Promulgation and Enforcement Schedule of the 2026 Amendment to the Act on the Protection of Personal Information: Issues Concerning the Statistical Use Exception for AI Development and Administrative Monetary Penalties

On April 7, 2026, the Personal Information Protection Commission announced the Cabinet approval of the "Bill to Partially Amend the Act on the Protection of Personal Information and Other Acts" (Japanese). The bill provides for an exception that makes the data subject's consent unnecessary for the provision of personal data to third parties and the acquisition of special care-required personal information where they are used solely for the preparation of statistics and the like (including AI development and the like), the creation of an administrative monetary penalty system for serious violations, and the development of provisions on the handling of personal information of children (persons under 16 years of age), among other things. In this article, I distinguish between obligations under the current law, the content of the amended law as enacted, and matters to prepare before enforcement, and then make concrete where in the data flow of AI services (training use, provision to third parties and outsourcing) the amendment reaches. The bill was passed and enacted (Japanese) at a plenary session of the House of Councillors on July 10, 2026, and promulgated on July 17 of the same year (Act No. 56 of 2026). The effective date is, as a rule, a date specified by Cabinet Order within two years from the date of promulgation, and some of the amended provisions relating to penalties will come into force ahead of the rest on January 17, 2027. In this article, I update the outlook for the enforcement schedule and the matters for companies to prepare, in light of the developments at the Personal Information Protection Commission as of September 22, 2026.

What Was Decided and How Far Deliberations Have Progressed

The bill was approved by the Cabinet on April 7, 2026 and submitted to the 221st session of the Diet. In the House of Representatives, it was passed by the committee on May 21 of the same year and passed at the plenary session on May 26, and was then sent to the House of Councillors. In the House of Councillors, it was passed by the committee on July 8, 2026 and passed and enacted at the plenary session on July 10. Accordingly, as of the date of writing, the bill is not merely a draft under deliberation but a statute that has completed the legislative process in the Diet. That said, enactment and entry into force are different concepts. The amended law was promulgated on July 17, 2026, but under Article 1 of the Supplementary Provisions, the effective date of the law as a whole is a date specified by Cabinet Order within a period not exceeding two years from the date of promulgation. In addition, some of the provisions relating to penalties, such as the increase in the statutory penalty for the crime of unauthorized provision, and Articles 2 and 3 of the Supplementary Provisions come into force on January 17, 2027, six months after promulgation, and Articles 13 and 16 of the Supplementary Provisions, such as delegation provisions, came into force on the date of promulgation. As of September 22, 2026, the Cabinet Order specifying the general effective date has not been promulgated, and I think it is necessary to watch for its future publication. The draft second AI Basic Plan adopted by the AI Strategy Headquarters on July 10, 2026 used wording that did not presuppose the enactment of this amendment bill, but I think this is because the result of the vote at the House of Councillors plenary session on the same day had not been reflected at the time the draft plan was adopted. When checking the content of the amended law, it is necessary to read the government documents distinguishing between the time they were written and the progress in the Diet.

The Personal Information Protection Commission's Deliberation Schedule

After promulgation on July 17, 2026, the Personal Information Protection Commission has been proceeding step by step with work toward developing Cabinet Orders, rules and other instruments. On July 31, it decided on its future initiatives, and on August 26 it decided on the overall picture of the matters to be prescribed by Cabinet Orders, rules and the like. On September 9, it set out how it would proceed: it would present "basic approaches" for each of the four categories of the amended law and for each theme and discuss them, and then, after exchanging views with organizations representing individuals and organizations representing businesses and holding secretariat hearings with business organizations, IT organizations, consumer organizations and others, it would present draft provisions and begin the public comment procedure. On September 16, rules concerning children, facial feature data and data subject involvement were discussed as "Basic Approaches (1)."

As for the schedule for the time being, Basic Approaches (2), covering the preparation of statistics and the like, outsourcees, and leaks and the like, is scheduled to be discussed from late September to early October, and Basic Approaches (3), covering contactable personal-related information, opt-out and administrative monetary penalties, in mid-October. In practice, I think it is effective for companies to watch which meetings will deal with the issues relating to their business and to understand early what effect the directions presented will have. I think it is appropriate to organize the issues in internal practice in preparation for responding to the public comment procedure after draft provisions are presented and for opportunities to submit opinions through industry associations such as business organizations. The latest status of deliberations can be checked on the Personal Information Protection Commission's "On the 2026 Amendment to the Act on the Protection of Personal Information" (Japanese) page.

Main Content of the Amendment Bill

The content of the amendment can be organized according to the categories in the overview material (Japanese). Under "promoting appropriate data utilization," an exception is newly created that makes the data subject's consent unnecessary for the provision of personal data and the like to third parties and for the acquisition of publicly available special care-required personal information where they are used solely for the preparation of statistical information and the like (Articles 30-2 and 31-3). The overview material expressly states that this exception covers "AI development and the like that can be characterized as the preparation of statistics and the like." At the same time, consent is also made unnecessary for handling that is clearly not contrary to the data subject's intention in light of the circumstances of acquisition, the requirement that obtaining consent be difficult is relaxed for handling for the protection of life and the like, and it is made explicit that medical care providers are included among the institutions covered by the academic research exception (Article 16, paragraph 9; Article 18, paragraph 3; Article 20, paragraph 2; Article 27, paragraph 1).

