Japan APPI Rulemaking: PPC's Second Basic-Approach Paper Details the Statistics/AI Exception, Contractor Regime and Breach Reporting (October 1, 2026)
Japan's APPI amendments passed the Diet on July 10, 2026 (Act No. 56 of 2026) — see Japan APPI 2026 Amendment Bill: AI Exemptions, Biometric Rules, and Administrative Fines for the bill's content. The implementation machinery is now moving fast: on September 16, 2026 the PPC set the "basic concept" for the delegated Cabinet Orders and rules, and on October 1, 2026 the PPC secretariat issued a 53-page second draft basic-approach paper covering the three topics that matter most to multinationals: the statistics-creation exception (which expressly reaches AI development), the contractor (entrustee) regime, and breach reporting.
1. The statistics-creation exception — consent-free data pooling and scraped sensitive data for AI
Under the amended law (Arts. 30-2, 31-3), a business may acquire without consent sensitive "special care-required" information that is currently public — the paper's diagram names web scraping as the source — and may provide personal data to third parties without consent, where the sole purpose is "statistics creation," a definition that includes AI development organized as statistics creation. The third-party route covers not just personal data but also "personally referable information" (cookie IDs, browsing histories) — the identifiers adtech runs on. A transfer under the exception may even exceed the purposes originally specified to the individual.
The exception is fenced by three safeguard sets the rules will demand: measures preventing use or onward provision beyond statistics creation; leak and restoration prevention — "restoration" meaning recovery of source data from the statistics or model, matching government witness Kiyoshi Sawaki's Diet testimony that rules would require measures "to prevent output or restoration from AI models"; and prompt deletion of unneeded data, with privacy-enhancing technologies applied on the basis of recorded risk assessments. Practices that act directly on individuals — e.g., using data obtained under the exception to approach people and harvest their reactions as new training data — would fall outside the exception, back under ordinary consent rules.
2. Publication: a single crawlable page — a public map of data-sharing deals
Both parties to an exception transfer must publish the business names and the statistics-creation content on a single web page that must not block crawlers (no robots.txt disallow), include findable keywords, and stay up long enough to be noticed. Sawaki described the intent as "making mechanical search possible." Five further item groups are proposed (parties and representatives, data outline, transfer timing, recipient handling incl. retention period, and rights/complaints contacts — including how the provider originally obtained the data). Substantive changes require co-publication by both parties. For cross-border flows, the Rule 16 "standard-compliant system" and Rule 18 periodic-check/halt obligations extend to the broader information categories covered by the exception — relevant to Japan's EU adequacy relationship.
3. Contractors: statutory scope duty plus a contract-fix exemption
Contractors get a new statutory duty not to handle entrusted data beyond the work required, with a parallel Art. 58-2 exemption from Chapter 4 obligations where the contract fixes the method of handling and the contractor stays within it. The paper's model follows GDPR Art. 28(3) and EDPB Guidelines 07/2020 "essential means": contracts must specify the data items, the processing operations (acquisition, storage, evaluation, processing, provision, deletion — with sources/recipients named), the start and end of handling, and the countries or regions where handling takes place, including whether it occurs abroad and where. Contracts must also oblige prompt reporting of leaks and out-of-scope handling. The paper cites contractors that used entrusted data for their own purposes as a driver — a direct warning for vendors pooling client data for their own model training.
4. Breach reporting: lighter for small leaks, new duty for illegal transfers
Single-person incidents were 84% of the ~12,100 reports in the PPC's interim review. Proposed changes: a substitute notification (public notice instead of individual notice) for leaks of information meaningless on its own, such as internal user IDs; batch final reports for single-person incidents (starting with mistaken handovers/misdeliveries) for businesses whose systems are vetted by accredited personal information protection organisations; alignment with the cyber-incident reporting regime (Act No. 42 of 2025) through a single contact point; and — new — making unlawful third-party transfers reportable regardless of data type or number of people, dropping the 1,000-person threshold that applies to ordinary leaks.
Status and what to watch
The paper is a draft: each proposal is put as a question, no effective date appears anywhere, and the remaining amended-law topics (improper use, enforceability, children under 16, facial feature data) plus guidelines and Q&As are due at later commission meetings. Both Diet chambers' supplementary resolutions (May 21 and July 8, 2026) require GDPR-consistent protection while avoiding chilling AI development, and direct that monitoring extend to published notices including those of foreign companies.
For compliance teams: if you train AI on Japan-sourced data, rely on data-sharing partnerships, offshore processing to contractors, or operate breach-reporting workflows in Japan, this paper is the blueprint for your 2027 obligations — the crawlable publication page will make Japanese data-sharing partnerships publicly machine-readable, and illegal transfers become a reportable event however small.