The framework
Japan regulates personal data through the Act on the Protection of Personal Information (APPI), dating from 2003 and supervised by the Personal Information Protection Commission.
The posture is hybrid. Notice and purpose limitation govern collection and consent is reserved for sensitive cases, which makes first-party marketing more workable here than in strict opt-in markets.
Key instruments
APPI (as amended 2020/2021)
Purpose specification and notice at collection; opt-in for sensitive data; third-party provision by consent or a PPC-filed opt-out; extraterritorial reach; breach reporting; pseudonymized and anonymized data categories.
2026 APPI amendment (Act No. 56 of 2026)
Adds consent exceptions for statistical processing and AI development with transparency safeguards, parental consent for under-16s and a best-interests duty for children's data, rules for biometric data, a new improper-acquisition offense, and administrative surcharges for violations affecting more than 1,000 people.
Marketing and advertising
Notice-based collection with purpose limitation; opt-in consent mainly for sensitive data and third-party provision (an opt-out filing route exists for non-sensitive data). The 2026 amendment adds consent exceptions for statistics and AI development and parental consent for under-16s. Most channel decisions here follow from that consent rule.
Cross-border transfers
Consent, or transfer to a country with equivalent standards (EU and UK are whitelisted), or safeguards with disclosure duties.
Enforcement and penalties
Orders first, then fines up to JPY 100M for corporate violations; the 2026 amendment adds tougher criminal penalties from January 2027 and administrative surcharges for violations affecting more than 1,000 people by July 2028.