Under "rules that respond appropriately to risks," for persons under 16 years of age, obtaining consent from and giving notice to legal representatives and the like are put in writing, the requirements for requests to cease use and the like are relaxed, and businesses are given a responsibility to consider the best interests of the data subject (Article 35, paragraphs 9 and 10; Article 40-2; Article 58-3). For facial feature data and the like, a duty to make information known is imposed, the requirements for requests to cease use and the like are relaxed, and provision to third parties through opt-out is prohibited (Article 21-2; Article 27, paragraph 2; Article 35, paragraphs 7 and 8). The obligation of businesses entrusted with data processing and the like to handle data appropriately is also revised (Articles 30-3 and 58-2). The duty to notify data subjects when a leak or similar incident occurs is relaxed where there is little risk of lacking protection of the data subject's rights and interests (Article 26, paragraph 2).

Under "preventing inappropriate use and the like," inappropriate use and unauthorized acquisition of information that does not constitute personal information but enables approaches to specific individuals are prohibited (Article 31-2), and confirming the identity and purpose of use of recipients of provision under the opt-out system is made mandatory (Article 27, paragraph 7). Under "rules for ensuring the effectiveness of compliance," in addition to a review of the requirements for orders and the addition of recommendations and orders requiring notice to data subjects, publication and the like (Article 148), a legal basis for requesting third parties who assist in violations to stop (Article 148-2), and stronger penalties (Articles 178 to 180), a system is newly created under which payment of an administrative monetary penalty equivalent to the economic benefit obtained through the conduct may be ordered where an individual's rights and interests have been infringed by a serious violation, among other cases (Articles 148-3 to 148-17). Similar measures concerning the handling of children's personal information and the like are also taken for the My Number Act and the Next-Generation Medical Infrastructure Act.

Where in the Data Flow of AI Services the Amendment Has an Effect

The part of the amendment that directly affects AI-related practice is the acquisition and provision of training data. Under the current law, the acquisition of special care-required personal information and the provision of personal data to third parties require, as a rule, the data subject's consent. After the amendment, this duty to obtain consent will no longer apply where the data is used solely for AI development and the like that can be characterized as the preparation of statistics and the like. Accordingly, in situations where a company provides personal data it holds to an AI vendor for training, or collects a dataset containing publicly available special care-required personal information and uses it for model development, the practical dividing line will be the assessment of whether that use constitutes AI development and the like that can be characterized as the preparation of statistics and the like.

In contrast, provision of data based on outsourcing is handled under a different framework. Under the current law as well, providing personal data to an outsourcee can in some cases be done without obtaining consent for third-party provision, but the amendment does not change this premise; rather, it revises the obligation of the entrusted business to handle data appropriately. If a company uses an AI vendor as an outsourcee for handling personal data, it will be necessary, once the content of the subordinate regulations becomes clear, to check whether the data handling clauses in the outsourcing agreement are consistent with the content of the obligations after the amendment.

The relaxation of the duty to notify data subjects when a leak or similar incident occurs and the addition of rules on information that does not constitute personal information but enables approaches to specific individuals also relate to the design of services that perform profiling or targeting using AI. Checking copyright and data use conditions at the stage of acquiring training data is covered in Checkpoints for Generative AI, Copyright and Training Data, and the items to check at the stage of selecting an AI vendor are covered in AI Vendor Due Diligence and Contract Review.

Distinguishing from What Must Already Be Observed Under the Current Law

Until the amended law comes into force, the rules of the current Act on the Protection of Personal Information (Japanese) continue to apply as they are. None of the following changes: that the provision of personal data to third parties requires, as a rule, the data subject's consent; that the acquisition of special care-required personal information requires, as a rule, the data subject's consent; and that when a leak or similar incident occurs, a report to the Personal Information Protection Commission and notice to the data subject are required. The exception making consent unnecessary where data is used solely for AI development and the like that can be characterized as the preparation of statistics and the like takes effect only on and after the effective date, and I think it is not possible at present to anticipate it and omit obtaining consent. When checking the company's privacy policy and internal rules, it is necessary to describe the current obligations before enforcement and the amended content that will apply after enforcement separately, so as not to confuse them.

Matters to Check and Prepare Before Enforcement

The items that legal staff can start checking from tomorrow are as follows. Check the purpose of use clause and the third-party provision clause of the privacy policy, and identify under which clause the provision of personal data for the purpose of AI development is currently being made. Check the personal data handling clauses in outsourcing agreements or SaaS terms of use with AI vendors, and organize them so that, after the subordinate regulations are published, you can check whether the provisions on the outsourcee's obligation to handle data appropriately are consistent with the content of the amended Article 30-3 and other provisions. Add a field to the checklist used when selecting AI vendors for recording whether the legal basis for acquiring training data is the data subject's consent, outsourcing, or the newly created exception. As for leak response rules, in my view it is advisable not to change the current notification criteria until the requirements for relaxing the duty to notify are clarified in subordinate regulations or guidelines.

Moves to Watch

To assess the impact on practice in the run-up to the enforcement of the amended law, it is necessary to keep checking the specific content of the Cabinet Orders, Personal Information Protection Commission rules and guidelines to be published.

• Promulgation of the Cabinet Order specifying the general effective date, which as a rule is to be within two years
• Formulation of Commission rules specifying the specific scope and matters to be published under the exception for the preparation of statistics and the like
• The content of the Cabinet Orders and Commission rules on the requirements for applying the administrative monetary penalty system and the calculation criteria
• Cabinet Orders and rules specifying the specific scope of facial feature data and the like and the method of making information known
• Rules specifying the measures to be agreed between the outsourcer and the outsourcee under the rules on outsourcees
• When the Commission will present draft provisions of Cabinet Orders and rules and carry out the public comment procedure
  As these subordinate regulations take concrete shape, I think the work required to revise internal rules on AI development and data utilization and to review contract practice will become clear. In corporate legal practice, I think it is appropriate to keep track of the published deliberations in a timely manner and to proceed with preparations for a smooth response to enforcement.