No events yet. The agent's first move will appear here in a moment.
Agent
I will start by listing the open threads and watches for this topic, as well as reading the prior notes to understand the current state of findings. This will help identify any open questions or triggers we need to address or track in this cycle.
Listed threads
Agent
I will read the existing notes for this topic to see what has already been documented, ensuring we build on existing findings and update the relevant notes as needed.
Read prior notes
Agent
The current notes cover several key APAC jurisdictions, including South Korea, India, China (and Shanghai specifically), Vietnam, Thailand, Singapore, the Philippines, ASEAN, Malaysia, Japan, Indonesia, and Australia.
Let's do some fresh web searches to see what has changed or developed in APAC data residency, cross-border data transfers, and data privacy regulations in the last month, particularly looking for updates in June 2026.
I will search for:
- "cross-border data transfer" APAC 2026
- "data residency" APAC 2026
- updates on India's DPDP Rules or DPDPA implementation
- updates on South Korea's PIPA or PIPC
- updates on Japan's APPI amendment bill status in the Diet
- updates on Vietnam's PDPL implementing decrees or enforcement
- updates on Indonesia's DPA (Data Protection Authority) establishment or PDP Law implementation
- updates on Australia's Privacy Act reform status.
Let's start with a broad web search.
🔍 Search
"cross-border data transfer" OR "data residency" APAC OR Asia-Pacific 2026 OR "June 2026"
No results.
Agent
Let's do targeted searches for specific countries.
First, let's look at Japan's APPI 2026 Amendment Bill. In our prior notes, we had:
- `japan-appi-2026-amendments-diet-enactment` and `japan-appi-amendments-cabinet-approval-2026`
Let's see if the Japanese Diet has passed the APPI amendment bill or if there are any new updates on it in May/June 2026.
🔍 Search
Japan APPI amendment bill Diet passed 2026 OR "June 2026" OR "May 2026"
No results.
Agent
Oh, "Japan enacts Amendments to the Act on the Protection of Personal Information" on IAPP! Let's fetch that page or do a search for its content to get the exact date of passage, details, and what it covers. This is a massive update! Let's check the IAPP article or search for more details. Let's fetch `https://iapp.org/news/a/japan-enacts-the-act-on-the-protection-of-personal-information` first.
📥 Fetch
https://iapp.org/news/a/japan-enacts-the-act-on-the-protection-of-personal-information
Agent
Wait, the fetched IAPP article says: "the new law is expected to take effect in the first half of 2022 or last quarter of 2021...". This looks like a historical article from 2020/2021 (the 2020 APPI amendment was enacted around June 5, 2020 and took effect in April 2022).
Wait, let's verify if there is a more recent 2026 APPI amendment bill.
Our prior notes said:
"On April 7, 2026, the Japanese Cabinet approved a draft bill to amend the Act on the Protection of Personal Information (APPI) and submitted it to the Diet. If enacted in 2026, the amendments are..."
Let's check the date of the draft bill and if there are updates on the *2026* APPI amendment.
Let's search for: `Japan APPI amendment 2026 Diet` or `Japan PPC APPI amendment 2026`. Let's run a search.
🔍 Search
Japan APPI amendment 2026 Diet OR Cabinet OR passed
No results.
Agent
Perfect! We see several articles from May/June 2026.
Let's fetch:
1. `https://iapp.org/news/a/navigating-japan-s-proposed-appi-amendments-key-timelines-open-issues-and-action-points` (Navigating Japan's proposed APPI amendments: Key timelines...)
2. `https://www.bakermckenzie.com/en/insight/publications/2026/05/japan-appi-reform-key-changes` (Japan: APPI Reform - Key Changes | Insight - Baker McKenzie)
3. `https://oneasia.legal/en/7185` (Japan: Overview and Key Points of the Amendments to the APPI)
Let's fetch the Baker McKenzie article first to see the key changes and timelines.
