Act on the Protection of Personal Information, administrative surcharge order

Act No. 57 of 2003, as amended by Act No. 56 of 2026, Arts. 148-3 to 148-17

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

An enforcement supervision rule binding private bodies.

As of 23 September 2026.

What it requires

This duty is enacted but not yet in force; it takes effect on a day fixed by Cabinet Order no later than 16 July 2028.
An app that, in circumstances where it is expected a recipient will use personal information for an illegal act or unjust discriminatory treatment, provides personal information to that recipient and receives money or another benefit as consideration for doing so or for stopping doing so, faces a Personal Information Protection Commission order to pay a surcharge equal to that benefit to the national treasury, unless the affected data subjects number 1,000 or fewer, the app exercised reasonable care to prevent the conduct throughout the period, or another Cabinet Order exception applies.

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

A new Chapter VI power (Arts. 148-3 through 148-17) requires the Personal Information Protection Commission to order a personal-information handling business to pay a surcharge, to the national treasury, equal to money or another benefit the business received as consideration for providing personal information to a third party under circumstances where it was expected the recipient would use it for an illegal act or unjust discriminatory treatment, or for ceasing that conduct.

The Commission may not order payment where the business exercised reasonable care to prevent the conduct throughout the relevant period, where the data subjects affected number 1,000 or fewer, or in another case a Cabinet Order designates as not significantly harming individual rights and interests. The surcharge amount can be increased for a repeat violation or reduced for voluntary pre-investigation disclosure under Arts. 148-4 through 148-17; this duty has not yet commenced.

When LexLint raises it

crawls_web
trains_models
generates_content
deploys_chatbot
automated_outreach
high_risk_decisions
processes_voice
processes_biometrics

Read the law

official bill outline (法律案要綱), Personal Information Protection Commission, matching Act No. 56 of Reiwa 8 as promulgated

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app