JAPAN Trends and Developments Contributed by: Yuki Kuroda, Takuya Uehara and Nanoko Sasaki, Oh-Ebashi LPC & Partners
Oh-Ebashi LPC & Partners Kishimoto Building 2F 2-2-1 Marunouchi, Chiyoda-ku Tokyo 100-0005 Japan Tel: +81 3 5224 5566 Fax: +81 3 5224 5565 Email: general_toiawase@ohebashi.com Web: www.ohebashi.com/en
Introduction The Act on the Protection of Personal Information (APPI) serves as Japan’s fundamental and compre - hensive data protection legislation. When the APPI underwent significant amendments in 2020, it was stipulated that its provisions should be reviewed approximately every three years following the implementation of the amended law. Therefore, the Personal Information Protection Commission (PPC), which was established as the data protection author - ity under the APPI, initiated its review in November 2023 and published an Interim Report in June 2024. Based on the results of hearings with experts and oth - er stakeholders, the PPC examined and reassessed the institutional issues that were identified in the Interim Report, and began discussing such issues in January 2025. The issues were associated with three main topics: • how to involve data subjects in the processing of their personal data; • how to respond to risks arising out of diversifying ways to process personal data; and • how to ensure the effectiveness of compliance by businesses processing personal data. In March 2025, the PPC published its “Views on Institutional Issues”, a document summarising its discussions and its views on the institutional issues concerning the APPI. It then published its “Policy on Institutional Amendments” in January 2026, outlining the following four pillars of the APPI amendment:
• the promotion of proper data utilisation; • rules to appropriately address risks; • the prevention of improper use; and • rules to ensure effective compliance.
The PPC is still conducting discussions regarding the issues highlighted in these document. No clear time - line for the implementation of the results of such dis - cussions has been made; specific proposed amend - ments to the APPI may be published as early as this spring, but it remains unclear whether all of the issues discussed in these documents will be reflected in such amendments. Nevertheless, some of these discussions, if imple - mented, would undoubtedly have a significant impact on a wide range of businesses processing personal data in Japan. This chapter focuses on such key issues and summarises the status of the PPC’s dis - cussions thereon as of January 2026. Note that one unique aspect of the APPI compared to other countries’ data protection regulations is that it defines concepts such as “Personal Information”, “Personal Data” and “Personal Data the Business Holds”. Since most of the data processed by busi - nesses falls under “Personal Data”, this chapter will use the term “Personal Data” without making strict distinctions between these terms. Promotion of Proper Data Utilisation Adjustment of consent requirements in the AI age The current APPI requires businesses to obtain the consent of data subjects when acquiring sensitive personal data, such as race, medical history or crimi -
254 CHAMBERS.COM
Powered by FlippingBook