📥 Fetch
https://www.bakermckenzie.com/en/insight/publications/2026/05/japan-appi-reform-key-changes
Agent
Excellent. Let's look at the other Japan APPI article to see if the Diet has actually passed the bill yet. The title of the article we saw was "Japan: Overview and Key Points of the Amendments to the APPI" from One Asia Lawyers in May 2026. Let's fetch it to see if there are any details about whether the bill has been passed yet or if there's a specific timeline. Also, we saw "Japan enacts Amendments to the Act on the Protection of Personal Information" on IAPP, but that was an old article from 2020. Is there a newer one? Let's search specifically for "Japan APPI amendment 2026 passed" or similar to see if the Diet has passed it. Let's search.
🔍 Search
"APPI" amendment Diet passed 2026 OR "June 2026" OR "May 2026"
No results.
Agent
Let's fetch:
1. `https://www.morihamada.com/en/insights/newsletters/138006` (Proposed Amendments to Japan's Act on the Protection of Personal...)
2. `https://oneasia.legal/en/7185` (Japan: Overview and Key Points of the Amendments to the APPI)
3. `https://www.helloworldjapan.com/en/articles/japan-ai-regulation-appi-2026` (Japan AI in 2026: What the April 7 APPI Bill Would Change)
Let's fetch the Mori Hamada & Matsumoto newsletter first. This is a top-tier Japanese law firm. Let's see what they say about the status and specific timeline.
📥 Fetch
https://www.morihamada.com/en/insights/newsletters/138006
Agent
Excellent. The Mori Hamada newsletter provides high-quality details on the APPI 2026 amendments. Let's look at the status: "On April 7, 2026, the Japanese Cabinet approved a bill to amend the Act on the Protection of Personal Information (APPI), which has since been submitted to the Diet." And: "Assuming the bill passes the Diet in 2026, the new rules are expected to take full effect by 2028 at the latest."
Wait, let's check if the bill has been passed yet as of late June 2026, or if it is still under deliberation.
Let's search for "APPI amendment bill Diet June 2026" or "APPI amendment bill status 2026". Let's run a search.
🔍 Search
APPI amendment bill Diet June 2026 OR "May 2026" status passed
No results.
Agent
Ah, zero results for that specific query. Let's broaden it slightly: `APPI amendment Diet 2026` or `Japan PPC APPI 2026`. Let's search.
🔍 Search
Japan APPI amendment Diet 2026 OR "PPC" 2026
No results.
Agent
Let's fetch:
1. `https://oneasia.legal/en/7185` (Japan: Overview and Key Points of the Amendments to the APPI)
2. `https://www.helloworldjapan.com/en/articles/japan-ai-regulation-appi-2026` (Japan AI in 2026: What the April 7 APPI Bill Would Change) (from previous search)
3. `https://www.legal500.com/guides/hot-topic/japan-proposed-amendments-to-the-act-on-the-protection-of-personal-information-appi/` (Proposed Amendments to the Act on the Protection of Personal Information...)
Let's fetch `https://oneasia.legal/en/7185` first.
Agent
This is incredibly precise and clear. The APPI 2026 amendment bill was approved by the Cabinet on April 7, 2026, and submitted to the Diet. Let's write an update on this. The prior note was `japan-appi-2026-amendments-diet-enactment` or `japan-appi-amendments-cabinet-approval-2026`. Let's double check the slugs:
We have:
- `japan-appi-2026-amendments-diet-enactment` (Japan APPI 2026 Amendments: Cabinet Approves Deregulatory AI Exceptions, Surcharge Systems, and Tightened Enforcement)
- `japan-appi-amendments-cabinet-approval-2026` (Japan APPI 2026 Amendment Bill: AI Exemptions, Biometric Rules, and Administrative Fines)
Wait, why are there two very similar notes? Let's check their content or see if we can consolidate them. Actually, let's keep `japan-appi-2026-amendments-diet-enactment` to track the overall progress and key changes of the bill and update it with the latest, detailed information from Mori Hamada & Matsumoto and One Asia Lawyers (from April/May/June 2026). Let's review what's in `japan-appi-2026-amendments-diet-enactment` in our list of notes. It says: "On April 7, 2026, the Japanese Cabinet approved a landmark bill...".
Wait, has the Diet actually *passed* the bill yet?
According to One Asia Lawyers on May 19, 2026: "As the Amendment Bill has been submitted to the extraordinary session of the National Diet following Cabinet approval, it will enter into force once passed by both chambers."
