Law / Japan

Act on the Protection of Personal Information, individual identification code and biometric provisions

Act No. 57 of 2003 as amended by Act No. 37 of 2021, Art. 2(2)(i); Cabinet Order to Enforce the Act (Cabinet Order No. 507 of 2003, as amended), Art. 1

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 1 April 2022.

A biometric privacy rule binding public and private bodies.

As of 29 August 2026.

What it requires

An app that derives a faceprint, voiceprint, or other individual identification code from a person in Japan, including one derived from a photo, video, or audio recording, must give purpose-of-use notice and avoid wrongful acquisition under APPI's general rules, and must obtain the data subject's consent before disclosing the identifier to a third party.

What it reaches

Excludes recording-derived identifiersNo

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

APPI reaches biometric identifiers through the concept of an individual identification code (Art. 2(2)(i)): a code converted to identify a specific individual by a distinguishing physical feature. Cabinet Order Art. 1 enumerates the covered features and names both facial appearance and vocal characteristics expressly, alongside DNA base sequence, iris pattern, gait, and palm or hand vein pattern.

Personal information containing an individual identification code is personal information in itself, without needing to be combined with other data, but it sits outside the Art. 2(3) sensitive personal information category, so its capture does not trigger the Art. 20(2) prior-consent requirement that applies to race, health data, and similar categories; disclosure to a third party instead requires the data subject's consent under the general third-party-provision rule, since data containing an individual identification code is excluded from the opt-out mechanism.

When LexLint raises it

processes_biometrics
processes_voice
trains_models
crawls_web

Read the law

official statute and Cabinet Order text, Japanese Law Translation portal

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app