect personal information while giving consideration to its usefulness, the bill would amend the Act on the Protection of Personal Information (APPI) to allow individuals to request the cessation of use of their personal information, even if there is no illegal handling. The bill also would eliminate the need for an individual’s consent when a business operator provides information to a third party that compiles statistics, including AI development that may be characterized as statistical processing. Consent exemptions also are expanded for low-risk processing that does not contradict an individual’s rights.

With respect to protections specific to children under age 16, the bill would establish specific requirements regarding consent and parental notification and would require businesses to consider the best interests of the child in any processing decisions. Finally, the bill strengthens the enforcement authority of the Personal Information Protection Commission (PIPC), allowing it to order business operators to notify affected individuals when necessary, enhancing criminal penalties for the unlawful acquisition of personal information, and establishing a system wherein the PIPC may order payment of a surcharge by a business operator if financial benefits are obtained through the illegal handling of personal information.

The bill will be submitted to the Japanese National Diet. If ultimately approved, the amendments will enter into force no later than two years from the date of promulgation.

News: InternationalLegislation DataPrivacy DataSecurity AINews