The bill isn’t law. That matters.
Japan’s Lower House passed amendments to the Act on the Protection of Personal Information
(APPI) that would reshape how AI developers can use personal data for model training. According to available reporting and legal analysis, the proposed amendments would
permit AI developers to collect and process publicly available personal data for model
training without prior individual consent, but only under conditions including strict
pseudonymization and mandatory Data Protection Impact Assessments. These are proposed
requirements. The Upper House hasn’t voted. The Personal Information Protection Commission
hasn’t issued implementing regulations. This isn’t enacted law.
State that clearly to stakeholders asking what APPI now requires. The honest answer is:
the same thing it required last week.
What the proposed amendments would change. The bill’s most significant provisions, if
enacted, would include:
An AI training consent exception: AI developers could use publicly available personal data
for model training without individual consent, subject to pseudonymization and DPIA
requirements. That’s a meaningful shift from the current consent-first framework, and
it’s directionally consistent with the policy signals Japan’s Digital Agency and PPC have
been signaling since late 2024, but “consistent with signaling” isn’t the same as
“confirmed in enacted text.”
Japan APPI Preparation Steps (Before Upper House Vote)
- Map all personal data flows involving Japanese residents in AI training pipelines
- Assess current DPIA capability and readiness for AI training use case
- Engage Japanese counsel to review official Lower House bill text
- Set PPC official gazette monitoring for Upper House scheduling announcement
- Identify any biometric data (facial recognition) in training datasets for enhanced protection assessment
A new Specific Biometric Personal Information category: The proposed amendments reportedly
would establish heightened protections for biometric data including facial recognition,
according to analysis by Japanese law firm Mori Hamada & Matsumoto. This is a
practitioner-grade detail worth tracking, but verify it against official bill text with
Japanese counsel before building it into your program.
Expanded PPC enforcement authority: The bill reportedly proposes administrative fines for
serious violations, with reporting citing a threshold linked to cases affecting over 1,000
individuals. The Filter has flagged this specific numeric threshold as requiring official
text confirmation before compliance programs rely on it. Don’t operationalize that figure
yet.
A parental consent requirement for children’s data below age 16: per available reporting.
Why it matters now, before passage. Two reasons. First, the legislative trajectory is
clear. Japan’s triennial
APPI review cycle has been consistent, the PPC’s public signals have been directional
toward AI data use liberalization, and the Lower House passage puts Upper House vote as
the next step, not a distant uncertainty. Second, the 2028 projected effective date (if
enacted, pending Upper House passage and implementing regulations) means compliance
programs need lead time that starts now, not after the Senate vote equivalent.
Unanswered Questions
- Are the pseudonymization and DPIA conditions in the proposed AI training exception substantive gatekeepers or procedural requirements, and will implementing regulations specify standards?
- Does the specific biometric personal information category as proposed cover synthetic or derived biometric data, or only directly collected biometric identifiers?
- What is the confirmed numeric threshold for PPC administrative fines, the 1,000-individual figure in reporting requires official text confirmation before compliance programs rely on it?
What to watch. Upper House scheduling is the next milestone. There’s no confirmed date. When it clears, or if amendments are introduced, that’s the trigger for moving from
preparation to compliance program build. PPC official gazette publications are the
authoritative source; English-language coverage will follow, but Japanese counsel is the
right resource for real-time accuracy.
The real question is whether the pseudonymization and DPIA conditions in the proposed AI
training exception are substantive gatekeepers or procedural checkboxes. That question
won’t be answered until implementing regulations follow, and those come after Upper House
passage.
Teams processing Japanese personal data in AI training pipelines should start the gap
analysis now. The preparation work, mapping data flows, identifying personal data in
training sets, assessing DPIA readiness, doesn’t depend on the Upper House vote to begin.