From Consent To Accountability: Japan’s 2026 APPI Amendment Bill And The New Data Strategy For AI-Driven Businesses

The Shift from Consent to Accountability

AI regulation does not always arrive in the form of a dedicated AI statute. More often, it enters through privacy law. On April 7, 2026, the Japanese Cabinet approved a bill to amend Japan’s Act on the Protection of Personal Information (“APPI”). The Diet passed the amendment on July 10, 2026, and it was promulgated on July 17, 2026 as Act No. 56 of 2026; the amendment is now enacted but not yet in force, with its main provisions taking effect on a date to be fixed by Cabinet order no later than mid-2028. Although the amendment is not presented as comprehensive AI legislation, one of its most significant effects may be to create a more workable legal pathway for AI development, large-scale analytics, and data collaboration. The Personal Information Protection Commission (“PPC”) frames the reform as a response to two competing pressures: the growing demand for data use, including for AI, and the increasing risk that unlawful handling of personal information may harm individual rights and interests.

For businesses, this is not merely another privacy update. It signals a shift in how regulators may assess compliance. The question is no longer only whether consent has been obtained. Increasingly, businesses will need to show that they can justify the legal basis for their data use, demonstrate that the use falls within a permitted category, explain the safeguards in place, and withstand scrutiny from the PPC. In practical terms, Japan appears to be moving from a consent-centred model toward an accountability-centred model.

The Statistical Processing Exception

The most commercially significant proposal is the new Statistical Processing Exception. Under the official materials, consent would not be required for certain third-party transfers of personal data, or for the acquisition of publicly available sensitive personal information, where the data is used solely to generate statistical information. Significantly, the PPC indicates that this may include AI development, provided the activity can properly be characterised as statistical creation.

The exception should not be read as a broad authorisation for all AI training, profiling, or data commercialisation. The proposed concept of “statistical compilation, etc.” appears to focus on the analysis of large volumes of information to produce insights about trends or characteristics. It excludes information that relates to identifiable individuals and limits the activity to cases the PPC considers low risk to individual rights and interests. Legal comfort is therefore likely to be strongest where the output is aggregate, statistical, or pattern-based, and weakest where the processing is used to identify, target, evaluate, or influence specific individuals.

A company using data to improve a model’s ability to recognise broad patterns may have a stronger basis for treating the activity as statistical. By contrast, a company using the same data to infer individual preferences, rank customers, personalise offers, determine eligibility, or predict individual behaviour may face a more difficult legal analysis. The label “AI development” will not be determinative. The more important questions will be how the data is used, what the output enables, and whether the processing remains confined to statistical purposes.

Where the Line Gets Drawn

The proposed exception is also paired with accountability obligations. The legislative materials indicate that organisations relying on it may be required to publicly disclose key information, including the entities involved and the nature of the statistical processing. The exception is therefore not a discreet route around consent. It is a structured legal pathway that requires organisations to make their processing visible, explainable, and defensible.

Consent is transactional; accountability is continuous. A consent-based system asks whether an individual agreed at a particular point in time. An accountability-based system asks whether the organisation can document, disclose, control, and justify its data use throughout the project lifecycle. The broader amendments reinforce this shift.

Certain consent requirements may be relaxed where there are reasonable grounds for not obtaining consent, or where the handling is clearly not contrary to the individual’s intent and does not harm the individual’s rights or interests. At the same time, the amendment introduces stricter rules for higher-risk areas, including biometric data, minors’ data, recipient verification in opt-out transfers, and stronger PPC enforcement powers. The result is not simple deregulation. It is a reallocation of risk: lower-friction data use in some cases, but closer scrutiny where the potential impact on individuals is greater.

For companies developing or deploying AI, this creates both opportunity and uncertainty. The opportunity is clear: businesses may be able to use data for certain statistical or AI-related purposes without obtaining individual consent in every case. This could be particularly relevant to AI model development, product improvement, fraud detection research, medical and healthcare analytics, SaaS optimisation, and large-scale data science. The uncertainty lies in the boundaries. Businesses will need to ask: what exactly qualifies as “statistical”? How will “solely” be interpreted? How much detail must public disclosures contain? When does model training become individual profiling? These questions are likely to become the practical battleground of the amended regime.