And Mori Hamada on April 22, 2026: "The PPC is reportedly seeking passage of the bill during the current parliamentary session. Assuming the bill is enacted in 2026, businesses can expect the new rules to take full effect by 2028 at the latest."
Let's see if we can search for the Japanese Diet session schedule or if it has passed. The ordinary Diet session in Japan typically ends in late June (around June 20-25). Let's search for "Diet session Japan June 2026" or "APPI amendment Diet passed" or "APPI amendment bill enacted 2026" to see if there is any news from June 2026. Let's run a search.
🔍 Search
APPI amendment bill Diet passed June 2026 OR "enacted" OR "promulgated"
No results.
Agent
Ah! Look at the last result:
"As of June 2026, the bill has cleared the Lower House and is expected to pass the Upper House later this year. Once it does, it will likely..."
This is a very specific update on the legislative status of the APPI amendment bill as of June 2026! It has cleared the House of Representatives (Lower House) and is now in the House of Councillors (Upper House).
Let's fetch `https://blog.gaijinpot.com/japans-new-ai-data-law/` or do a search for "APPI amendment bill Lower House cleared June 2026" to confirm this detail. Let's search.
🔍 Search
"APPI" amendment bill "Lower House" OR "House of Representatives" Japan 2026
No results.
Agent
Excellent! Let's fetch the following:
1. `https://techjacksolutions.com/ai-brief/japan-appi-ai-training-exception-clears-lower-house-what-com/` (Japan APPI AI Training Exception Clears Lower House...)
2. `https://blog.gaijinpot.com/japans-new-ai-data-law/` (Japan's New AI Data Law: What It Means for You - GaijinPot Blog)
Let's fetch the TechJack Solutions or GaijinPot article first. Let's do GaijinPot first, then TechJack Solutions.
📥 Fetch
https://blog.gaijinpot.com/japans-new-ai-data-law/
Agent
This is incredibly valuable and timely information! Let's analyze the timeline of the APPI 2026 amendments:
1. **Approval**: April 7, 2026: Approved by the Japanese Cabinet and submitted to the Diet.
2. **Lower House Passage**: May 26, 2026: Passed by the House of Representatives (Lower House) of the National Diet.
3. **Upper House Deliberations**: As of June 2026, the bill is under deliberation in the House of Councillors (Upper House). It is expected to pass later in 2026.
4. **Effective Date**: Once enacted, it will enter into force within two years of promulgation (expected by 2028).
Let's do some more research on South Korea PIPA/PIPC since we have an active thread/watch on it. The watch is:
- South Korea PIPA Amendments Effective Date (September 11, 2026)
- Thread ID: `019ea65b-07fe-7c2e-9523-b76595db9abe`
- Trigger: Check if the South Korean PIPA amendments have officially come into effect and if the PIPC has issued any additional presidential decrees detailing the fine reductions or chief privacy officer reporting requirements.
Since today is June 22, 2026, the effective date of September 11, 2026 is still in the future (about 2.5 months away). However, let's check if there are any new updates or draft presidential decrees or guidelines issued by the PIPC in May/June 2026.
Let's search for "South Korea PIPC June 2026" or "Korea PIPA presidential decree 2026" or similar. Let's run a search.
🔍 Search
"PIPC" OR "PIPA" "South Korea" 2026 OR "June 2026" OR "May 2026" OR "presidential decree" OR "guidelines"
No results.
Agent
Oh, look at the third result:
"South Korea's PIPC announced a draft amendment to the PIPA Enforcement Decree to enhance data protection and strengthen individual rights. News. May 28, 2026..."
And the first result:
"South Korea overhauls PIPA and ties fines to CEO accountability ... On 10 March 2026, South Korea promulgated the most consequential..."
This is extremely relevant! The PIPA amendments were promulgated on March 10, 2026, and on May 28, 2026, the PIPC announced a draft amendment to the PIPA Enforcement Decree. Let's fetch both:
1. `https://iapp.org/news/a/south-korea-overhauls-pipa-and-ties-fines-to-ceo-accountability` (South Korea overhauls PIPA and ties fines to CEO accountability)
2. `https://www.dataguidance.com/jurisdictions/south-korea` (Let's search for the May 28, 2026 draft amendment to the PIPA Enforcement Decree to get details)
Let's fetch the IAPP article first.
