In this column, we are introducing the 2026 amendments to the Act on the Protection of Personal Information over three installments. In this final installment, we take up the surcharge system newly introduced in order to enhance the effectiveness of the amending act. We also introduce the government’s forthcoming actions leading up to the entry into force of the amending act (the numbering of the headings continues from the previous installment (2)).
II. Key Points of the Amending Act
4. Ensuring the Effectiveness of Compliance
Introduction of the surcharge system
Under the current act, no administrative surcharge system has been established for disgorging the profits obtained through acts that violate the Act on the Protection of Personal Information. As a result, even where a violator ceased the violation after receiving a recommendation or an order, the profits unlawfully obtained could be retained.
Accordingly, in order to remove the economic incentive for violations and to deter egregious violations, the amending act establishes a surcharge system. The acts covered are categories of conduct that are highly likely to lead to serious infringement of individuals’ rights and interests and that violate important regulations subject to urgent orders. They are also limited to conduct that actually occurs in Japan or abroad and in respect of which unlawful proceeds to be disgorged can be envisaged. Specifically, improper use, unlawful acquisition, unlawful third-party provision, and violations of the statistics exception are envisaged.
Furthermore, surcharge payment orders are in principle limited to large-scale or serious cases. For example, a surcharge payment order may not be issued where the number of individuals whose personal information or personal data is involved in the act subject to the surcharge is 1,000 or fewer, or in cases specified by Cabinet Order as cases in which the degree of harm to individuals’ rights and interests is not significant.
The amount of the surcharge is the amount corresponding to the monetary or other economic benefit obtained by the personal information handling business operator as consideration for the act subject to the surcharge or for ceasing that act.
III. Supplementary Resolutions of the Diet and Developments in the Run-Up to Entry into Force
In the current amendments, the specific scope of application and requirements of many of the systems are left, to no small extent, to Cabinet Orders, rules of the Personal Information Protection Commission, guidelines and the like. For this reason, supplementary resolutions were adopted in both the House of Representatives and the House of Councillors with a view to the appropriate operation of the amending act. The supplementary resolutions call for ensuring the transparency and predictability of the systems, striking a balance between AI development and data utilization on the one hand and the protection of individuals’ rights and interests on the other, the cautious operation of the exceptions, and strict enforcement against egregious cases. They also state that issues not taken up in the current amendments, such as a system of injunctions and damage recovery brought by organizations and the regulation of profiling, should continue to be examined.
Going forward, the examination and promulgation of Cabinet Orders and rules of the Personal Information Protection Commission, revisions to guidelines and Q&As, and the development of the enforcement framework, including the surcharge system, are to proceed. With respect to the exception for the creation of statistics, etc., technical examination and the development of the secretariat’s organizational framework will also be carried out. The date of entry into force is provided to be within two years from the date of promulgation, July 17, 2026. According to government materials, following these preparations, the amendments are expected to come into force between around the spring of 2028 and around July of that year.
IV. Conclusion
As we have introduced over these three installments, the current amendments to the Act on the Protection of Personal Information substantially overhaul the personal information protection framework in light of the advance of AI and the expansion of data utilization. For companies, it will be important to continue to monitor the Cabinet Orders, rules of the Personal Information Protection Commission, guidelines and the like to be published going forward, and to review their own personal information protection frameworks and data utilization practices as appropriate.
(References)
Personal Information Protection Commission, 「令和８年改正個人情報保護法について」 (retrieved on August 6, 2026, https://www.ppc.go.jp/personalinfo/legal/r8kaiseihogohou/)
Personal Information Protection Commission, 「個人情報保護法等の一部を改正する法律について」 (retrieved on August 6, 2026, https://www.ppc.go.jp/files/pdf/260717_kaiseihounitsuite.pdf)
Personal Information Protection Commission, 「個人情報の保護に関する法律の一部を改正する法律の成立を受けた個人情報保護委員会の今後の取組について」 (retrieved on August 6, 2026, https://www.ppc.go.jp/files/pdf/260731_kongonotorikumi.pdf)