Comparative Context: GDPR and DPDP

Japan is not alone in taking this approach. It forms part of a broader trend across the world’s major privacy regimes, and it is useful to locate the APPI within that landscape. The GDPR gives businesses several lawful grounds for processing data, including for research purposes, but Japan’s 2019 EU adequacy status rested on the Supplementary Rules Japan adopted to bridge specific gaps between the APPI and the GDPR, not on any alignment between the two regimes’ research-processing grounds.¹ That said, scholars note that the APPI still covers a narrower range of data and organisations than the GDPR, a gap that persists even as the two regimes continue to converge.² India’s DPDP Act follows a similar pattern: Section 7 sets out a fixed list of “legitimate uses,” and its research and statistics exemption under Section 17(2)(b) permits companies to forgo consent, but only where the data is not used to make decisions about specific individuals — the same guardrail Japan has now adopted.3 This pattern is not unique to Japan: several Asian regulators have moved toward flexible, purpose-based carve-outs that allow data use to proceed first, subject to later accountability, while European regulators generally require the lawful basis to be established before processing begins. For businesses operating across these markets, the practical implication is that a “statistical use” or “research” argument built for Tokyo will usually need to be reconstructed, rather than simply relabelled, before it will hold up in Brussels or New Delhi.⁴

What Scholars Warn About

International scholarship helps explain why businesses should be careful. Sylvia Lu’s work on algorithmic opacity notes that AI systems can be difficult to oversee because of technical complexity, trade secrecy, and organisational invisibility.⁵ That concern is directly relevant here. If the APPI framework relies on public disclosure and organisational accountability, vague disclosures that merely state that data is used for “AI” or “analytics” will not suffice. Such language does not show meaningful transparency. A stronger disclosure would explain the purpose, scope, categories of data, entities involved, safeguards, and limits on downstream use, while protecting legitimate commercial confidentiality, an interest the APPI framework itself recognises.

Frank Pasquale’s The Black Box Society provides a theoretical foundation for opacity as a design choice. Opacity refers to an algorithmic system’s inability to explain, to a user with little technical knowledge, why a particular decision was made. This aptly identifies the risk of using consumer data for AI training or algorithmic analytics. Opacity in design excludes the ordinary user from the algorithm’s decision-making process, and it can exclude the business running the algorithm as well.⁶ The APPI framework aims to remove this opacity by demanding specifics from businesses, which in turn pushes them toward more transparent algorithms; businesses that fail to do so may face regulatory scrutiny.

There is also a risk in assuming that statistical processing is harmless simply because it does not produce an individual-facing decision. Heffetz and Ligett’s work on data-based research shows that privacy risk can arise even from de-identified data or from functions of data, particularly where large datasets allow unexpected inferences.⁷ For businesses, the lesson is practical: legal classification should be supported by technical safeguards. Aggregation thresholds, access controls, pseudonymisation, de-identification, model-output controls, query restrictions, and privacy-enhancing techniques may all help demonstrate that the processing is low risk.

Practical Steps for Businesses

The safest approach is to design the project around the exception from the outset. Organisations should begin by classifying the proposed data use. Is the project statistical in substance, or will the results be applied to identifiable individuals? Does the dataset include sensitive information, biometric data, children’s data, or contactable identifiers? Is a third party involved? Will the data leave Japan? If the project later shifts from model training to customer targeting, eligibility assessment, or decision support, the original legal basis may no longer be adequate.

Documentation will be critical. Businesses should be able to explain why the exception applies, what data is involved, what purpose the data serves, what safeguards are in place, why the risk to individuals is low, and how any public disclosure requirements have been met. This record should be prepared contemporaneously, not reconstructed after a regulator asks questions. In an accountability model, the strength of the legal position often depends on the quality of the paper trail.

Contracts will also require careful attention. Where data is provided to a third party for statistical processing, the agreement should define the permitted purpose, prohibit incompatible use, restrict onward transfers, require appropriate security controls, preserve audit rights, and address cooperation in the event of a PPC inquiry. Cross-border arrangements require particular care, because the legal analysis may need to cover both the statistical processing route and the applicable transfer safeguards.