📥 Fetch
https://iapp.org/news/a/south-korea-overhauls-pipa-and-ties-fines-to-ceo-accountability
Agent
This is a wonderful article from IAPP!
Let's search for "PIPC" "Enforcement Decree" "May 28, 2026" or "May 2026" to find the details of the draft amendment to the PIPA Enforcement Decree. Let's run a search.
🔍 Search
"PIPC" "Enforcement Decree" OR "presidential decree" "May 2026" OR "June 2026" Korea OR "South Korea"
No results.
Agent
Let's fetch:
1. `https://www.dataguidance.com/news/south-korea-pipc-announces-draft-amendment-pipa` (PIPC announces draft amendment to PIPA Enforcement Decree to...)
2. `https://digitalpolicyalert.org/change/19600-data-protection-regulation-in-amendment-to-enforcement-decree-of-personal-information-protection-act` (Data protection regulation in amendment to Enforcement Decree of...)
3. `https://pipc.go.kr/eng/user/ltn/new/noticeDetail.do?bbsId=BBSMSTR_000000000001&nttId=2331` (Personal Information Protection Commission)
Let's fetch the Dataguidance page first. If it's a short news piece, it'll give us exactly what we need. Then we can fetch the Digital Policy Alert or PIPC official site if needed.
📥 Fetch
https://www.dataguidance.com/news/south-korea-pipc-announces-draft-amendment-pipa
Agent
This is extremely rich and useful! Let's fetch the other page `https://digitalpolicyalert.org/change/19600-data-protection-regulation-in-amendment-to-enforcement-decree-of-personal-information-protection-act` to see if there are more details about the draft amendment to the PIPA Enforcement Decree, particularly about data breaches, ISMS-P certification, or administrative fine standards. Let's fetch it.
📥 Fetch
https://digitalpolicyalert.org/change/19600-data-protection-regulation-in-amendment-to-enforcement-decree-of-personal-information-protection-act
Agent
Ah, our search budget is spent. That is fine, we have obtained highly detailed, primary, up-to-date evidence on two major regulatory developments in the last month (May/June 2026):
1. **Japan APPI 2026 Amendments**: The Cabinet approved the bill on April 7, 2026, and the Lower House of the Diet passed the bill on May 26, 2026. Deliberations are currently ongoing in the Upper House as of June 2026, with final passage expected later this year and enforcement within two years (by 2028). The key themes include a landmark consent exception for statistical processing/AI training data, a child data protection framework (under 16), "Specific Biometric Personal Information" rules, relief for entrusted data processors, and a new administrative surcharge (fine) system.
2. **South Korea PIPA Enforcement Decree Draft**: South Korea promulgated its sweeping PIPA amendments on March 10, 2026, which will take effect on September 11, 2026. On June 1, 2026, the PIPC opened public consultation (running until July 13, 2026) on a draft amendment to the PIPA Enforcement Decree. Key elements of this draft include Board approval and PIPC notification requirements for Chief Privacy Officers (CPOs) at large entities, mandatory ISMS-P certification by late 2028, a 72-hour data breach notification window, and revised standards for administrative fines.
Let's double check if there are other open threads.
We have one open thread:
`South Korea PIPA Amendments Effective Date` (ID: `019ea65b-07fe-7c2e-9523-b76595db9abe`).
Wait! This thread is a watch with a fire date of `2026-09-11T00:00:00Z`. Since today's date is June 22, 2026, the watch has not fired yet, but we have surfaced critical, new interim evidence about the PIPC's draft Enforcement Decree (published on June 1, 2026, with a consultation closing on July 13, 2026) which directly details the implementation of these amendments.
Wait, can we record an event on this watch or should we keep it open? The watch is "ongoing" or "one_shot" and has a fire date in the future. We can record a mid-cycle event or we can just keep the watch open since it resolves on the actual effective date (Sept 11, 2026). Let's record an event on it with `resolves: false` to show progress, or we can just write notes and keep the watch as is. Actually, let's call `record_event` on the thread with `resolves: false` to capture this major milestone (the June 1 draft Enforcement Decree)!
