Act on the Protection of Personal Information

• A business handling personal information (個人情報取扱事業者) must specify as far as it can the purpose for which it uses personal information (利用目的), must not handle the information beyond what that purpose needs without the person's prior consent, and must not use it in a way that may encourage or induce illegal or unjust acts. It must not acquire personal information by deception or other wrongful means, nor acquire sensitive personal information without the person's prior consent. Consent is not needed in cases the Act lists — among them where laws and regulations (法令), local ordinances (条例) included, call for the handling, or where the handling is needed to protect a person's life, body or property, or especially needed for public health or children's healthy upbringing, and consent is hard to get.This is the rule until the change takes effect, 16 July 2028 at the latest.(Art. 17(1), Art. 18(1), Art. 18(3), Art. 18(3)(i), Art. 18(3)(ii), Art. 18(3)(iii), Art. 19(1), Art. 20(1), Art. 20(2)) (the provisions it rests on)
• From a day a Cabinet Order sets, no later than 16 July 2028, a business handling personal information (個人情報取扱事業者) must still specify its purpose of use (利用目的) as far as it can, keep within it unless the person consents in advance, not use the information in a way that may encourage or induce illegal or unjust acts, and acquire neither personal information by wrongful means nor sensitive personal information without prior consent. Consent is still not needed in cases the Act lists, such as where laws and regulations (法令), local ordinances (条例) included, call for the handling; and where the handling is needed to protect a person's life, body or property, or especially needed for public health or children's healthy upbringing, it is enough that consent is hard to get or that there is other reasonable ground for not getting it. Consent is also not needed for handling clearly needed to perform a contract with the person, or otherwise clearly not against their will and so harmless to their rights, in cases an Order of the Personal Information Protection Commission (個人情報保護委員会規則) sets.This is the rule from a day still to be set, 16 July 2028 at the latest.(Art. 17(1), Art. 18(1), Art. 18(3), Art. 18(3)(i), Art. 18(3)(ii), Art. 18(3)(iii), Art. 18(3)(vii), Art. 19(1), Art. 20(1), Art. 20(2), Art. 20(2)(vii)) (the provisions it rests on)
• On acquiring personal information, a business handling personal information must promptly tell the person the purpose of use or publish it, unless it had published it already; when taking the person's information directly from them in writing — a contract or other document, electronic records included — it must state the purpose to them beforehand, unless that is urgently needed to protect someone's life, body or property; and it must tell or publish a changed purpose — none of this where telling or publishing would harm someone's life, body, property or other rights or the business's rights or legitimate interests, would hinder state work it is cooperating with, or where the purpose is obvious from how the information was acquired. For the personal data it holds, it must keep its name and address, the purposes of all of it and its procedure, with any fee, for people's requests, and the other matters a Cabinet Order sets, where the person can know them (answering without delay on request counts), must tell a person on request the purpose for their data unless that is already clear or one of the first three of those cases applies, and may charge a fee, reasonable in view of its actual costs, for that notice or for disclosure.This is the rule until the change takes effect, 16 July 2028 at the latest.(Art. 21(1), Art. 21(2), Art. 21(3), Art. 21(4), Art. 32(1), Art. 32(2), Art. 38(1), Art. 38(2), Art. 32(1)(iv)) (the provisions it rests on)
• From a day a Cabinet Order sets, no later than 16 July 2028, a business handling personal information must still tell the person the purpose of use or publish it promptly on acquiring the information unless it had published it already, state the purpose beforehand when taking the person's information directly from them in writing unless that is urgently needed to protect someone's life, body or property, and tell or publish a changed purpose — none of this where it would harm someone's life, body, property or other rights or the business's rights or legitimate interests, would hinder state work it is cooperating with, or where the purpose is obvious. Before handling specified biometric personal information (特定生体個人情報) it must also tell the person, or make it easy for them to know, its name and address, that it handles such information, the purpose, what physical feature the code is made from, how to make requests and other matters a Commission Order sets, unless that would harm someone's rights or the business's legitimate interests, would hinder state work it is cooperating with, or a case a Cabinet Order sets applies. For the personal data it holds, it must keep its name and address, the purposes of all of it and its procedure, with any fee, for people's requests, and the other matters a Cabinet Order sets, where the person can know them (answering without delay on request counts), must tell a person on request the purpose for their data unless that is already clear or one of the first three of those cases applies, and may charge a fee, reasonable in view of its actual costs, for that notice or for disclosure.This is the rule from a day still to be set, 16 July 2028 at the latest.(Art. 21(1), Art. 21(2), Art. 21(3), Art. 21(4), Art. 21-2(1), Art. 21-2(2), Art. 16(5), Art. 32(1), Art. 32(2), Art. 38(1), Art. 38(2), Art. 32(1)(iv), Art. 21-2(1)(vi)) (the provisions it rests on)
• A business handling personal information must take necessary and appropriate measures to keep personal data (個人データ) — personal information in its personal information database (個人情報データベース等) — safe from leaks, loss or damage, and must supervise its employees, and anyone it entrusts with handling the data, so that the data stays safe. Where a leak or other security incident occurs of a kind an Order of the Personal Information Protection Commission (個人情報保護委員会規則) sets as highly likely to harm people's rights and interests, the business must report it to the Commission, unless it handles the data for another business or a public body and notifies that body instead. A business that reports must also notify the people affected, unless that is difficult and it takes other measures needed to protect their rights and interests.This is the rule until the change takes effect, 16 July 2028 at the latest.(Art. 16(3), Art. 23(1), Art. 24(1), Art. 25(1), Art. 26(1), Art. 26(2)) (the provisions it rests on)
• From a day a Cabinet Order sets, no later than 16 July 2028, a business handling personal information must still keep personal data (個人データ) safe from leaks, loss or damage, supervise its employees and anyone it entrusts with the data to that end, and report to the Commission a security incident of a kind an Order of the Personal Information Protection Commission (個人情報保護委員会規則) sets as highly likely to harm people's rights and interests, unless it handles the data for another business or a public body and notifies that body instead. A business that reports must notify the people affected, unless the case is one that Order sets — notice being difficult, or leaving the people unnotified being unlikely to leave their rights and interests unprotected — and the business takes other measures needed to protect them.This is the rule from a day still to be set, 16 July 2028 at the latest.(Art. 16(3), Art. 23(1), Art. 24(1), Art. 25(1), Art. 26(1), Art. 26(2)) (the provisions it rests on)
• A business handling personal information must not give personal data to a third party without the person's prior consent, except in cases the Act lists, such as where laws and regulations (法令) call for it, or where it is needed to protect a person's life, body or property and consent is hard to get; handing data to a contractor within the purpose of use, in a merger or other succession of the business, or for joint use the person was told of in advance does not count as giving it to a third party. Without consent, a business may also provide data if it stops on the person's request, tells people of this in advance or makes it easy for them to know, and files with the Personal Information Protection Commission — but not sensitive personal information, nor data acquired wrongfully or itself received this way. Giving personal data to a third party in a foreign country needs the person's prior consent to that, after the person is told about that country's protection system and the recipient's measures, unless the country is one an Order of the Commission lists as having protection equivalent to Japan's, the recipient has a system meeting the Commission's standards for keeping up equivalent measures, or one of the listed cases applies.This is the rule until the change takes effect, 16 July 2028 at the latest.(Art. 27(1), Art. 27(1)(i), Art. 27(1)(ii), Art. 27(2), Art. 27(5), Art. 28(1), Art. 28(2)) (the provisions it rests on)
• From a day a Cabinet Order sets, no later than 16 July 2028, giving personal data to a third party still needs the person's prior consent except in cases the Act lists — among them where laws and regulations (法令) call for it, where it is needed to protect a person's life, body or property and consent is hard to get or there is other reasonable ground for not getting it, and where it is clearly needed to perform a contract with the person or otherwise clearly not against their will, in cases an Order of the Personal Information Protection Commission sets; handing data to a contractor, in a succession of the business or for joint use the person was told of still does not count. Providing data without consent on the terms of stopping on request, telling people in advance and filing with the Commission is then barred for specified biometric personal information (特定生体個人情報) as well as for sensitive personal information, data acquired wrongfully and data itself received this way, and the business must first confirm the recipient's name, address and purpose of use, unless the data was all made public, when the business acquired it, by the person, the State, local governments or others the Act or that Order lists, or a case that Order treats alike applies. Giving personal data to a third party abroad still needs prior consent to that, after the person is told about that country's system and the recipient's measures, unless the country is one the Commission's Order lists as equivalent, the recipient has a system meeting the Commission's standards, or one of the listed cases applies.This is the rule from a day still to be set, 16 July 2028 at the latest.(Art. 27(1), Art. 27(1)(i), Art. 27(1)(ii), Art. 27(1)(viii), Art. 27(2), Art. 27(5), Art. 27(7), Art. 16(5), Art. 28(1), Art. 28(2)) (the provisions it rests on)
• A business that gives personal data to a third party other than a national body, local government or the like must record the date, the recipient and the other matters an Order of the Personal Information Protection Commission sets, and a business receiving personal data from a third party must first check the provider's name and address and how the provider got the data, and record that; both keep the records for a period that Order sets. Neither applies where one of the Article 27(1) cases where consent is not needed, or a contractor, succession or joint-use transfer, applies — for a transfer abroad needing consent under Article 28, only the Article 27(1) cases. A provider must not lie to a business checking those matters.(Art. 29(1), Art. 29(2), Art. 30(1), Art. 30(2), Art. 30(3), Art. 30(4)) (the provisions it rests on)
• A person may ask a business handling personal information to disclose the personal data it holds about them (保有個人データ), electronically or by another method an Order of the Personal Information Protection Commission sets, together with its records of giving that data to or receiving it from third parties; to correct, add to or delete it if it is untrue; to stop using or erase it if it is handled beyond its purpose, used improperly or acquired wrongfully; and to stop giving it to third parties if that breaks the consent rules. The person may also ask for use, erasure or provision to stop where the business no longer needs the data, where a reportable security incident has affected it, or where its handling is likely to harm the person's rights or legitimate interests; the business must act on a justified request without delay, though it may withhold disclosure that would harm someone's life, body, property or other rights, seriously hinder its business or break another law, and may take other measures needed to protect the person where stopping would be very costly or otherwise difficult. Before suing over any of these requests, the person must make the request and wait two weeks from its arrival, unless the business refuses it.This is the rule until the change takes effect, 16 July 2028 at the latest.(Art. 16(4), Art. 33(1), Art. 33(2), Art. 33(5), Art. 34(1), Art. 34(2), Art. 35(1), Art. 35(2), Art. 35(3), Art. 35(4), Art. 35(5), Art. 35(6), Art. 39(1)) (the provisions it rests on)
• From a day a Cabinet Order sets, no later than 16 July 2028, a person may still ask a business for disclosure of the personal data it holds about them (保有個人データ) and of its third-party records, for correction if it is untrue, and for use, erasure or provision to stop where it is handled, acquired or provided against the Act's rules, is no longer needed, has been affected by a reportable incident, or is likely to harm the person's rights or legitimate interests; the business must act on a justified request without delay, though it may withhold disclosure that would harm someone's life, body, property or other rights, seriously hinder its business or break another law, and may take other measures needed to protect the person where stopping would be very costly or otherwise difficult. A person may also ask a business to stop using, erase or stop providing their specified biometric personal information (特定生体個人情報) that forms part of the personal data it holds — personal information containing an individual identification code converted from a physical feature that can be captured without special technology or great cost and without the person easily noticing, of a kind a Cabinet Order sets — unless, among other listed cases, the person consented in advance to the code being made or the information being acquired. Before suing over any of these requests, the person must make the request and wait two weeks from its arrival, unless the business refuses it.This is the rule from a day still to be set, 16 July 2028 at the latest.(Art. 16(4), Art. 16(5), Art. 33(1), Art. 33(2), Art. 33(5), Art. 34(1), Art. 34(2), Art. 35(1), Art. 35(2), Art. 35(3), Art. 35(4), Art. 35(5), Art. 35(6), Art. 35(7), Art. 35(8), Art. 39(1)) (the provisions it rests on)
• A public body (行政機関等) may hold personal information only as far as needed for the duties laws and regulations (法令), local ordinances included, give it, with the purpose specified as far as possible, and must not use or provide the information it holds for another purpose unless laws and regulations call for it, or in cases the Act lists — such as with the person's consent — where that would not unfairly harm someone's rights. Anyone may ask the public body holding personal information about them to disclose it, by a written request with proof of identity; the body must disclose it unless it contains information the Act withholds — such as information that could harm the person's life or health, that identifies someone else, or that could harm national security, crime prevention or the body's work — and must decide within 30 days, extendable by up to 30 days for good reason, or, for a very large request, decide on a substantial part within 60 days and the rest within a reasonable period. Within 90 days of receiving disclosure, the person may also ask for correction of what they think is untrue, and for use or provision to stop where they think it is held, used or provided against the Act's rules, unless another law sets a special procedure for this; the body need not stop where stopping would seriously hinder the work the information is held for.(Art. 61(1), Art. 69(1), Art. 69(2), Art. 69(2)(i), Art. 76(1), Art. 77(1), Art. 77(2), Art. 78(1), Art. 83(1), Art. 83(2), Art. 84(1), Art. 90(1), Art. 90(3), Art. 98(1), Art. 98(3), Art. 100(1)) (the provisions it rests on)

• 1 October 2026

  The text on this site

  Science Council of Japan Act

  日本学術会議法

  Act No. 70 of 2025The text after this amendment, on e-Gov

• 17 July 2026

  Act on the Arrangement, etc. of Related Acts upon the Enforcement of the Act for Establishment of the Disaster Management Agency

  防災庁設置法の施行に伴う関係法律の整備等に関する法律

  Act No. 62 of 2026The text after this amendment, on e-Gov

• 17 July 2026

  Act Partially Amending the Act on the Protection of Personal Information, etc.

  個人情報の保護に関する法律等の一部を改正する法律

  Act No. 56 of 2026The text after this amendment, on e-Gov

• 24 June 2026

  Act on the Arrangement of Related Acts upon the Enforcement of the Act Partially Amending the Civil Code, etc.

  民法等の一部を改正する法律の施行に伴う関係法律の整備等に関する法律

  Act No. 46 of 2026The text after this amendment, on e-Gov

• 21 May 2026

  Act Partially Amending the Code of Civil Procedure, etc.

  民事訴訟法等の一部を改正する法律

  Act No. 48 of 2022The text after this amendment, on e-Gov

• 1 June 2025

  Act on the Arrangement of Related Acts upon the Enforcement of the Act Partially Amending the Penal Code, etc. (extract)

  刑法等の一部を改正する法律の施行に伴う関係法律の整理等に関する法律　抄

  Act No. 68 of 2022The text after this amendment, on e-Gov

• 1 April 2025

  Act Partially Amending the Basic Act on the Formation of a Digital Society, etc. to Improve Convenience for Persons Concerned in Administrative Procedures, etc. and to Simplify and Streamline Administrative Operations through the Use of Information and Communications Technology

  情報通信技術の活用による行政手続等に係る関係者の利便性の向上並びに行政運営の簡素化及び効率化を図るためのデジタル社会形成基本法等の一部を改正する法律

  Act No. 46 of 2024The text after this amendment, on e-Gov

• 1 April 2025

  Act on the Arrangement of Related Acts upon the Enforcement of the Act on Japan Institute for Health Security

  国立健康危機管理研究機構法の施行に伴う関係法律の整備に関する法律

  Act No. 47 of 2023The text after this amendment, on e-Gov

• 1 April 2024

  Act Partially Amending the Financial Instruments and Exchange Act, etc.

  金融商品取引法等の一部を改正する法律

  Act No. 79 of 2023The text after this amendment, on e-Gov

• 16 February 2024

  Act on the Promotion of a Smooth Transition to a Decarbonized Growth-Oriented Economic Structure

  脱炭素成長型経済構造への円滑な移行の推進に関する法律

  Act No. 32 of 2023The text after this amendment, on e-Gov

All 29 amendments already in force

• Academic research institutions (学術研究機関等) — universities and other bodies or groups for academic research, and people belonging to them — may, without the person's consent, handle personal information beyond its purpose and acquire sensitive personal information where they need to for academic research, even if that is only part of the purpose, unless that would unfairly infringe someone's rights. On the same condition, personal data may be given without consent to such an institution that needs it for research, an institution may give it where unavoidable to publish or teach research results or to a partner in joint research, and a partner in joint research may acquire sensitive information from it. They are to follow the Act and try to take, and publish, measures to keep that handling proper.This is the rule until the change takes effect, 16 July 2028 at the latest.(Art. 16(8), Art. 18(3)(v), Art. 18(3)(vi), Art. 20(2)(v), Art. 20(2)(vi), Art. 27(1)(v), Art. 27(1)(vi), Art. 27(1)(vii), Art. 59(1)) (the provisions it rests on)
• From a day a Cabinet Order sets, no later than 16 July 2028, academic research institutions (学術研究機関等) include hospitals and other bodies providing medical care, besides universities and other bodies or groups for academic research and people belonging to them. They may still, without the person's consent, handle personal information beyond its purpose and acquire sensitive personal information where needed for academic research, even if that is only part of the purpose, unless that would unfairly infringe someone's rights; on the same condition, data may be given to such an institution that needs it for research, an institution may give it where unavoidable to publish or teach research results or to a partner in joint research, and a partner in joint research may acquire sensitive information from it. They are to follow the Act and try to take, and publish, measures to keep that handling proper.This is the rule from a day still to be set, 16 July 2028 at the latest.(Art. 16(9), Art. 18(3)(v), Art. 18(3)(vi), Art. 20(2)(v), Art. 20(2)(vi), Art. 27(1)(v), Art. 27(1)(vi), Art. 27(1)(vii), Art. 59(1)) (the provisions it rests on)
• The bodies in Appended Table 2 — among them national university corporations (国立大学法人), national research and development agencies (国立研究開発法人) and the National Hospital Organization (独立行政法人国立病院機構) — and local incorporated administrative agencies of the kinds Article 58(1)(ii) names by their work under the Local Incorporated Administrative Agencies Act (地方独立行政法人法), a separate Act, are businesses handling personal information, but Articles 32 to 39 on people's requests and the rules on anonymised information do not apply to them; instead, Chapter 5's rules on disclosure, correction and stopping use, its personal information file register and its scheme for anonymised information from public bodies apply to them, as if they were incorporated administrative agencies or local ones. Hospitals, clinics and universities run by local government bodies, and hospitals run by the Japan Organization of Occupational Health and Safety (独立行政法人労働者健康安全機構), likewise follow Chapter 4's rules for businesses in that work, except Articles 32 to 39 and the rules on anonymised information; most of Chapter 5 does not apply to that work, but its rules on disclosure, correction and stopping use — with the grounds for stopping use read as breaches of the Chapter 4 rules — its personal information file register and its scheme for anonymised information from public bodies still do.(Art. 58(1), Art. 58(1)(i), Art. 58(1)(ii), Appended Table 2, Art. 125(2), Art. 2(11)(iii), Art. 2(11)(iv), Art. 58(2), Art. 58(2)(i), Art. 58(2)(ii), Art. 125(1), Art. 125(3)) (the provisions it rests on)
• Pseudonymised personal information (仮名加工情報) — processed to standards an Order of the Personal Information Protection Commission sets so that it identifies no one unless checked against other information — has rules of its own: the limit on changing its purpose, the duty to report leaks and people's requests under Articles 32 to 39 do not apply, and its purpose need only be published. Unless laws and regulations (法令) call for it, it may be used only within its purpose and given to no third party (contractors, successors and joint users apart), and may not be checked against other information to identify people or used to phone them, send them post, telegrams, faxes or electronic messages by means a Commission Order sets, or visit their homes.(Art. 2(5), Art. 41(1), Art. 41(3), Art. 41(4), Art. 41(6), Art. 41(7), Art. 41(8), Art. 41(9), Art. 42(1), Art. 42(2)) (the provisions it rests on)
• The rights to disclosure, correction and stopping use against public bodies do not cover personal information about criminal or juvenile protection trials, dispositions by prosecutors or judicial police, the execution of sentences or protective measures, emergency aid after release (更生緊急保護) or pardons, where it concerns the person tried, dealt with, applying or petitioned for.(Art. 124(1)) (the provisions it rests on)
• In using its powers over businesses, the Commission must not hinder freedom of expression, academic freedom, freedom of religion or freedom of political activity, and it does not use them against a business, or a public body, providing personal information to the news organisations, writers, religious bodies or political bodies of Article 57 for the purposes that article names.(Art. 149(1), Art. 149(2), Art. 160(1)) (the provisions it rests on)
• From a day a Cabinet Order sets, no later than 16 July 2028, where a business or public body handles the personal information of someone under 16, the consents and notices the Act requires — for handling beyond the purpose, acquiring sensitive information, giving data to third parties or abroad, breach notices and the like — are given by or to the person's legal representative (法定代理人), unless the handler has good reason not to know the person is under 16, the representative allowed the person to run a business and the information came from it, or there is no representative or the handler has reasonable grounds to believe there is none. A person under 16 may also ask a business to stop using, erase or stop providing their personal data unless, among other listed cases, it was acquired with the representative's consent. Consent given before that day, by the person or the representative, counts under the new rules.This is the rule from a day still to be set, 16 July 2028 at the latest.(Art. 40-2(1), Art. 71-3(1), Art. 35(9), Art. 35(10), Suppl. Prov. Art. 5(1), Suppl. Prov. Art. 5(2)) (the provisions it rests on)
• From a day a Cabinet Order sets, no later than 16 July 2028, a business that handles personal information or the related kinds for another business or a public body, under a contract setting how it is to handle them as an Order of the Personal Information Protection Commission requires and binding it to report promptly any leak or handling outside the work or the contract, is freed from most of Sections 2 to 4 of Chapter 4 for that handling, as long as it handles the information only as the work needs and as the contract sets. Security measures, supervising employees and those it entrusts, reporting incidents, the bar on handling beyond the entrusted work and the rules for people under 16 still apply to it.This is the rule from a day still to be set, 16 July 2028 at the latest.(Art. 58-2(1), Art. 58-2(1)(i), Art. 58-2(1)(ii), Art. 58-2(1)(iii), Art. 30-3(1), Art. 23(1), Art. 24(1), Art. 25(1), Art. 26(1), Art. 40-2(1)) (the provisions it rests on)
• From a day a Cabinet Order sets, no later than 16 July 2028, a business that needs sensitive personal information already made public solely for statistics or similar analysis (統計作成等) — analysis of large amounts of information, of kinds an Order of the Personal Information Protection Commission sets, whose results are not about individuals — or solely to provide it for such analysis, may acquire it without the person's consent if it publishes, by a method that Order sets, its name, the analysis it intends or that it will provide it, and the other matters that Order sets, and keeps them published while it handles the information. It may then handle the information only for what it published, except where laws and regulations call for more or in an emergency such as saving life or disaster relief. On the same footing, a business may give personal information without consent to another business or a public body that needs it solely for such analysis — one abroad only if it has a system meeting the Commission's standards — where both publish their names and the analysis and they agree in writing that the provision is made this way, unless the information itself came to it by this route, or by the matching route for information related to personal information.This is the rule from a day still to be set, 16 July 2028 at the latest.(Art. 2(13), Art. 30-2(1), Art. 30-2(2), Art. 30-2(4), Art. 30-2(5), Art. 30-2(5)(i), Art. 30-2(5)(ii), Art. 31-3(1)) (the provisions it rests on)

• The Personal Information Protection Commission (個人情報保護委員会), under the jurisdiction of the Prime Minister, supervises how businesses handle personal information and monitors how public bodies do. Its chair and eight members are appointed by the Prime Minister with the consent of both Houses of the Diet and exercise their powers independently. Over public bodies, where needed for Chapter 5 to work smoothly, it may ask for materials and explanations, have its staff examine on site, give guidance and advice, and make recommendations and then ask what was done about them; the President of the Board of Audit (会計検査院長) is outside these powers.(Art. 130(1), Art. 130(2), Art. 132(1)(ii), Art. 133(1), Art. 134(1), Art. 134(3), Art. 156(1), Art. 157(1), Art. 158(1), Art. 159(1)) (the provisions it rests on)
• As far as needed to apply Chapter 4, the Commission may require a business handling personal information — or pseudonymised, anonymised or related information — and others concerned to report or submit materials, and may have its staff enter their offices, question people and inspect books and other items; this power is not one for criminal investigation. It may also give those businesses guidance and advice. Where conditions a Cabinet Order sets make it necessary for effective recommendations or orders, the Commission may delegate its powers to receive breach reports and to require reports and inspect to the minister responsible for the business's sector — for employment matters, the Minister of Health, Labour and Welfare among them.(Art. 146(1), Art. 146(3), Art. 147(1), Art. 150(1), Art. 152(1), Art. 152(1)(i), Art. 152(1)(ii)) (the provisions it rests on)
• Where a business breaches one of the duties Article 148 lists — among them the rules on purpose, acquisition, security, breach reports, giving data to third parties and abroad, and dealing with people's requests — and the Commission finds it needed to protect people's rights, it may recommend that the business stop or correct the breach. If the business, without good reason, does not follow the recommendation and a serious infringement of people's rights is imminent — or at once, where a breach of certain of those duties seriously harms people's rights and urgent action is needed — the Commission may order it to take the measures, and may publish that an order was disobeyed.This is the rule until the change takes effect, 16 July 2028 at the latest.(Art. 148(1), Art. 148(2), Art. 148(3), Art. 148(4)) (the provisions it rests on)
• From a day a Cabinet Order sets, no later than 16 July 2028, for breaches committed from that day — earlier ones staying under the earlier rules — where a business breaches the duties of Sections 2 to 4 of Chapter 4, apart from a few the Act names, and the Commission finds it needed to protect people's rights, it may recommend that the business stop or correct the breach, notify the people affected or publish the facts, or take other measures needed to protect them. If the business, without good reason, does not follow the recommendation and serious harm to people's rights is likely — or at once, where a breach of duties the Act names has seriously harmed people's rights or such harm is imminent, and urgent action is needed — the Commission may order it to take such measures (措置命令), and may publish that an order was disobeyed. Once an order is disobeyed, the Commission may ask contractors and other providers whose services the business uses for that handling to stop the handling or the service, and once it has made an order over information sent by specified telecommunications (特定電気通信), as a separate Act defines them, it may ask the provider of those services to stop its distribution; neither is liable to the business for complying.This is the rule from a day still to be set, 16 July 2028 at the latest.(Art. 148(1), Art. 148(2), Art. 148(3), Art. 148(4), Art. 148-2(1), Art. 148-2(2), Art. 148-2(3), Art. 148-2(4), Suppl. Prov. Art. 7(1)) (the provisions it rests on)
• Under Chapter 8, disobeying an order of the Commission is punishable by imprisonment (拘禁刑) of up to one year or a fine of up to 1,000,000 yen, and a business handling personal information — for a corporation, its officers — or its employees, current or former, who provide or steal a personal information database handled at work to gain an illicit profit for themselves or another face up to one year or a fine of up to 500,000 yen, also when committed outside Japan. Where either is done in a corporation's business, the corporation is also fined up to 100,000,000 yen. Failing to report to, lying to, or obstructing a Commission inspection is fined up to 500,000 yen, and the corporation the same.This is the rule until 16 January 2027.(Chapter 8, Art. 178(1), Art. 179(1), Art. 182(1), Art. 183(1), Art. 184(1)) (the provisions it rests on)
• Under Chapter 8, a business handling personal information — for a corporation, its officers — or its employees, current or former, who provide or steal a personal information database handled at work to gain an illicit profit for themselves or another, or to harm the person or anyone else, face imprisonment (拘禁刑) of up to two years or a fine of up to 1,000,000 yen, and anyone who acquires personal information for those ends by deceiving, assaulting or threatening someone, or by theft, damage, trespass, wiretapping, unauthorised computer access (不正アクセス行為, as a separate Act defines it) or another act that defeats its keeper's control, faces the same; both are punishable also when committed outside Japan. Disobeying an order of the Commission under Article 148(2) or (3) is punishable by up to one year or a fine of up to 1,000,000 yen, and failing to report to, lying to, or obstructing a Commission inspection by a fine of up to 500,000 yen. Where the database offence or disobeying an order is done in a corporation's business, the corporation is also fined up to 100,000,000 yen, and for the acquisition and inspection offences it is fined the same as the individual.This is the rule from 17 January 2027.(Chapter 8, Art. 178(1), Art. 180(1), Art. 181(1), Art. 183(1), Art. 184(1), Art. 185(1), Suppl. Prov. Art. 3(1)) (the provisions it rests on)
