Knowledge Base Regulation Tracker Standards & Frameworks OSS Directory AI Incident Database Research Paper Library Case Studies Society Articles News Jobs About Charter Sign inBecome a Member
Home/Regulation Tracker/Japan Act on the Protection of Personal Information (APPI), as amended

Japan Act on the Protection of Personal Information (APPI), as amended

Japan's privacy law has no automated-decision article but the PPC applies its purpose-limitation and improper-use rules to AI, including formal cautions to OpenAI in 2023 about training on sensitive data. Reform proposals in 2025 target children's data and enforcement.

japanappippc

Required actions

  • Specify purposes of use and do not use personal information for improper purposes, including discriminatory profiling; the PPC has issued cautions on generative-AI training - Report breaches to the PPC; cross-border transfers need consent or equivalent safeguards - Handle pseudonymised and anonymised data under the tailored regimes

Sources

PreviousCFPB Circulars 2022-03 and 2023-03 — adverse action notices when using complex algorithmsNextEnforcement decisions against Clearview AI: Italy, France, Netherlands and the UK

Contribute

Spot an error, or know a record we should add? Members can propose additions and submit corrections.

Add regulationReport a correction or request removal

Related in Regulation Tracker

Japan Act on the Promotion of AI-Related Technologies (Act No. 53 of 2025)

Japan's first AI statute is promotional rather than prescriptive: it creates a Cabinet-level AI Strategy Headquarters and a Basic Plan, imposes a duty of cooperation on businesses and relies on guidelines and public…

JapanIn force

Japan Act on the Promotion of Research, Development and Utilisation of AI-Related Technologies

Japan's first AI law, enacted in May 2025, is promotional rather than prohibitive: it creates a strategy headquarters and basic plan, and empowers the government to investigate and name organisations involved in AI…

JapanIn force

Japan Active Cyber Defense Law (2025)

Japan's 2025 active cyber defence law introduces mandatory incident reporting for critical infrastructure, phasing in from 2026, and authorises pre-emptive government action against attacker infrastructure.

JapanIn force, applied in stages