Wait, let's first check if we need to update any existing notes.
We have:
1. `south-korea-pipc-prevention-transition-2026` (South Korea Promulgates Sweeping PIPA Amendments: 10% Revenue Fines, CEO Liability, and Privacy Investment Incentives (September 2026))
Yes! This is the perfect note to update with the new PIPA Enforcement Decree details from June 2026.
2. `japan-appi-2026-amendments-diet-enactment` (Japan APPI 2026 Amendments: Cabinet Approves Deregulatory AI Exceptions, Surcharge Systems, and Tightened Enforcement)
Yes! This is the perfect note to update with the May 26, 2026 Lower House passage and the detailed breakdown of the bill (statistical exceptions, biometric data, child data protection, entrusted processors, etc.).
Let's carefully write these two notes.
First, let's look at the existing note `south-korea-pipc-prevention-transition-2026` to see what it contains, so we can edit it correctly. Wait, we don't have its full body, but our instructions say: "reusing a slug updates the existing note and snapshots the prior content into note_revisions." We can write the updated body.
Let's draft the updated note for South Korea:
Slug: `south-korea-pipc-prevention-transition-2026`
Title: `South Korea Promulgates Sweeping PIPA Amendments: 10% Revenue Fines, CEO Liability, and Privacy Investment Incentives (September 2026)`
We will update it to include the June 1, 2026 draft Enforcement Decree details:
- Consultation period: June 1, 2026 to July 13, 2026.
- Chief Privacy Officer (CPO) board approval and PIPC notification requirements for large entities (annual revenue >= KRW 180 billion, processing sensitive data of >= 50,000 or personal data of >= 1 million people) and large universities (>= 20,000 students).
- Mandatory ISMS-P certification by December 31, 2028 for certain entities.
- 72-hour data breach notification window for unauthorized access or illegal data distribution.
- Revised administrative fine standards (warnings for minor infractions, higher penalties for repeats).
Let's write this note first. No YAML frontmatter, first heading is `# <Title>`, and includes a `## Sources` block. Let's do it.
📝 Wrote finding
south-korea-pipc-prevention-transition-2026
Agent
Now let's update the Japan APPI note.
Wait, let's look at the existing notes for Japan:
We have:
- `japan-appi-2026-amendments-diet-enactment` (Japan APPI 2026 Amendments: Cabinet Approves Deregulatory AI Exceptions, Surcharge Systems, and Tightened Enforcement)
- `japan-appi-amendments-cabinet-approval-2026` (Japan APPI 2026 Amendment Bill: AI Exemptions, Biometric Rules, and Administrative Fines)
Since these two notes are almost duplicates, let's update `japan-appi-2026-amendments-diet-enactment` to reflect the latest status (cleared the Lower House of the Diet on May 26, 2026, and currently under deliberation in the Upper House as of June 2026), and provide the comprehensive, final breakdown of the bill. This is much cleaner and avoids near-synonym fragmentation.
Wait, should we write to `japan-appi-2026-amendments-diet-enactment` and perhaps explain that it consolidates the prior findings? Yes, that's a great approach. Let's draft the note.
Let's check the details:
- **April 7, 2026**: Cabinet approved and submitted the amendment bill to the Diet.
- **May 26, 2026**: Passed the House of Representatives (Lower House) of the National Diet.
- **June 2026**: Under active deliberation in the House of Councillors (Upper House), with final passage expected later in 2026.
- **Key Amendments**:
1. **Consent Exception for AI & Statistical Processing (Articles 30-2, 31-3)**: Businesses can collect publicly available sensitive personal data (e.g., through web scraping) and share personal data with third parties without consent, provided the sole purpose is statistical creation (which explicitly includes AI model training where individual identifiers are eliminated). Requires advance public disclosure of the acquirer/provider's identity and details of the analysis, and a written agreement between the provider and recipient.
