Japan pairs a mature data protection law with a deliberately pro-innovation approach to AI. The APPI governs personal information and has an adequacy arrangement with the EU. A 2026 amendment introduces administrative fines for the first time and eases some rules for AI training, but it is not yet in force.
The AI Promotion Act, fully in force since September 2025, creates a national AI strategy rather than heavy obligations. Startups launching in Japan mostly need to get APPI consent and transfer rules right, handle cookies under the Telecommunications Business Act and localise consumer terms.
- Core data law
- APPI (2022 amendments in force; 2026 amendments promulgated)
- Regulator
- Personal Information Protection Commission (PPC)
- AI
- AI Promotion Act (Sep 2025), soft-law guidelines
- Cookies
- Telecommunications Business Act external transmission rules (Jun 2023)
- EU adequacy
- Yes (mutual)
- Fines
- Administrative fines coming under the 2026 amendment
Who needs to comply
Businesses handling personal information of people in Japan
The APPI applies to business operators handling personal information, including foreign businesses supplying goods or services to people in Japan.
Websites and apps using third-party tags
The external transmission rules require notice or opt-out when user information is sent to third parties via cookies or SDKs.
AI companies
AI training and outputs are governed by the APPI, copyright law (including the data-analysis exception) and AI guidelines.
E-commerce
The Act on Specified Commercial Transactions requires specific seller disclosures.
The laws, in detail
01Act on the Protection of Personal Information (APPI)
Purpose specification, acquisition, third-party provision, overseas transfers, security and breach reporting.
When it applies
Handling personal information of individuals in Japan in connection with supplying goods or services.
What you must do
- Specify and notify or publish purposes of use
- Consent for third-party provision (with exceptions) and overseas transfers
- Security control measures and staff and vendor supervision
- Report qualifying breaches to the PPC and notify individuals
- Handle requests for disclosure, correction and cessation of use
Regulator
Personal Information Protection Commission
Penalties
Orders and criminal penalties; administrative fines once the 2026 amendment takes effect.
02Telecommunications Business Act: external transmission rules
Sending user information from devices to third parties through cookies, tags and SDKs.
When it applies
Certain telecommunications businesses, including many websites and apps offering services to Japanese users.
What you must do
- Notify or publish what is sent, to whom and why
- Or obtain consent, or offer an opt-out
Regulator
Ministry of Internal Affairs and Communications
Penalties
Administrative guidance and orders.
03AI Promotion Act
National AI strategy, AI Strategy Headquarters and a basic plan.
When it applies
AI developers and users in Japan, through cooperation duties.
What you must do
- Cooperate with government measures
- Follow sector AI guidelines
- Existing laws still apply
Regulator
Cabinet AI Strategy Headquarters
Penalties
No direct penalties; may lead to public naming in cases of misuse.
04Act on Specified Commercial Transactions
Mail-order and online sales disclosures and subscription rules.
When it applies
Selling to consumers in Japan online.
What you must do
- Publish seller identity, prices and return terms
- Clear final confirmation screens for subscriptions
Regulator
Consumer Affairs Agency
Penalties
Orders and penalties.
05Payment Services Act (crypto-assets and stablecoins)
Registration of crypto-asset exchange service providers and rules for electronic payment instruments, including stablecoins.
When it applies
Exchanging, intermediating or custodying crypto-assets for users in Japan.
What you must do
- Register with the FSA before operating
- Segregate customer assets and keep most in cold storage
- AML/KYC and Travel Rule compliance
Regulator
Financial Services Agency
Penalties
Business improvement orders, suspension and criminal penalties for unregistered business.
06Act on Regulation of Transmission of Specified Electronic Mail
Marketing emails and messages.
When it applies
Sending advertising emails to recipients in Japan.
What you must do
- Prior opt-in consent
- Sender identification and opt-out instructions
- Keep records of consent
Regulator
Consumer Affairs Agency; MIC
Penalties
Orders and fines.
Compliance checklist
01 · Before you launch
- Publish purposes of use in Japanese
- Map third-party provision and overseas transfers
- Inventory tags and SDKs for external transmission notices
- Prepare Specified Commercial Transactions disclosures
02 · At launch
- Breach reporting process to the PPC
- Vendor supervision clauses
- Consent flows for overseas transfers
03 · As you scale
- Prepare for administrative fines under the 2026 amendment
- Use the EU adequacy arrangement for EU–Japan flows
- Track sector AI guidelines
Key dates
- Apr 2022APPI 2020 amendments in force
- 16 Jun 2023Telecommunications Business Act external transmission rules
- 1 Sep 2025AI Promotion Act fully in force
- 17 Jul 2026APPI amendment promulgated (fines; in force within two years)
Common mistakes
- Forgetting overseas transfer consent or disclosures
- No Japanese-language notices
- Ignoring tag and SDK disclosures
FAQs
Is Japan a good place to train AI?
Japan’s copyright law has a broad data-analysis exception, and the 2026 APPI amendment eases some AI training uses, but personal data rules still apply.
Does APPI apply to foreign companies?
Yes, when they handle personal information of people in Japan in connection with supplying goods or services.
In the law library
Sources
Reviewed 12 October 2026. General information, simplified for planning; not legal advice. Check current law before relying on any requirement, and get advice for your facts. For markets outside India, advice is coordinated with locally qualified counsel.