What happened
On 1 October 2026, the secretariat of Japan's Personal Information Protection Commission (PPC) released a 53-page draft paper (second of a series) setting out detailed Cabinet Order and commission rules to implement the Act Partially Amending the Act on the Protection of Personal Information (Act No. 56 of 2026). The draft operationalises the new 'statistics creation' exception that expressly reaches AI development: businesses may collect sensitive data already published online (via web scraping 'and similar methods') and share personal data with third parties without consent — including beyond originally specified purposes, potentially yielding sensitive information — provided the data is used only for statistics/AI training, both sides publish details on a single search-engine-readable web page, and recipients are barred from other uses. It also sets a narrower regime for outsourced data processors and lighter batch breach-reporting for low-risk, single-person leaks.
Why it matters
This is the regulatory plumbing for a statute letting Japanese AI developers and data pools train on personal data without individual consent — a direct, rules-level counterweight to the EU's consent-centric posture and a major exemption many global data controllers and AI model trainers operating in Japan will use. Any company holding Japanese personal data or scraping Japanese web pages to train models must understand the eligibility, disclosure-on-a-crawlable-page, written-agreement and no-re-use conditions, or risk rebuilding compliance pipelines when rules are finalised.
Action needed
Stakeholders should track PPC consultation and comment on the draft paper; firms intending to use the statistics/AI exception should pre-plan the public I-page disclosures, written transfer agreements, and entrustee contract terms the draft contemplates. No effective date is yet set.