Japan's Cabinet approves easing of personal data rules for AI development

Japan is taking another step toward becoming the most convenient jurisdiction for AI development. On April 7, 2026, the cabinet approved amendments to the Personal Information Protection Law that remove the requirement to obtain citizen consent for using data for statistics and certain AI tasks.

What's Changing

The key news is that data subject consent will no longer be required if personal data is transferred to third parties or used for creating statistics, and such activity falls under the category of AI development. This also applies to obtaining published sensitive data — for example, information from already open sources, if used specifically for statistical processing. The Japanese regulator emphasizes separately: this is not about free circulation of any personal data, but about modes where the ultimate goal is statistics and analytics, not work with a specific person.

The amendments also expand other exceptions. Consent need not be requested if circumstances clearly show that processing does not contradict the person's will and does not harm their rights and interests. Conditions are eased for processing data for the purpose of protecting life and health or public health.

One more clarification is important for medicine: organizations providing medical services are directly included in the category of structures to which exceptions for academic research apply.

Where Control Isn't Relaxed

At first glance, it seems Japan is simply opening the gates for data, but the package of amendments is organized much more complexly. Simultaneously with relaxations for AI and statistics, the state adds new restrictions and control tools, especially where the risk to people is higher: in working with biometrics, minor data, mediated information transfer, and economically motivated abuse. In other words, the relaxations are addressed not to all scenarios at once, but only to those that authorities consider relatively safe.

• For users under 16, consent and notifications must be addressed to legal representatives.
• For facial trait data, additional disclosure requirements are introduced, and transfer of such data to third parties via opt-out mechanism is prohibited.
• Recipients of data under opt-out mechanisms must be verified for identity and purpose of use.
• For serious violations, stricter sanctions are introduced, including monetary penalties comparable to benefits obtained.
• Authorities gain more power to require rapid remedy of violations and disclosure of information about them.

This is important: the deregulatory course does not mean abandoning oversight. On the contrary, Japan is attempting to divide regimes into two classes — low-risk data use for development and statistics, which they want to accelerate, and sensitive scenarios, where oversight becomes even stricter than before. Essentially, Tokyo is not removing rules entirely, but reconfiguring them under AI economy priorities while simultaneously protecting the most privacy-conflictive zones.

Why Japan Needs This

The amendments did not appear out of nowhere. They fit into a broader state strategy: already in the AI Basic Plan, Japanese authorities fixed the goal of making the country the most AI-friendly in the world. Government documents explicitly state that Japan lags in the pace of AI implementation and investment, and weak practical use of technology has already become a brake on its own development.

Therefore, regulatory reform here is not a side measure, but part of national industrial policy. The logic of reform is simple: if companies and research teams have fewer legal barriers to combining and analyzing data, it will be easier for them to train models, test applied services, and launch industry products. Japan is clearly betting not only on foundational models but also on applied AI for industry, medicine, government services, and robotics.

At the same time, changes will not take effect immediately: the bill must still go through parliamentary procedures, and the entry-into-force timeline is set within two years of the law's official publication.

What This Means

For AI companies, Japan is becoming a platform with a noticeably more convenient data-handling regime than before, especially in tasks related to statistics, training, and inter-corporate data exchange. But this is not "abolishing privacy": the state is simultaneously strengthening rules for biometrics, minors, and malicious use of personal information. The key signal is different — Tokyo is ready to change the legal framework for the AI race and remove barriers for the market, rather than wait for business to adapt on its own.