What it is
On 2 June 2023, Japan’s Personal Information Protection Commission (PPC) published an alert on the use of generative AI services. A day earlier, on 1 June 2023, it had issued a separate notice to OpenAI under Article 147 of the Act on the Protection of Personal Information (APPI). Both remain the regulator’s main published position on personal data in generative AI prompts. The alert is in Japanese only.
What the PPC asks
Businesses using generative AI
- Before entering personal information into prompts, confirm the use is within the stated purpose of use.
- If personal data is entered without the person’s consent, confirm the provider will not use it for anything other than producing the response, including machine learning.
Government bodies: keep use to the minimum necessary and ensure the data is not used for training.
Individual users: inputs may be used for machine learning, outputs may be inaccurate, and the provider’s terms and privacy policy should be checked.
OpenAI (the 1 June 2023 notice): do not collect sensitive personal information without prior consent, reduce or delete sensitive data before training, honor requests not to collect from specific sites, and publish purposes of use in Japanese.
What has changed since
The alert itself has not been replaced, but the APPI has been amended. The amending law was promulgated on 17 July 2026 and includes an exception for using personal data only to create statistical information, including some AI development (see the APPI article in this series).
Reuse terms
PPC content is usable under PDL1.0 unless otherwise noted, with attribution (“Source: Personal Information Protection Commission website, URL”) and a note of edits. Do not present edited material as the government’s.
What it means for AI and RAG
- Map purposes of use before personal data reaches any prompt or retrieval index.
- Check vendor terms for training on inputs, and use enterprise settings that exclude it.
- Keep personal data out of shared RAG indexes unless the purpose covers it.
- Log what data types each AI workflow handles.
- Translate carefully: the alert is Japanese-only, so label any English summary as unofficial and edited.
Common mistakes
- Assuming the alert only concerns OpenAI.
- Entering customer data into consumer AI tools that train on inputs.
- Treating outputs as accurate without review.
- Using an English summary without the edit notice PDL1.0 requires.
Checklist
- Purpose-of-use check before AI input
- Vendor training settings verified
- Personal data excluded from shared indexes
- Data-type log per AI workflow
- Attribution and edit notes on translations
How AskDona helps
AskDona compares your AI acceptable-use policy and vendor contracts with the PPC’s points and flags gaps, citing each source passage.
Run a sample AI privacy policy check
AskDona shows the evidence; your privacy team decides.
Editor’s note. This article is general information, not legal advice. The “conditions to check” rating comes from our source list and is a first-pass judgment, not a legal opinion.
FAQ
Can employees in Japan put personal data into ChatGPT? Only within the purpose of use, and, without consent, only if the provider will not use it for training or other purposes.
Is the alert in English? No, it is Japanese-only.
Did the PPC take action against OpenAI? It issued a notice under APPI Article 147 on 1 June 2023 with specific requests.
Has the law changed since? Yes. An APPI amendment was promulgated on 17 July 2026.
References
All pages opened and checked by October 26, 2026.
| Source | What it supports |
|---|---|
| PPC: Alert on generative AI services | Page, date, attachments |
| PPC: Alert text (PDF) | Points for businesses, government, users |
| PPC: Notice to OpenAI (PDF) | Article 147 notice |
| PPC: Terms of use | PDL1.0, attribution |
| PPC: 2026 APPI amendment | Promulgation 17 July 2026 |