Japan amends the penalties under the Act on the Protection of Personal Information and related acts — new offense of wrongful acquisition of personal information, in force January 17, 2027

Source material is a Japanese government announcement (in Japanese); this page is a summary.

Of the Act Partially Amending the Act on the Protection of Personal Information and Related Acts (個人情報の保護に関する法律等の一部を改正する法律, 令和8年法律第56号), promulgated on July 17, 2026 (令和8年7月17日), the penalty-related provisions take effect on January 17, 2027. Three acts are amended: (1) the Act on the Protection of Personal Information (個人情報の保護に関する法律), (2) the My Number Act (行政手続における特定の個人を識別するための番号の利用等に関する法律), and (3) the Next-Generation Medical Infrastructure Act (医療分野の研究開発に資するための匿名加工医療情報及び仮名加工医療情報に関する法律). If you live or work in Japan, there are three points worth noting. 1) A penal provision aimed at the act of extracting personal information itself is newly added to the Act on the Protection of Personal Information (new Article 180). Where a person, for the purpose of securing a wrongful gain for themselves or for a third party, or for the purpose of causing damage to the individual concerned, to a person holding personal information, or to any other person, acquires personal information by deceiving a person, by using violence against a person, or by intimidating a person, or by theft or destruction of property, intrusion into a facility, interception of wire telecommunications (有線電気通信の傍受), an act of unauthorized computer access (不正アクセス行為; an act of unauthorized computer access as provided in Article 2, paragraph 4 of the Act on Prohibition of Unauthorized Computer Access, 不正アクセス行為の禁止等に関する法律), or any other act that impairs the management by a person holding personal information, the person who committed that violation is punished by imprisonment for up to 2 years or a fine of up to 1 million yen (100万円). Paragraph 2 of the same Article provides that this provision does not preclude the application of the Penal Code (刑法, 明治40年法律第45号) or other penal provisions. 2) The statutory maximums are raised for the provisions that apply to people who handle personal information in the course of business. Where a personal information handling business operator (個人情報取扱事業者; in the case of a corporation, its officer, representative, or administrator), an employee of such an operator, or a person who formerly held such a position provides or misappropriates a personal information database and the like handled in connection with their duties, the penalty changes from imprisonment for up to 1 year or a fine of up to 500,000 yen (50万円) to imprisonment for up to 2 years or a fine of up to 1 million yen (100万円) (former Article 179 → new Article 178). Where an employee or former employee of an administrative organ or the like, a person who is or was engaged in entrusted work, or a dispatched worker who is or was engaged in handling personal information, pseudonymously processed information (仮名加工情報), or anonymously processed information (匿名加工情報) at an administrative organ or the like provides, without justifiable grounds, a personal information file (個人情報ファイル) falling under Article 60, paragraph 2, item 1 in which matters constituting an individual's secrets are recorded (including anything that reproduces or processes all or part of such a file), the penalty changes from imprisonment for up to 2 years or a fine of up to 1 million yen (100万円) to imprisonment for up to 3 years or a fine of up to 1.5 million yen (150万円) (Article 176). Where an employee or the like of an administrative organ or the like provides or misappropriates retained personal information (保有個人情報) that they learned of in the course of their duties, the penalty likewise changes from imprisonment for up to 1 year or a fine of up to 500,000 yen (50万円) to imprisonment for up to 2 years or a fine of up to 1 million yen (100万円) (former Article 180 → new Article 179). New Article 178 and new Article 179 add “the purpose of causing damage to the individual concerned or to any other person” as a purpose requirement, alongside the existing “purpose of securing a wrongful gain for oneself or for a third party.” Article 176 has no purpose requirement: both before and after the amendment it covers provision made without justifiable grounds (正当な理由がないのに), and all this amendment changes there is the level of punishment. As before, a person remains within scope after leaving their position, as “a person who formerly held such a position.” 