In Japan, against the backdrop of advances in digital technology and AI, the Act on the Protection of Personal Information has been amended. The amending act was enacted on July 10, 2026 and promulgated on July 17 of the same month. This is an important amendment that may have a significant impact both on the utilization of data by companies and on the protection of personal information. In this column, we therefore introduce, in three installments, the background to the amending act, its principal amendments, and the developments expected in the run-up to its entry into force.
I. Background to the Amendments
The supplementary provisions of the 2020 amendments to the Act on the Protection of Personal Information provided that, in light of the status of implementation of the amended act, necessary reviews were to be conducted every three years after it came into force.
In the years that followed, the environment surrounding personal information changed significantly. With the rapid advance of digital technology and AI, the need to utilize data has grown, while addressing the risk of infringement of individuals’ rights and interests has also become an issue. In light of these circumstances, the Act on the Protection of Personal Information was amended from the perspective of achieving both “the appropriate protection of individuals’ rights and interests” and “the promotion of smooth data sharing that also contributes to the utilization of AI.”
The amending act carries out a wide-ranging review resting on four pillars: (i) promotion of appropriate data utilization; (ii) rules that respond appropriately to risk; (iii) prevention of improper use and the like; and (iv) rules to ensure the effectiveness of compliance.
II. Key Points of the Amending Act
1. Promotion of Appropriate Data Utilization
(1) Creation of statistics, etc. (the so-called “statistics exception”)
The introduction of an exception concerning the creation of statistics, etc., known as the “statistics exception,” was a particularly controversial item among the current amendments to the Act on the Protection of Personal Information.
Under the current act, the acquisition of special care-required personal information (information such as beliefs, medical history or criminal record that could lead to unjust discrimination, and which is therefore personal information requiring particularly careful handling), as well as the provision of personal data to third parties, in principle require the consent of the individual concerned.
Under the amending act, subject to conditions such as it being ensured that the information will be used solely for the creation of statistical information, etc. (including AI development), “the provision of personal data, etc. to third parties” and “the acquisition of publicly available special care-required personal information” become possible without the consent of the individual. This is expected to make AI development and the creation of statistical data easier and thereby to promote the utilization of data.
On the other hand, because the situations in which third-party provision or acquisition takes place without the individual’s consent will expand, some have voiced concerns about information leakage and invasion of privacy. The government explains that the creation and use of statistical information, etc. from which any correspondence with a specific individual has been eliminated poses little risk of infringing individuals’ rights and interests. In light of such concerns, however, the methods for ensuring that information is used solely for “the creation of statistical information, etc.” are expected to be given concrete form in rules and guidelines going forward.
(2) Rules on use beyond the purpose of use, the acquisition of special care-required personal information, and third-party provision
In addition to the statistics exception, the amending act dispenses with the consent of the individual, in the following cases, for the use of personal information beyond the purpose of use, the acquisition of special care-required personal information, and the provision of personal data to third parties.
(i) Where it is indispensable for the performance of a contract, or where it is clear, in view of the circumstances of acquisition, that it is not contrary to the individual’s intention and does not harm the individual’s rights and interests (examples: the provision of information from a hotel reservation site to the accommodation facility; the provision of information between financial institutions in connection with an overseas remittance).
(ii) Where it is necessary for the protection of life, body or property, or for the improvement of public health, etc., and there are reasonable grounds for not obtaining the individual’s consent (a relaxation of the previous requirement that it be “difficult to obtain the individual’s consent”).
In order to prevent expansive interpretation by businesses, the specific scope of application, criteria for judgment and examples are, here too, to be set out in rules and guidelines in the future.
(References)
Personal Information Protection Commission, 「令和８年改正個人情報保護法について」 (retrieved on August 6, 2026, https://www.ppc.go.jp/personalinfo/legal/r8kaiseihogohou/)
Personal Information Protection Commission, 「個人情報保護法等の一部を改正する法律について」 (retrieved on August 6, 2026, https://www.ppc.go.jp/files/pdf/260717_kaiseihounitsuite.pdf)
