JapanWhat is special care-required personal information?
Special care-required personal information in Japan refers to personal data that could lead to unfair discrimination, prejudice, or other disadvantages if mishandled — including race, creed, social status, medical history, criminal record, and more.
What the Law Says
Under Japan’s Act on the Protection of Personal Information (APPI), special care-required personal information is strictly regulated due to its sensitivity and potential for harm.
Special care-required personal information is defined in the APPI as personal information that requires special attention because misuse could result in unfair discrimination, prejudice, or other disadvantages. This includes data about a person’s race, creed, social status, medical history, criminal record, and other specified categories.
Business operators must obtain prior, explicit consent from the individual before collecting, using, or providing such information to third parties — with very limited exceptions. Unlike regular personal data, there is no 'opt-out' mechanism; consent must be affirmative and informed.
The law lists 11 specific categories — including physical disabilities, mental disabilities, infection status, and treatment history — and also covers any other personal information designated by the Personal Information Protection Commission (PPC) as requiring special care.
Statutory Text‘Special care-required personal information’ means personal information regarding a person’s race, creed, social status, medical history, criminal record, or other descriptions, the handling of which requires special care in order not to cause unfair discrimination, prejudice, or other disadvantages to the person.
— Act on the Protection of Personal Information, s. 2(3) — Definition
Statutory TextA business operator shall not handle special care-required personal information without obtaining the prior consent of the individual concerned, except where otherwise provided by laws and regulations.
— Act on the Protection of Personal Information, s. 17(1) — Consent requirement
What to Do
Identify whether the data you hold falls under any of the 11 statutory categories in APPI s. 2(3).
Obtain clear, affirmative, and documented consent before collecting or using such information.
Implement strict access controls, encryption, and audit logs for storage and transmission.
Do not share special care-required personal information with third parties unless legally permitted and consented.
Report any data breach involving this information to the PPC and affected individuals without delay.
Sources
Not legal advice. This article is general information based on publicly available sources, written for educational purposes. Laws change and individual situations vary. Consult a licensed attorney in your jurisdiction before acting on anything you read here. Last reviewed: 2026-06-08.