JapanAct on the Protection of Personal Information, personal information of persons under 16
Act No. 57 of 2003, as amended by Act No. 56 of 2026, Arts. 40-2, 35(9)-(10)
A comprehensive regime rule binding private bodies.
- Obligation class
- Consent, Disclosure, Data subject rights, Breach notice
As of .
What it requires
- If you handle the personal information of a person under 16 in Japan, obtain the consent of the person's legal representative, not the person's own consent, wherever Article 18 (use beyond the specified purpose of use), Article 20(2) (acquisition of special care-required personal information), Article 27 (provision of personal data to a third party) or Article 28 (provision to a third party in a foreign country) requires the data subject's consent (Article 40-2(1)).NIST Privacy FrameworkCT.PO-P1
- Give the notice or public announcement of the purpose of use that Article 21 requires, and the notice of a data breach that Article 26(2) requires, to the legal representative of a person under 16 and not to the person (Article 40-2(1)).NIST Privacy FrameworkCM.AW-P1NIST Privacy FrameworkCM.AW-P7
- Before you provide information related to personal information about a person under 16 to a recipient that is expected to acquire it as personal data, confirm that the person's legal representative, not the person, has given the consent Article 31(1) requires (Article 40-2(2)).NIST Privacy FrameworkCT.PO-P1
- Cease using, or stop providing to a third party, personal data you hold that identifies a person under 16 without delay once the person's request under Article 35(9) is found justified, unless a case Article 35(9) lists applies or ceasing is difficult and you take the alternative measures needed to protect the person's rights and interests (Article 35(10)).NIST Privacy FrameworkCT.PO-P3
- You need not read the data subject as the legal representative where you have a justifiable reason for not knowing that the information is a person under 16's, where the legal representative permitted the person's business and you acquired the information in connection with it, or where the person has no legal representative or you have reasonable grounds to believe there is none (Article 40-2(1), items (i) to (iii)).
These lines are LexLint's reading of the law's text, as of .
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
- NIST CSF 2.0
- RS.CO-02Internal and external stakeholders are notified of incidents
- FINOS AIGF
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What this law does
Article 40-2(1) of the Act, inserted by Act No. 56 of Reiwa 8, provides that where a personal information handling business operator handles the personal information of a person under 16, the provisions it lists apply with the words for the data subject read as the data subject's legal representative, subject to specified adjustments.
The provisions it lists are Article 18, Article 20(2), Article 21, Article 21-2(1), Article 26(2), Article 27, Article 28, Article 30-2(1) and (5), Article 32(1) and Article 35(7).
The reading does not apply where the operator has a justifiable reason for not knowing that the information is a person under 16's, where the person's legal representative permitted the person's business and the operator acquired the information in connection with it, or where the person has no legal representative or the operator has reasonable grounds to believe there is none.
Article 40-2(2) applies a similar reading to Article 31(1) where a business handling information related to personal information handles such information about a person under 16, with the same three exceptions. Article 35(9) lets a person under 16 ask a business operator to cease using, or to stop providing to a third party, retained personal data that identifies the person, except in the cases it lists.
Article 35(10) requires the operator to cease the use or stop the provision without delay once such a request is found justified, unless doing so costs a large sum or is otherwise difficult and the operator takes alternative measures needed to protect the person's rights and interests. Article 71-3 applies the same reading to administrative organs. The Act comes into force on a day a Cabinet Order sets within two years of its promulgation.
When LexLint raises it
When your app profile says your app serves under-18s.