> Update (June 2026): The reform proposal covered in this article was approved by the Cabinet as an amendment bill on April 7, 2026. For the latest bill contents and compliance steps, see our APPI Reform 2026 compliance guide.
Introduction — What Is the APPI Triennial Review?
The Act on the Protection of Personal Information (APPI) includes a built-in review mechanism under Supplementary Provision Article 12, requiring the government to examine the law's implementation every three years and make revisions as needed. As three years have passed since the fully amended APPI took effect in 2022, the Personal Information Protection Commission (PPC) conducted extensive deliberations throughout 2025 and published its reform proposal in January 2026.
This review is fundamentally different from previous ones because, in addition to strengthening individual rights protection, it directly addresses a new policy priority: promoting AI development and data utilization. The government's stated goal of making "Japan the easiest country in the world for AI development" is now exerting direct influence on data protection legislation.
Key Reform Issues
1. Relaxing Consent Requirements for AI Training Data
Under the current APPI Article 27(1), providing personal data to third parties requires, in principle, the data subject's prior consent. Industry stakeholders have strongly argued that this requirement makes it prohibitively difficult to build large-scale datasets necessary for AI development.
The reform proposal outlines the following directions:
| Item | Current Law | Proposed Reform |
|---|---|---|
| Third-party provision for AI training | Consent required in principle (Art. 27(1)) | New exemption under specified conditions |
| Statistical processing | Provision permitted after anonymization (Art. 2(6)) | Exploration of an "intermediate processing" category for AI training |
| Purpose specification | Specific purpose of use must be identified (Art. 17(1)) | Broader, AI-encompassing purpose descriptions permitted |
Particularly noteworthy is the exploration of a framework allowing the use of data at an "intermediate processing" stage — data that has not been fully anonymized to the point of complete non-re-identification — for AI training under appropriate security controls.
2. Reforming Sensitive Personal Information Acquisition Rules
Current APPI Article 20(2) requires prior consent for the acquisition of sensitive personal information (race, creed, medical history, criminal record, etc.). However, questions have been raised about whether individual consent should truly be required when AI systems acquire sensitive information contained in publicly available sources such as news articles, social media posts, and public records.
The reform proposal indicates a direction toward eliminating the consent requirement for acquiring publicly available sensitive personal information. This is an internationally significant change and is broadly consistent with the GDPR, which provides special treatment for personal data "manifestly made public by the data subject" under Article 9(2)(e).
However, the following safeguards are under consideration:
- The purpose of use must not create a risk of promoting unjust discrimination or prejudice
- Appropriate security control measures (breach prevention, etc.) must be implemented
- Obligations to respond when a data subject exercises a right to request cessation of use
3. Cross-Border Data Transfer Reform
Current APPI Article 28 requires, in principle, the data subject's consent for providing personal data to third parties located in foreign countries, while exempting transfers to (i) countries recognized by the PPC, and (ii) entities with conforming data protection frameworks.
The reform proposal contemplates the following changes:
| Item | Current Law | Proposed Reform |
|---|---|---|
| Information provision about transfer destination | Obligation to provide information about destination country's system (Art. 28(3)) | Simplification and standardization of disclosure requirements |
| Conforming framework | APEC CBPR system and equivalent certification standards | Expansion of international mutual recognition frameworks |
| Cross-border transfers for AI development | General cross-border transfer rules apply | Exploration of special provisions for AI training purposes |
The underlying recognition is that global datasets are indispensable for AI development, and excessively strict cross-border transfer regulations would undermine Japan's competitiveness as an AI development hub.
4. Introduction of Administrative Surcharges
Under the current law, sanctions for APPI violations are limited to administrative orders (Art. 148) and criminal penalties (Art. 173 et seq.). However, the maximum criminal fine for corporations (up to ¥100 million) has been criticized as insufficient deterrence against major tech companies responsible for large-scale data breaches.
The reform proposal contemplates introducing an administrative surcharge system:
- Target conduct: Violations of PPC orders, large-scale personal data breaches, etc.
- Calculation method: A percentage of revenue related to the infringing conduct (specific rates to be determined)
- Reduction system: Reductions for voluntary reporting and early remedial measures
This is a system design clearly influenced by GDPR's administrative fines (up to 4% of annual worldwide turnover) and would represent a substantial strengthening of APPI enforcement.
Free Tool Related to This Article
Statute of Limitations Checker
Try our free simulator related to this topic.
Try for free →Impact on the EU Adequacy Decision
The EU granted Japan an adequacy decision in January 2019, enabling the free flow of personal data between the EU and Japan. This decision is subject to periodic review, and the current reform could affect its continuation.
Factors Favoring Maintenance
- The introduction of surcharges moves Japan's enforcement closer to the GDPR model and is likely to be positively evaluated
- Expanding international mutual recognition frameworks for cross-border transfers aligns with the EU's approach
Risk Factors
- Significant relaxation of consent requirements creates tension with the GDPR's emphasis on data subject rights
- Loosening sensitive data acquisition rules raises balance concerns with the GDPR's strict protections for special category data (Article 9)
- The policy goal of making "Japan the easiest country for AI development" itself risks being perceived by the EU as a reduction in protection standards
The European Commission, in its adequacy review, will assess whether the amended legal framework as a whole maintains an "essentially equivalent level of protection." Whether the consent relaxation remains a reasonable, AI-specific measure or is viewed as a general lowering of standards will be the key factor in maintaining the adequacy decision.
FREE CONSULTATION
Internet Issues: your first 30 minutes are free
- ・Handled by Yusuke Abe, admitted in Japan and New York
- ・Online (Zoom etc.) or at our office in Otemachi, Tokyo
- ・In English or Japanese
Timeline and Practical Preparations
| Period | Expected Development |
|---|---|
| January 2026 | Publication of reform proposal (completed) |
| First half of 2026 | Public comment period |
| Late 2026 – 2027 | Submission of amendment bill to the Diet |
| 2027 – 2028 | Enactment and promulgation (expected) |
| 1-2 years after promulgation | Enforcement (date to be set by Cabinet Order) |
What Companies Should Prepare Now
- Privacy policy review: Consider adding AI training as a stated purpose of data use
- Data inventory: Identify personal data holdings that could be used for AI training
- Cross-border transfer audit: Review the status of data provision to overseas AI development partners
- Surcharge risk assessment: Conduct a comprehensive compliance audit of current APPI obligations
- GDPR adequacy impact analysis: Identify business operations that depend on data transfers from within the EU
Conclusion
The 2026 APPI triennial review is a landmark effort to address the contemporary challenge of balancing AI development promotion with individual rights protection. While the relaxation of consent requirements and sensitive data regulation reform are welcome directions for the AI industry, the introduction of surcharges significantly raises the stakes for compliance.
For AI-related businesses in particular, it is important to begin building proactive compliance frameworks aligned with the reform direction. Even before the amended law is enacted, taking steps consistent with the PPC's guidelines and reform proposals will enable a smooth transition once the changes take effect.