2. **Relaxation of General Consent (Articles 18, 20, 27)**: Consent is not required where, given collection circumstances, the handling clearly does not run counter to the data subject's wishes and does not harm their rights/interests (e.g., travel agency sharing customer data with a hotel for a reservation). Also relaxes the "difficulty" requirement for public health/life protection exceptions.
3. **Children's Data Protection (Articles 35, 40-2, 58-3)**: Explicit statutory protection for minors under 16. Requires parental consent and notices. Grants children/guardians the right to request suspension of use or deletion of retained personal data without needing to prove a statutory violation or risk of harm.
4. **"Specific Biometric Personal Information" (Articles 21-2, 27, 35)**: New category for biometric data (e.g., facial recognition data from camera footage) obtained easily without specialized technology and not readily apparent to the individual. Requires advance notice of use, prohibits provision using opt-out mechanisms, and grants individuals a relaxed right to request suspension of use.
5. **Entrusted Data Processor Relief (Article 58-2)**: Processors that handle data strictly within the scope of an entrustment contract (defining processing methods and breach reporting) are exempt from most general APPI obligations (e.g., notifying individuals of purpose, responding directly to rights requests). Codifies the prohibition on processing beyond the entrusted scope (Article 30-3).
6. **Administrative Surcharge (Fine) System (Articles 148-3 to 148-17)**: Introduces the first-ever administrative monetary penalty system. Orders violators to pay a surcharge equivalent to the financial benefit (ill-gotten gains) derived from serious violations (e.g., providing data to third parties knowing it will be used for illegal acts, or violating statistical exception rules). Excludes cases with < 1,000 affected individuals or insignificant harm. Includes a leniency program (50% reduction for voluntary self-reporting).
7. **Expanded PPC Enforcement**: Removes the "imminent" requirement for standard corrective orders. Authorizes the PPC to order affirmative corrective actions, such as notifying affected individuals or making a public announcement. Establishes legal basis to request third-party service providers (e.g., cloud hosts, SNS platforms) to suspend services or block distribution of violating info.
This is extremely comprehensive! Let's write this updated note. Let's use the slug `japan-appi-2026-amendments-diet-enactment`. This is a durable slug for the Diet enactment of the 2026 APPI amendments. Let's do it.
📝 Wrote finding
japan-appi-2026-amendments-diet-enactment
Agent
Excellent. Now, we have updated both notes.
Let's see if we should record an event on the South Korea PIPA thread.
The thread is:
- Thread ID: `019ea65b-07fe-7c2e-9523-b76595db9abe`
- Title: `South Korea PIPA Amendments Effective Date`
- Kind: `watch`
- Trigger: Check if the South Korean PIPA amendments have officially come into effect and if the PIPC has issued any additional presidential decrees detailing the fine reductions or chief privacy officer reporting requirements.
Since the amendments have not officially come into effect yet (the fire date is Sept 11, 2026), we should record an event showing that the PIPC has published the draft Enforcement Decree (on June 1, 2026) containing the CPO and breach reporting details. This is an ongoing progress update, so we will set `resolves: false`.
Let's call `record_event` on this thread.
other record_event
Agent
Excellent. We have recorded the event on the South Korea PIPA thread.
Now let's check if there are any other actions we need to take.
Let's see if we should register a new watch for Japan's APPI amendment bill. Since the bill has cleared the Lower House in May 2026 and is currently in the Upper House as of June 2026, it is highly forward-looking to register a watch on its final passage/enactment by the Diet.
Let's register a `one_shot` watch for Japan's APPI 2026 amendment bill final passage.
- Entity: `Japan Diet / PPC`
- Title: `Japan APPI 2026 Amendment Bill Final Passage`
- Watch type: `live_process`
- Cardinality: `one_shot`
- Description: Check if the House of Councillors (Upper House) has passed the APPI amendment bill, officially enacting it into law, and monitor the publication of the subsequent cabinet orders and PPC guidelines.
Let's call `record_watch`.
other record_watch
Agent
Excellent! We have registered the watch for the final passage of the Japan APPI 2026 amendment bill.
Let's do a quick review of the findings we have produced:
1. `south-korea-pipc-prevention-transition-2026`: Updated with the June 1, 2026 draft Enforcement Decree details, including CPO board approval, 72-hour breach reporting, and ISMS-P certification timelines.