The Bottom Line

The amendments should therefore be understood not as a workaround to privacy law, but as an opportunity to build lawful pathways through it. If a project does not fit comfortably within the Statistical Processing Exception, the answer is not necessarily to abandon it. Businesses may be able to narrow the purpose, separate statistical outputs from individual-level use, rely on anonymised or synthetic data, obtain consent for higher-risk applications, restructure third-party roles, or identify another statutory basis where available. The key is to make these decisions before processing begins.

For prospective clients, the commercial takeaway is straightforward. Japan is not closing the door on data-driven innovation. On the contrary, the 2026 APPI amendments appear designed to make responsible data use easier, including for AI. But the price of that flexibility is governance. Organisations that invest early in data mapping, internal review procedures, public disclosure strategy, technical safeguards, and contractual controls will be better placed to benefit from the new framework.

The real shift is from permission to proof. Under the emerging APPI model, it may no longer be enough to say that consent was not required. Organisations will need to show that their processing is lawful, limited, transparent, and governed by controls that protect individuals. The amended framework points in the right direction: it allows responsible innovation but requires businesses to explain their purposes, manage risk, and remain accountable for the consequences of data use.

References:

1. Personal Information Protection Commission, Overview of the Bill to Partially Amend the Act on the Protection of Personal Information and Related Acts (Apr. 7, 2026) (Japan), https://www.ppc.go.jp/files/pdf/260407_gaiyou.pdf.
2. Personal Information Protection Commission, Outline of the System Reform Policy Under the Triennial Review of the Act on the Protection of Personal Information (APPI) (Jan. 9, 2026) (Japan), https://www.ppc.go.jp/files/pdf/260109_outline.pdf.
3. Act on the Partial Amendment of the Act on the Protection of Personal Information and Related Acts, Act No. 56 of 2026 (Japan), promulgated July 17, 2026.
4. Seiichi Igaya & Osamu Sudoh, Ignored Discrepancies in the Fundamental Concepts of Data Protection Laws in Japan and the EU, 15 Int’l Data Priv. L. 171 (2025).
5. Digital Personal Data Protection Act, 2023, §§ 7, 17(2)(b) (India).
6. Lanx Goh & Vinni Kalra Francis, Comparative Analysis of AI and Privacy Laws in Europe and Asia: Identifying Regulatory Disparities and Pathways for Harmonisation, 8 J. Data Prot. & Privacy 374 (2026).
7. Sylvia Lu, Data Privacy, Human Rights, and Algorithmic Opacity, 110 Calif. L. Rev. 2087 (2022).
8. Frank Pasquale, The Black Box Society: The Secret Algorithms That Control Money and Information (Harvard University Press 2015)
9. Ori Heffetz & Katrina Ligett, Privacy and Data-Based Research, 28 J. Econ. Persp. 75 (2014).

Footnotes

^{1 European Commission, Data protection adequacy for non-EU countries, https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en (2026).}

^{2 Seiichi Igaya & Osamu Sudoh, Ignored Discrepancies in the Fundamental Concepts of Data Protection Laws in Japan and the EU, 15 Int’l Data Priv. L. 171 (2025).}

^{3 Digital Personal Data Protection Act, 2023, §§ 7, 17(2)(b) (India)}

^{4 Lanx Goh & Vinni Kalra Francis, Comparative Analysis of AI and Privacy Laws in Europe and Asia: Identifying Regulatory Disparities and Pathways for Harmonisation, 8 J. Data Prot. & Privacy 374 (2026).}

^{5 Sylvia Lu, Data Privacy, Human Rights, and Algorithmic Opacity, 110 Calif. L. Rev. 2087 (2022).}

^{6 Frank Pasquale, The Black Box Society: The Secret Algorithms that Control Money and Information, Harvard University Press (2015).}

^{7 Ori Heffetz & Katrina Ligett, Privacy and Data-Based Research, 28 J. Econ. Persp. 75 (2014).}

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.