Law note · Japan

Act on the Protection of Personal Information, individual identification code and biometric provisions

cite Act No. 57 of 2003 as amended by Act No. 37 of 2021, Art. 2(2)(i); Cabinet Order to Enforce the Act (Cabinet Order No. 507 of 2003, as amended), Art. 1 stage IN FORCE in force since 2022-04-01 kind Biometric privacy binds public and private bodies reviewed 2026-08-29

What it requires

An app that derives a faceprint, voiceprint, or other individual identification code from a person in Japan, including one derived from a photo, video, or audio recording, must give purpose-of-use notice and avoid wrongful acquisition under APPI's general rules, and must obtain the data subject's consent before disclosing the identifier to a third party.

When LexLint raises it

processes_biometrics
processes_voice
trains_models
crawls_web

Excludes recording-derived identifiers: No

What we found

APPI reaches biometric identifiers through the concept of an individual identification code (Art. 2(2)(i)): a code converted to identify a specific individual by a distinguishing physical feature. Cabinet Order Art. 1 enumerates the covered features and names both facial appearance and vocal characteristics expressly, alongside DNA base sequence, iris pattern, gait, and palm or hand vein pattern.

Personal information containing an individual identification code is personal information in itself, without needing to be combined with other data, but it sits outside the Art. 2(3) sensitive personal information category, so its capture does not trigger the Art. 20(2) prior-consent requirement that applies to race, health data, and similar categories; disclosure to a third party instead requires the data subject's consent under the general third-party-provision rule, since data containing an individual identification code is excluded from the opt-out mechanism.

Primary source

official statute and Cabinet Order text, Japanese Law Translation portal

← Back to the example · Lint your app →