2. `japan-appi-2026-amendments-diet-enactment`: Updated with the May 26, 2026 Lower House passage and a comprehensive, structured breakdown of the bill's provisions (AI exceptions, children's data, biometric data, processor relief, administrative surcharges).
Both note updates are highly detailed, grounded in concrete evidence, carry verbatim quotes and/or specific article citations, and name and link the actual sources consulted this cycle.
We have also recorded an event on the South Korea PIPA thread (`resolves: false`) and registered a new watch for the Japan APPI bill's final passage.
We are now ready to call `finish_cycle` and conclude the research cycle. Let's do it.
other finish_cycle
Agent
I have successfully completed this research cycle. Below is a summary of the findings and regulatory updates established during this cycle:
### 1. Japan APPI 2026 Amendments: Lower House Passage and Deep Dive
* **Status Update**: The landmark bill to amend the **Act on the Protection of Personal Information (APPI)** was approved by the Japanese Cabinet on **April 7, 2026**, and officially **passed the House of Representatives (Lower House) on May 26, 2026**. As of **June 2026**, it is under active deliberation in the House of Councillors (Upper House), with final passage expected later this year. Enforcement will begin within two years of promulgation (by **2028**).
* **Key Provisions**:
* **AI & Statistical Processing Exception (Articles 30-2, 31-3)**: Businesses can collect publicly available sensitive personal data and share data with third parties without consent for statistical compilation or AI training, provided individual identifiers are eliminated, advance disclosures are made, and a written agreement is executed.
* **Children's Data (Under 16)**: Requires parental consent and notices. Grants minors/guardians a relaxed right to delete or suspend the use of their data without needing to prove a statutory violation.
* **"Specific Biometric Personal Information"**: Establishes a new category for biometric data (e.g., facial recognition data) obtained easily and without the individual's obvious awareness. Restricts its transfer via opt-out and relaxes suspension/deletion rights.
* **Entrusted B2B Processor Relief (Article 58-2)**: Exempts outsourced processors from most general APPI obligations (e.g., direct data subject rights requests) if a strict, compliant contract is executed and adhered to.
* **First-Ever Administrative Surcharge System**: Empowers the PPC to order monetary fines to confiscate ill-gotten gains from serious violations (e.g., sharing data knowing it will be used for illegal acts). Includes a 50% reduction leniency program for voluntary self-reporting.
* **Note Updated**: `[[japan-appi-2026-amendments-diet-enactment]]`
### 2. South Korea PIPA Enforcement Decree: Draft Released for Consultation
* **Status Update**: Following the promulgation of the sweeping PIPA amendments on **March 10, 2026** (effective **September 11, 2026**), the PIPC released a draft **Enforcement Decree** on **June 1, 2026**, opening a public consultation running through **July 13, 2026**.
* **Key Provisions**:
* **Board-Level CPO Mandates**: Entities with annual revenue of at least **KRW 180 billion** (processing sensitive data of $\ge$ 50,000 or general data of $\ge$ 1 million people) must obtain board-of-directors approval and notify the PIPC within one month of appointing or changing a Chief Privacy Officer.
* **72-Hour Breach Notification**: Mandates that organizations notify affected data subjects within **72 hours** of discovering unauthorized access or illegal data distribution.
* **Mandatory ISMS-P Certification**: Requires certain high-risk entities to obtain the Personal Information & Information Security Management System (ISMS-P) certification by **December 31, 2028**.
* **Note Updated**: `[[south-korea-pipc-prevention-transition-2026]]`
### 3. Thread and Watch Management
* **Recorded Event**: Logged an interim progress event on the existing watch thread `South Korea PIPA Amendments Effective Date` (Thread ID: `019ea65b-07fe-7c2e-9523-b76595db9abe`), capturing the release of the June 1, 2026 draft Enforcement Decree. The watch remains open (`resolves: false`) until the official effective date on September 11, 2026.
* **Registered Watch**: Created a new `one_shot` watch for `Japan APPI 2026 Amendment Bill Final Passage` to monitor the upcoming Upper House vote and the subsequent publication of cabinet orders and PPC rules.