Data, privacy and AI rules

Due in 60 days12Regulations190

12 due in 60 days · 190 regulations

Jurisdiction

Japan: data, AI and cyber laws

Part of APAC.

Regulations

Add to calendar
Apple Calendar or OutlookGoogle Calendar Download .ics
Enacted
Japan Active Cyber Defense ActJapan's active cyber defense law. Designated critical infrastructure operators must register the important computers they bring in (product and maker) with their sector minister and report cyber intrusions and precursor events to that minister and the Prime Minister. The Act also lets the government collect and analyse communications data on foreign cyber attacks under oversight by a new Cyber Communications Information Supervisory Commission.Next: Nov 22, 2027 Communications data measures in force (latest date) · in 13 months
In force
Japan AI Promotion ActA framework law to promote AI R&D and use, not to restrict it. It sets up the AI Strategy Headquarters under the Prime Minister and an AI Basic Plan. The government can investigate cases where AI causes harm to rights and publish guidance and names. It sets no direct compliance obligations or fines for businesses, beyond a duty to cooperate with government measures.In effect since Jun 4, 2025
Amended
Japan APPIJapan's general privacy law covering purpose specification, security, third-party transfer consent (with an opt-out scheme), cross-border transfer rules, mandatory breach reporting, and pseudonymized data. The 2026 amendment (promulgated 17 July 2026) adds Japan's first administrative fine (disgorgement of gains from serious violations), guardian consent for children under 16, stricter rules on facial-feature data, relaxed breach notification to individuals, and a consent exemption for statistics and AI development.In effect since Apr 1, 2005

Upcoming deadlines

Takes effectTentativeNov 22, 2027 · in 13 months
Japan Active Cyber Defense ActCommunications data measures in force (latest date)Chapters 3 to 7 on agreements with operators and collection of communications data take effect by Cabinet Order within 2 years and 6 months of promulgation. e-Gov lists 22 Nov 2027 as the outer limit, not a fixed date.Japan

Past deadlines

ComplianceOct 1 · 26 days ago
Japan Active Cyber Defense ActRegistration and incident reporting duties startMain provisions take effect, including Chapter 2 duties for special social infrastructure operators to register important computers and report specified intrusion incidents.Japan
MilestoneJul 17 · 3 months ago
Japan APPI2026 APPI amendment act promulgatedAmendment enacted by the Diet on 10 July 2026 and promulgated; main provisions take effect by cabinet order within two years of promulgation.Japan
Takes effectApr 1 · 7 months ago
Japan Active Cyber Defense ActSupervisory Commission provisions in forceProvisions setting up the Cyber Communications Information Supervisory Commission take effect, per the e-Gov revision history.Japan
Takes effectSep 1, 2025 · 14 months ago
Japan AI Promotion ActAI Promotion Act fully in forceProvisions establishing the AI Strategy Headquarters and AI Basic Plan take effect.Japan
Takes effectJun 4, 2025 · 17 months ago
Japan AI Promotion ActAI Promotion Act promulgated and partly in forceMost provisions, including basic principles and stakeholder duties, take effect on promulgation.Japan
MilestoneMay 23, 2025 · 17 months ago
Japan Active Cyber Defense ActAct promulgatedAct No. 42 of 2025 promulgated; preparatory supplementary provisions apply from this day.Japan
Takes effectApr 1, 2022 · 4.6 years ago
Japan APPI2020 amendments in forceMandatory breach reporting, pseudonymized information and stricter cross-border rules apply.Japan