Japan: Cabinet approved draft Bill amending Act on the Protection of Personal Information and Other Acts including data protection authority governance

On 7 April 2026, the Cabinet approved the draft Bill amending the Act on the Protection of Personal Information and Other Acts. The Bill applies to both public and private entities handling personal data. It expands the supervisory and enforcement powers of the Personal Information Protection Commission. The Commission may recommend or order personal information handling business operators to take measures, including cessation of violations, notification to individuals of facts relating to violations, and other measures necessary to protect the rights and interests of individuals. Where serious harm to the rights and interests of individuals is imminent, the Commission may issue an order without first making a recommendation. Where an operator fails to comply with a measures order, the Commission may request a handling-related service provider to cease handling the personal information subject to the violation or to cease providing the relevant services. Where a violation involves transmission of information containing personal information via specific telecommunications, the Commission may request the specific telecommunications service provider to take measures to prevent distribution. The Commission may issue surcharge payment orders where a personal information handling business operator has provided personal information to a third party in circumstances where illegal use or unjustly discriminatory treatment is anticipated, and consideration has been obtained.