Face recognition in Japan
In Japan, a face recognition template is a personal identification code under the Act on the Protection of Personal Information, which makes it personal information in its own right, independent of any name attached to it. The Personal Information Protection Commission supervises the Act.
How does Japanese law classify face data?
The Act on the Protection of Personal Information — the APPI — defines a category called a personal identification code. A biometric feature converted into data for computer processing, which is what a face template is, falls inside it. The consequence is direct: the template is personal information by itself, whether or not a name, an employee number or any other identifier sits beside it.
That matters for system design more than it sounds. An operator cannot argue that an anonymous template is outside the Act because nothing identifies the person, since the code is the identification. Purpose of use must be specified and notified, and use beyond that purpose requires consent.
The Personal Information Protection Commission is the supervisory authority. It issues the guidelines that carry the practical detail, and it has the power to order and to recommend.
What did the 2022 amendments change?
- Breach reporting to the Personal Information Protection Commission became mandatory, with notification to the affected people, where a leak is likely to harm their rights.
- Cross-border transfers now require more disclosure: the person has to be told about the data protection regime of the destination country.
- Individuals gained stronger rights to demand cessation of use and deletion.
- A category of pseudonymously processed information was introduced, with lighter obligations in exchange for restrictions on re-identification.
A face template is not made pseudonymous by removing the name beside it. Pseudonymously processed information has a statutory definition, and a personal identification code does not stop being one because its label was stripped.
Does face data have to stay in Japan?
No. Japan imposes no general data localisation requirement. Transfer to a third country is permitted where the recipient is in a country designated as having an equivalent standard, or has established a system meeting the Commission's requirements, or where the person has given consent after being informed about the destination regime.
In practice many Japanese operators — government bodies, transport operators, financial institutions — prefer that the data does not leave the site at all, which is a procurement preference rather than a legal requirement. Ayonix face recognition supports that directly: an ATLAS BOX appliance or the operator's own servers run detection, template extraction and matching locally, with no vendor service in the path.
What does it mean that Ayonix is Japanese?
Three things that a buyer can check rather than take on trust. The company was founded in Japan in 2007 and its headquarters is in Tokyo. Its published case studies include Japanese deployments and trials with Japanese organisations. And its technology has been submitted to the face recognition evaluations run by the United States National Institute of Standards and Technology, whose results are public and independently produced. NIST does not certify, approve or endorse vendors.
What it does not mean is a claim of compliance. No vendor, Japanese or otherwise, can make an operator compliant with the APPI: the purpose specification, the notification, the retention and the response to a request for cessation are the operator's, and they are decisions about the deployment rather than properties of the software.
This page describes what the named laws require, with each instrument cited so it can be checked. It is not legal advice, and it is not a statement that any particular deployment complies: that assessment belongs to your own counsel and your data protection authority.
Frequently asked questions
- Is face recognition legal in Japan?
- Yes, subject to the Act on the Protection of Personal Information. A face template is a personal identification code and therefore personal information, so its purpose of use must be specified and notified, and use beyond that purpose requires consent.
- Is a face template personal information under the APPI even without a name?
- Yes. A biometric feature converted into data for computer processing is a personal identification code, which is personal information in its own right. Removing the name beside it does not take it outside the Act.
- Who regulates face recognition in Japan?
- The Personal Information Protection Commission supervises the Act on the Protection of Personal Information and issues the guidelines that carry the operational detail. Sector regulators may impose additional requirements on financial institutions and transport operators.
- Does Japanese face data have to be stored in Japan?
- No. There is no general localisation requirement. Cross-border transfer is permitted under designated-country status, an equivalent system at the recipient, or informed consent that includes information about the destination country's regime.
- Where is Ayonix based?
- Ayonix was founded in Japan in 2007 and is headquartered in Tokyo. It also publishes a United States office contact. Japan is its home market, and its published case studies include deployments and trials with Japanese organisations.
- Can Ayonix run entirely inside a Japanese facility?
- Yes. Ayonix face recognition runs on-premise, at the edge or fully air-gapped, including on the ATLAS BOX appliance. Detection, template extraction and matching happen on the operator's own hardware, with no vendor service in the processing path.