This Act comes into effect as of the date specified by Cabinet Order within a period not exceeding 2 years from the date of promulgation; provided, however, that the provisions set forth in the following items come into effect as of the dates specified respectively in those items.

①Recommendations, orders, or other dispositions, or notices or other acts, made by the Specific Personal Information Protection Commission before the date of enforcement of the provisions set forth in Article 1, item (ii) of the Supplementary Provisions (hereinafter referred to as the "item (ii) effective date") pursuant to the provisions of the Act on the Use of Numbers to Identify a Specific Individual in Administrative Procedures prior to its amendment by Article 4 (hereinafter referred to as the "former Number Use Act" in this Article) or of orders based on it are deemed, on and after the item (ii) effective date, to be recommendations, orders, or other dispositions, or notices or other acts, made by the Personal Information Protection Commission pursuant to the corresponding provisions of the Act on the Use of Numbers to Identify a Specific Individual in Administrative Procedures as amended by Article 4 (hereinafter referred to as the "new Number Use Act" in this Article) or of orders based on it.

②Applications, notifications, or other acts that have actually been made to the Specific Personal Information Protection Commission at the time the provisions set forth in Article 1, item (ii) of the Supplementary Provisions come into effect, pursuant to the provisions of the former Number Use Act (including the Act on the Protection of Personal Information Held by Administrative Organs (Act No. 58 of 2003) as applied with the replacement of terms pursuant to Article 29, paragraph (1) of the former Number Use Act; the same applies in the following paragraph) or of orders based on it, are deemed, on and after the item (ii) effective date, to be applications, notifications, or other acts made to the Personal Information Protection Commission pursuant to the corresponding provisions of the new Number Use Act (including the Act on the Protection of Personal Information Held by Administrative Organs as applied with the replacement of terms pursuant to Article 29, paragraph (1) of the new Number Use Act; the same applies in the following paragraph) or of orders based on it.

③With regard to a matter for which a notification or other procedure must be carried out with the Specific Personal Information Protection Commission before the item (ii) effective date pursuant to the provisions of the former Number Use Act or of orders based on it, and for which that procedure has not been carried out before the item (ii) effective date, on and after the item (ii) effective date, the corresponding provisions of the new Number Use Act or of orders based on it apply by deeming that matter to be a matter for which that procedure must be carried out with the Personal Information Protection Commission pursuant to those corresponding provisions and for which that procedure has not been carried out.

Rules of the Specific Personal Information Protection Commission that are in force at the time the provisions set forth in Article 1, item (ii) of the Supplementary Provisions come into effect are to have effect as Rules of the Personal Information Protection Commission on and after the item (ii) effective date.

①A person who is serving as the chairperson or a commissioner of the former Specific Personal Information Protection Commission at the time the provisions set forth in Article 1, item (ii) of the Supplementary Provisions come into effect is deemed to have been appointed, on the item (ii) effective date, as the chairperson or a commissioner, respectively, of the Personal Information Protection Commission pursuant to the provisions of Article 54, paragraph (3) of the Act on the Protection of Personal Information as amended by Article 1 (hereinafter referred to as the "item (ii) new Personal Information Protection Act" in this Article). In this case, notwithstanding the provisions of Article 55, paragraph (1) of the item (ii) new Personal Information Protection Act, the term of office of the person deemed to have been so appointed is to be a period equal to the remainder of that person's respective term of office as the chairperson or a commissioner of the former Specific Personal Information Protection Commission as of the item (ii) effective date.

③A person who is serving as an official of the secretariat of the former Specific Personal Information Protection Commission at the time the provisions set forth in Article 1, item (ii) of the Supplementary Provisions come into effect is to become the corresponding official of the secretariat of the Personal Information Protection Commission on the item (ii) effective date, under the same working conditions, unless otherwise notified by a letter of appointment.

With regard to the duty of a person who was the chairperson, a commissioner or an official of the secretariat of the Specific Personal Information Protection Commission not to divulge or misappropriate any secret learned in the course of their duties, the provisions then in force continue to govern even on and after the item (ii) effective date.