3) Fines for corporations are set out separately. New Article 185, paragraph 1 provides that where a representative of a corporation, or an agent, employee, or other worker of a corporation or of an individual, commits a violation in connection with the business of that corporation or individual, then in addition to punishing the offender, the fine specified in the relevant item is imposed on the corporation and the fine prescribed in the applicable Article is imposed on that individual; item 1 (Article 178 and Article 181) carries a fine of up to 100 million yen (1億円), and item 2 (Article 180 and Article 183) carries the fine prescribed in the applicable Article. In addition, new Article 184 applies the offenses under Articles 176 through 180 and Article 182 to persons who commit them outside Japan (excluding Article 180, paragraph 2). The medical and My Number fields change on the same day as well. Under the Next-Generation Medical Infrastructure Act, Article 68 (where an officer or employee, or a former officer or employee, of an accredited anonymously processed medical information creation business operator, an accredited pseudonymously processed medical information creation business operator, or an accredited medical information handling contractor provides a medical information database and the like without justifiable grounds) changes from imprisonment for up to 2 years or a fine of up to 1 million yen (100万円) to imprisonment for up to 3 years or a fine of up to 1.5 million yen (150万円); Article 69, paragraphs 1 through 4 (wrongful provision or misappropriation of anonymously processed medical information and the like, pseudonymously processed medical information and the like, provided pseudonymously processed medical information, and medical information and the like) change from imprisonment for up to 1 year to imprisonment for up to 2 years, with the fine remaining up to 1 million yen (100万円), and for all of these provisions imprisonment and a fine may be imposed cumulatively (併科). Article 69 also adds “the purpose of causing damage to the individual concerned or to any other person.” Under the My Number Act, the same purpose requirement is added to Article 49 (wrongful provision or misappropriation of an individual number) while the penalty remains imprisonment for up to 3 years or a fine of up to 1.5 million yen (150万円, which may be imposed cumulatively), and “destruction of property” and “interception of wire telecommunications” are expressly added to the means covered by Article 51, paragraph 1 (wrongful acquisition of an individual number). On the procedural side, the way the Personal Information Protection Commission (個人情報保護委員会) effects service by publication (公示送達) changes (Article 163, paragraphs 2 and 3). Instead of only posting on the Commission's bulletin board a notice to the effect that the document to be served will be delivered at any time, service is effected by measures that place that notice in a state where an unspecified large number of people can inspect it, by a method specified by rules of the Personal Information Protection Commission, and that additionally either post on the bulletin board a document stating that fact or place what is displayed on the screen of a computer installed at the Commission's office in a state where it can be inspected. The effect arises once 2 weeks have passed from the day those measures were commenced (6 weeks for service by publication where service is to be effected outside Japan). One caveat: January 17, 2027 is not the effective date of the amending Act as a whole. The main clause of Article 1 of the Supplementary Provisions (附則) of the amending Act sets the general effective date as “the day specified by Cabinet Order within a period not exceeding 2 years from the day of promulgation,” and only the provisions listed in item 3 of the proviso to the same Article (the penalty provisions above and others) take effect on “the day on which 6 months have elapsed from the day of promulgation.” Because the Cabinet Order has not yet been made, the effective date of the main body of the amendment is not fixed. Transitional measures necessary for enforcement, including transitional measures concerning penalties, are delegated to Cabinet Order (Article 13 of the Supplementary Provisions, which takes effect on the day of promulgation).

Of the Act Partially Amending the Act on the Protection of Personal Information and Related Acts (個人情報の保護に関する法律等の一部を改正する法律, 令和8年法律第56号), promulgated on July 17, 2026 (令和8年7月17日), the penalty-related provisions take effect on January 17, 2027. A new offense of wrongful acquisition of personal information (個人情報不正取得罪; imprisonment for up to 2 years or a fine of up to 1 million yen / 100万円) is added to the Act on the Protection of Personal Information, the statutory maximums for offenses such as wrongful provision or misappropriation of a personal information database and the like are raised, and the penalty provisions of the My Number Act (マイナンバー法) and the Next-Generation Medical Infrastructure Act (次世代医療基盤法) also change on the same day.

Summaries below are factual notes based on government announcements and primary sources — not evaluations or opinions.

Summaries reflect national-level programs. Municipal (city/ward/town) programs may differ — confirm with the official desk before applying.