JapanAct on the Protection of Personal Information, statistics-creation consent exemption
Act No. 57 of 2003, as amended by Act No. 56 of 2026, Arts. 30-2, 31-3
A comprehensive regime rule binding public and private bodies.
- Audit expectation
- none
What it requires
- An app may acquire sensitive personal information that is already publicly available, without the data subject's consent, for the purpose of creating statistics or other large-scale trend analysis, or of providing it to a third party for that purpose, if it publishes the details of the statistics-creation activity over the internet.
- An app may provide personal information or personal-related information to a third party that needs it for statistics creation, without the data subject's consent, if both parties publish the statistics-creation details over the internet and a written agreement with the third party states the provision is made under this provision; the recipient may not use it beyond that stated purpose or pass it on to a further third party.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Article 31-3(10) applies Article 29(1) main text and (2) to a provision of related information under the statistics-creation exemption, so the business prepares, and keeps for the period a Commission order sets, a record of that provision. Article 30-2(10) applies the same two paragraphs to a provision of statistics-use sensitive personal information that is related information, and reads the provisos of Articles 29(1) and 30(1) so that a provision under Article 30-2(5) is not excused from the record. Article 30-2(5)(ii) and Article 31-3(1)(ii) also make a written agreement (including an electronic record) that states the provision is made under the exemption a condition of using it. What the record must hold is set in Article 29(1), which the row does not cite, so the row lists no log contents, and the retention period is left to a Commission order, so the row states no retention. The Act is enacted and not yet in force.
- Kind
- Explicit
- As of
- Provision
- Article 31-3, paragraph 10 (applying Article 29(1) main text and (2), the record of a provision to a third party and its retention, to a related-information business that provides related information to a special recipient), with Article 30-2, paragraph 10 (the same for a business that provides personal information under the statistics-creation exemption), as inserted by Act No. 56 of 2026
- Trigger
- personal_data_processing
What this law does
New Arts. 30-2 and 31-3 create a statistics creation etc. exemption, defined at Art. 2(13) as extracting and analyzing large volumes of information to produce trend or characteristic information of a kind the Personal Information Protection Commission's rules find low-risk to individual rights, letting a business acquire already-public sensitive personal information, or provide personal information or personal-related information to a third party, for that purpose without the data subject's consent, conditioned on publishing the statistics-creation details online and, for third-party provision, a written agreement so stating; the recipient may not use the data beyond the published purpose or pass it on further.
A parallel exemption at Arts. 69(2)(4) and 72-3 lets an administrative organ provide held personal information for the same purpose. The Act comes into force on a day a Cabinet Order sets within two years of its promulgation.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .