日本語 
Enterprises in Japan are faced with a challenge. How can they access value from sensitive data without compromising privacy and trust with their customers? And AI makes that challenge even more acute.
Japan spent ¥323.5 billion on AI-related R&D in FY2024, up 18.3% year on year. However, having more data does not necessarily mean that decisions will be better made, since privacy laws, security issues and lack of access may limit what you can do. Privacy enhancing technologies (PETs) can help.
In this article, we explore how they work, how they map to Japan’s APPI and how your enterprise can leverage them across industries.
Understanding PETs in the Context of Japan’s APPI
Privacy-enhancing technologies (PETs) are techniques and tools that enable enterprises to leverage data in analysis, research and business decision-making with mitigated exposure of personally and or sensitive data. Examples are pseudonymization, anonymization, encryption, and privacy-preserving computation. They are important because they allow enterprises to do more with data whilst containing the scope in which data that pertains to an individual is available.
In Japan, PETs should be viewed in the context of the APPI. There are two types of processing, pseudonymous processing and anonymous processing. The difference matters because removing names from a dataset does not automatically make the information anonymous or remove the organization’s legal obligations.
Under APPI Article 41, businesses must process personal information to make individuals difficult to identify without combining the data with other information. The article also restricts attempts to identify those individuals by matching pseudonymously processed information with other data. This makes pseudonymization useful for internal analysis, but it does not turn the resulting information into unrestricted data.
APPI Article 43 sets a higher bar for anonymously processed information. Businesses must process data so that they cannot identify specific individuals or restore the original personal information. They must also take security measures and, when creating or providing this information, meet specified disclosure requirements. Articles 44 and 45 place additional requirements concerning the supply of and dealing with anonymized information.
The take-away for business: PETs are part of the solution, but technology doesn’t create APPI compliance. Companies must select the appropriate processing approach, then ensure they appropriately treat the processing data, and adhere to the obligations that apply to it regardless of how it is classified.
Core Privacy-Enhancing Technologies for Enterprises
There are various privacy-enhancing technologies (PETs), each of which enables organizations to benefit from their data without exposing personal and sensitive information. There are multiple types of PETs, but the appropriate technology is determined by the particular needs of the organization.
Data Clean Rooms
Data clean rooms are secured spaces where companies can analyze combined datasets without directly giving each other access to their underlying customer data.
This method could enable Japanese ad buyers and publishers to perform audience insights, campaign measurement, and ad performance for a publisher’s audience without sharing raw personally identifiable information (PII). A retailer could evaluate the reach of its campaign through matching to a publisher’s audience data, within the constraints of access controls and output restrictions.
No, just because a customer is in a clean room, it doesn’t mean you can use them for anything. Enterprises need to limit queries, manage access to results, and protect output so that an individual’s identity isn’t exposed. The goal is to share value, not customer data.
Differential Privacy
DP nudges individuals out of view by injecting controlled statistical noise into either the data or the result of a computation to facilitate meaningful aggregation.
The method allows Japanese retailers, digital platforms and research teams to identify big-picture trends without revealing one person’s impact on the data. A company could analyze purchasing trends across thousands of customers, for example, while making it harder to determine whether a particular person’s records influenced the result.
How much noise is added? Add too little and you might still expose individuals. Add too much and the results may be less relevant for business purposes. Businesses need to find a way to stop outside eyes from tracking their customers but still preserve the kind of data that helps them make business decisions.
Federated Learning
In federated learning, several organizations can build a common machine learning model without sharing their master data sets.
This process applies well to Japanese manufacturers, automakers, banks, hospitals, and anyone else who possesses valuable information that they are not able to freely exchange with others. Each one builds a model using its own data and then contributes to learning. Additional safeguards may be needed because model updates can themselves reveal information.
Japan’s National Institute of Information and Communications Technology (NICT) provides a concrete example. On 21 April 2026, NICT announced that the DeepProtect development team had received the Maejima Prize for developing its privacy-preserving federated learning system. DeepProtect combines federated learning with encryption to support joint analysis while keeping participating organizations’ underlying data confidential.
Homomorphic Encryption
Homomorphic encryption allows computations to be performed on encrypted data without first decrypting the underlying information.
For enterprises, this can enable an external service provider or shared computing environment to process sensitive data while limiting access to its readable contents. Banks could use it to support collaborative fraud analysis, while manufacturers could explore joint analysis of commercially sensitive datasets.
