Ready before it bites: AI data governance for a Japanese retail chain under the amended APPI

The situation

A Japanese retail chain with several hundred stores ran a loyalty programme, an app and in-store cameras. Its data team trained demand forecasting and promotion models on loyalty purchases, and two outside contractors analysed camera footage to measure footfall and queue times. The data had grown up over a decade: copies in the warehouse, the contractors' environments and a few notebooks, with no single record of where personal data went or why.

Why now. Japan's amended Act on the Protection of Personal Information was promulgated in July 2026 as Act No. 56 of 2026, with most duties starting on dates set later by Cabinet Order². As reported, it introduces an administrative surcharge, adds rules for facial recognition data, makes contractors' duty not to use data beyond their task explicit, and creates a consent exception for statistical processing and AI development¹³. Commentary expects strengthened penalties from early 2027 and the main reforms by mid-2028². The Personal Information Protection Commission (PPC) will set the detailed rules⁴. The chain wanted to use the time to get ready rather than react later.

What had to be true

• Every dataset used for AI known: its source, purpose, legal basis and where copies live.
• Facial data minimised: kept only where needed, disclosed clearly and never reused quietly.
• Contractors bounded to the task they were hired for, technically and not just by contract.
• Personal data out of telemetry by default.
• Evidence on demand, ready to map to the PPC's rules when they arrive.

Architecture

The data flow, end to end

The hard part: cameras and contractors

The footfall project was the riskiest part of the estate. Contractors received video clips and ran their own models on them, which meant faces left the stores and their later use was hard to control. With facial data getting specific rules in the amendment¹, the team changed the design rather than adding paperwork.

Video processing moved to on-premises devices in each store. They produce counts, dwell times and queue lengths, and discard frames after processing. Contractors now receive those aggregates, not footage. Where a use case truly needed identification, such as a loss-prevention pilot, it was split out as its own system with its own disclosure, retention and approval. That separation is what makes the purpose clear to customers and to a regulator.

Contractors moved into scoped workspaces on the chain's own platform, with access to named datasets for a set period, every query logged and no export by default. This turns the duty not to use data beyond the task into a technical control instead of a clause³.

The last gap was telemetry. Application logs and traces carried customer IDs, emails and auth headers, copied into tools that many people could see. The team set masking as the default in the OpenTelemetry pipeline, keeping useful context such as store or segment and hiding identifiers and credentials⁵.

How it ran

Key decisions and trade-offs

What I'd do again, and differently

Again: redesign the camera use case instead of documenting it. It removed most of the risk in one move. Differently: put purpose tags on data at ingestion from the start, rather than adding them during the inventory; tagging old data took longer than building the platform. Related: ISO 42001 and the NIST AI RMF, high-impact AI under Korea's AI Basic Act and where I work.

If you use personal data for AI in Japan or across Asia, see my AI architecture work, or analyse your challenge and bring the result to a call.