Duty LXD-1339
Processes biometric data, in Japan
Each law's tag says when it binds: since in force from a date not yet set not yet in force
Act on the Protection of Personal Information, individual identification code and biometric provisionssince 1 line
Act No. 57 of 2003, as amended by Act No. 37 of 2021, Art. 2(2)(i); Cabinet Order to Enforce the Act (Cabinet Order No. 507 of 2003, as amended), Art. 1 · Read the law's page
- An app that derives a faceprint, voiceprint, or other individual identification code from a person in Japan, including one derived from a photo, video, or audio recording, must give purpose-of-use notice and avoid wrongful acquisition under APPI's general rules, and must obtain the data subject's consent before disclosing the identifier to a third party.
Act on Promotion of Research and Development, and Utilization of Artificial Intelligence-related Technology (AI Promotion Act)since 2 lines
Act No. 53 of 2025 · Read the law's page
- A utilization business operator (any person developing, providing, or using AI-related technology in its business activities) is to endeavor to enhance the efficiency and advancement of its business activities and to create new industries through the active use of AI-related technology, in accordance with the Act's basic principles.
- A utilization business operator must cooperate with the AI-promotion measures the national government carries out under Article 4 and a local government carries out under Article 5.
Act on the Protection of Personal Information, Specific Biometric Personal Informationfrom a date not yet set1 line
Act No. 57 of 2003, as amended by Act No. 56 of 2026, Arts. 16(5), 21-2, 27(2), 35(7)-(8) · Read the law's page
- An app that handles a data subject's Specific Biometric Personal Information, an individual identification code converted from a bodily feature obtainable without special technology or great expense and of a kind the data subject cannot easily recognize is being captured, must, except in specified cases, notify the data subject in advance or place the purpose of use where the data subject can readily learn it; may not provide it to a third party under the ordinary opt-out mechanism; and must, on the data subject's request, cease using it or stop providing it to a third party without delay, unless a specified exception applies.