JapanAct on the Protection of Personal Information, Specific Biometric Personal Information
Act No. 57 of 2003, as amended by Act No. 56 of 2026, Arts. 16(5), 21-2, 27(2), 35(7)-(8)
A biometric privacy rule binding private bodies.
- Audit expectation
- none
What it requires
- An app that handles a data subject's Specific Biometric Personal Information, an individual identification code converted from a bodily feature obtainable without special technology or great expense and of a kind the data subject cannot easily recognize is being captured, must, except in specified cases, notify the data subject in advance or place the purpose of use where the data subject can readily learn it; may not provide it to a third party under the ordinary opt-out mechanism; and must, on the data subject's request, cease using it or stop providing it to a third party without delay, unless a specified exception applies.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
The row's provisions define Specific Biometric Personal Information (Article 16(5)), require advance notice, or a readily accessible statement, of the business's name, the purpose of use and the biometric feature handled (Article 21-2), bar the ordinary opt-out route for providing it to a third party (Article 27(2) proviso) and give the data subject a right to stop its use or provision (Article 35(7) and (8)). None requires a business to make, keep or produce a log or record. The same Act inserts a pre-provision confirmation under Article 27(7) and amends the record in Article 29(1) to carry its results, but those are outside the cited provisions. The Act is enacted and not yet in force. The Act's record duties sit in Article 29 (a record of each provision of personal data to a third party, with the date and the third party's name, kept for the period a Commission order sets) and Article 30 (confirmation and a record on receiving personal data from a third party); neither article is among the provisions this row cites, so the row does not borrow them.
- Kind
- None
- As of
What this law does
A new Specific Biometric Personal Information category (Art. 16(5)) covers an individual identification code converted from a bodily feature that is obtainable without special technology or great expense and that a Cabinet Order specifies as one the data subject cannot easily recognize is being captured, aimed at facial-recognition data captured passively.
A business handling it must give advance purpose-of-use notice (Art. 21-2), may not rely on the ordinary opt-out mechanism to provide it to a third party (Art. 27(2)), and must honor a data subject's request to stop using it or providing it to a third party even absent any illegality (Art. 35(7)-(8)), a use-cessation right the current Act's individual identification code category does not carry. The Act comes into force on a day a Cabinet Order sets within two years of its promulgation.
When LexLint raises it
When your app profile says your app processes biometric data.
Back to the example · Lint your app
Page updated .