With regard to the application of penal provisions to acts committed before this Act (or, for the provisions set forth in Article 1, item (ii) of the Supplementary Provisions, those provisions) comes into effect and to acts committed on or after the item (ii) effective date in the cases where the provisions then in force continue to govern pursuant to the preceding Article, the provisions then in force continue to govern.

Beyond what is provided for in these Supplementary Provisions, transitional measures necessary for the enforcement of this Act are specified by Cabinet Order.

①By the effective date, the Government is to, in light of the purpose of the provisions of the new Personal Information Protection Act, review how the handling of the Personal Information as set forth in Article 2, paragraph (2) of the Act on the Protection of Personal Information Held by Administrative Organs that is held by administrative organs as set forth in paragraph (1) of that Article and of the Personal Information as set forth in Article 2, paragraph (2) of the Act on the Protection of Personal Information Held by Incorporated Administrative Agencies, etc. (Act No. 59 of 2003) that is held by incorporated administrative agencies, etc. as set forth in paragraph (1) of that Article (hereinafter collectively referred to as "Personal Information held by administrative organs, etc." in this Article) should be regulated, including having the Personal Information Protection Commission give guidance, advice, etc. concerning the handling of anonymized Personal Information held by administrative organs in a unified and cross-cutting manner, from the perspective of promoting the smooth and prompt use of anonymously processed information (meaning anonymously processed information as set forth in Article 2, paragraph (9) of the new Personal Information Protection Act, and including anonymized Personal Information held by administrative organs (meaning anonymously processed information obtained by processing Personal Information held by administrative organs, etc.; the same applies hereinafter in this paragraph)), and take required measures based on the results.

②The Government is to, around three years after this Act comes into effect, review the improvement of the formulation and promotion of the basic policy on the protection of Personal Information and the other functions under the jurisdiction of the Personal Information Protection Commission, taking into consideration the status of the development of the personnel structure, the securing of financial resources and other measures necessary to carry out those functions effectively, and, if it finds it necessary, take required measures based on the results.

③In addition to the matters provided for in the preceding paragraph, the Government is to, around three years after this Act comes into effect, review the status of the enforcement of the new Personal Information Protection Act, taking into consideration international trends concerning the protection of Personal Information, the advancement of information and communications technology, the status of the creation and development of new industries utilizing Personal Information that accompany that advancement, etc., and, if it finds it necessary, take required measures based on the results.

④The Government is to, around three years after the provisions set forth in Article 1, item (vi) of the Supplementary Provisions come into effect, review measures for financial institutions as set forth in Article 2, paragraph (1) of the Deposit Insurance Act (Act No. 34 of 1971) to be appropriately provided with Individual Numbers by depositors, etc. as set forth in paragraph (3) of that Article, or for agricultural and fishery cooperatives as set forth in Article 2, paragraph (1) of the Agricultural and Fishery Cooperatives Savings Insurance Act (Act No. 53 of 1973) to be appropriately provided with Individual Numbers by savers, etc. as set forth in paragraph (3) of that Article, and the status of the enforcement of the Act on the Use of Numbers to Identify a Specific Individual in Administrative Procedures as amended by Article 7, and, if it finds it necessary, take required measures based on the results while gaining citizens' understanding.

⑤In view of the importance of the precise formulation and implementation of measures concerning cybersecurity (meaning cybersecurity as set forth in Article 2 of the Basic Act on Cybersecurity (Act No. 104 of 2014)) in ensuring the security of Personal Information held by national administrative organs, etc., the Government is to review the development, etc. of systems for the formulation and implementation of measures at national administrative organs, etc. based on the standards set forth in Article 13 of that Act, and take required measures based on the results.

⑥The Government is to, in light of the status of the enforcement of the new Personal Information Protection Act, the status of the implementation of the measures referred to in paragraph (1), and other circumstances, review what the legal system concerning the protection of Personal Information should be, including consolidating the provisions concerning the protection of Personal Information as set forth in Article 2, paragraph (1) of the new Personal Information Protection Act and of Personal Information held by administrative organs, etc., and providing for them in an integrated manner.