The technology also incurs some performance overhead due to encryption and computation, which may cause some workloads to cost more to run or run slower. Organizations should evaluate the benefits of secure collaboration against the cost.
The tools can also be combined. In the example below, we show Deep Protect that pairs federated learning with homomorphic encryption, demonstrating how organizations can stack multiple protections rather than choose a single privacy solution.
Step-by-Step Guide to Implementing PETs in Japanese Enterprises
For Japanese companies, a good place to begin implementing PETs is by thinking through how the business considers data. Simply purchasing a tool in the absence of a problem definition can incur additional costs and fail to address underlying privacy issues. Here are three ways Japanese companies can be more pragmatic.
Step 1: Discover and classify data
Map where personal information is collected, stored, accessed, and shared across the business. Classify the data under Japan’s Act on the Protection of Personal Information (APPI), including whether it contains identifiable information, pseudonymously processed information, or anonymously processed information. This gives teams a clearer view of their legal obligations and helps identify where data exposure creates the greatest risk.
Step 2: Choose PETs based on the business goal
It is necessary to select technology based on the use case. If there is a need to compare customers for marketing purposes, then data clean rooms might help. Federated learning could also come in handy for collaboration between research and development departments of different organizations. In cases where the data needs to be analyzed in an encrypted form, homomorphic encryption might be used.
Step 3: Integrate with legacy systems
Many organizations have old databases and applications that need to be replaced. This may prove costly and difficult. Begin with a small-scale project and integrate the PET into a well-defined process to see how it works. Involvement of the IT department, lawyers, security experts, and other key stakeholders is crucial to ensure that privacy controls match the rest of the system.
Real-World Industry Use Cases in Japan
Japanese companies find use cases in almost any industry for privacy-preserving enhancements by applying PETs to a real-world business challenge: working together on data without revealing sensitive records. The most compelling use cases arise when companies require a set of information that no one organization can generate alone.
Healthcare and pharmaceuticals
Hospitals store patient medical images and records that could be useful for researchers working to build more accurate diagnostic AI models. With federated learning, it is possible to train models across hospitals without moving the underlying patient data off-site. NICT and other Japanese universities have already begun researching how to apply Deep Protect to diagnosis AI tools that work with radiological images, with the aim of working on joint AI development without transferring the medical data. This remains a research effort, rather than proof of widespread clinical deployment.
Financial services
Fraud can be an inter-institutional affair, but banks also have a duty to keep personal details of individual customers and transactions safe. According to NICT, a cross-bank fraud-detection experiment showed it hit its own standard of at least 80 percent accuracy and uncovered fraudulent transactions that the picture looked for by each individual institution’s algorithm. This is an indication of the possible benefit of working together, but not a proof that any bank can disclose data without legal or security concerns.
Retail and e-commerce
Japan’s retail and e-commerce operators may get a new way to measure cross-brand campaigns or evaluate loyalty deals without sharing raw customer data, if data clean rooms take off there. Partners could contrast audience overlap and campaign results through protected access terms. Marketers will be able to fine-tune their strategies with minimal data blast.
Overcoming Barriers to Adoption in Japan
The implementation of PETs poses its own set of difficulties. For instance, homomorphic encryption requires considerable computational capacity, which leads to increased costs and slower performance of some tasks. Additionally, Japanese companies could suffer from a dearth of specialists skilled enough in the areas of cryptography, data privacy, and machine learning in order to correctly introduce the PETs.
Companies can implement one use case initially, monitor its results and costs, and then make an informed decision on the potential value of scaling. The PET-as-a-Service vendors can be of great help here as well, as the companies do not have to develop their own specialist teams in this way, but have to evaluate the security, handling of data, and the compliance with the APPI.
Conclusion
Also Read: Adobe and NVIDIA Expand AI Content Creation Partnership
The Japanese enterprises would be able to harness the full potential of data while retaining ownership of sensitive information through the application of PETs. Besides being useful for adhering to APPI requirements, privacy enhancing tools could help with collaborative work, research and fraud detection among other things.
Selecting appropriate technologies that will meet business needs, as well as legal and infrastructure considerations, remains challenging. However, companies that incorporate privacy into their data strategy would have a chance to discover additional applications of information responsibly. The process should begin with a data privacy audit, pinpoint where restricted data is hindering progress, and seek advice from a PET expert.
English