• A non-penal fine (過料) of up to 100,000 yen applies to a provider of personal data who lies to a business checking where the data came from, or a recipient of information related to personal information (個人関連情報) who lies to the business providing it when it checks that the person has consented; to anyone who calls itself a certified personal information protection organisation (認定個人情報保護団体), or uses a confusingly similar name, without being one; to a certified organisation that ends its certified work without the notice it must give, or with a false one; and to anyone who obtains disclosure of a public body's personal information by deception or other wrongful means.This is the rule until 16 January 2027.(Art. 185(1), Art. 185(1)(i), Art. 185(1)(ii), Art. 185(1)(iii), Art. 30(2), Art. 31(3), Art. 56(1), Art. 51(1), Art. 31(1)) (the provisions it rests on)
• A non-penal fine (過料) of up to 100,000 yen applies to a provider of personal data who lies to a business checking where the data came from, or a recipient of information related to personal information (個人関連情報) who lies to the business providing it when it checks that the person has consented; to anyone who calls itself a certified personal information protection organisation (認定個人情報保護団体), or uses a confusingly similar name, without being one; to a certified organisation that ends its certified work without the notice it must give, or with a false one; and to anyone who obtains disclosure of a public body's personal information by deception or other wrongful means.This is the rule from 17 January 2027.(Art. 186(1), Art. 186(1)(i), Art. 186(1)(ii), Art. 186(1)(iii), Art. 30(2), Art. 31(3), Art. 56(1), Art. 51(1), Suppl. Prov. Art. 3(1), Art. 31(1)) (the provisions it rests on)
• From a day a Cabinet Order sets, no later than 16 July 2028, the same non-penal fine (過料) of up to 100,000 yen also applies to a recipient who lies to a business confirming its name, address and purpose before receiving personal data without consent on the terms of stopping on request. It still applies to a provider of personal data who lies to a business checking where the data came from, or a recipient of information related to personal information (個人関連情報) who lies to the business providing it when it checks that the person has consented; to anyone who calls itself a certified personal information protection organisation (認定個人情報保護団体), or uses a confusingly similar name, without being one; to a certified organisation that ends its certified work without the notice it must give, or with a false one; and to anyone who obtains disclosure of a public body's personal information by deception or other wrongful means.This is the rule from a day still to be set, 16 July 2028 at the latest.(Art. 186(1), Art. 186(1)(i), Art. 186(1)(ii), Art. 186(1)(iii), Art. 27(7), Art. 27(8), Art. 30(2), Art. 31(3), Art. 56(1), Art. 51(1), Art. 31(1)) (the provisions it rests on)
• Staff of public bodies, people doing entrusted or similar work for them and agency workers there, current or former, who without good reason provide a computerised personal information file containing personal secrets face imprisonment (拘禁刑) of up to two years or a fine of up to 1,000,000 yen; providing or stealing personal information the body holds, learnt at work, to gain an illicit profit for oneself or another, and a public body employee abusing their authority to collect documents or records of personal secrets for purposes other than their duties, are punishable by up to one year or a fine of up to 500,000 yen. These offences, and the Commission's members and staff leaking or misusing secrets (up to two years or 1,000,000 yen), are punishable also when committed outside Japan.This is the rule until 16 January 2027.(Art. 176(1), Art. 177(1), Art. 143(1), Art. 180(1), Art. 181(1), Art. 183(1)) (the provisions it rests on)
• Staff of public bodies, people doing entrusted or similar work for them and agency workers there, current or former, who without good reason provide a computerised personal information file containing personal secrets face imprisonment (拘禁刑) of up to three years or a fine of up to 1,500,000 yen, and providing or stealing personal information the body holds, learnt at work, to gain an illicit profit for oneself or another, or to harm the person or anyone else, is punishable by up to two years or a fine of up to 1,000,000 yen. A public body employee abusing their authority to collect documents or records of personal secrets for purposes other than their duties faces up to one year or a fine of up to 500,000 yen. These offences, and the Commission's members and staff leaking or misusing secrets (up to two years or 1,000,000 yen), are punishable also when committed outside Japan.This is the rule from 17 January 2027.(Art. 176(1), Art. 177(1), Art. 143(1), Art. 179(1), Art. 182(1), Art. 184(1)) (the provisions it rests on)
• From a day a Cabinet Order sets, no later than 16 July 2028, the Commission must order a business handling personal information to pay a surcharge (課徴金) to the national treasury where, receiving money or other gain for the act or for stopping it, the business provides personal information to a third party expected to use it for illegal acts or unfair discriminatory treatment, uses it at such a third party's request, gives personal data to a third party in breach of the consent rule or breaks certain other rules the Act names, or acquires personal information by wrongful means and uses it — in an amount equal to the gain, worked out as a Cabinet Order sets. No surcharge is ordered where the business is found to have taken due care throughout to prevent the act, or where 1,000 or fewer people are affected or the harm is otherwise not great in cases a Cabinet Order sets; the business is first given the chance to explain itself, the amount is one and a half times where, within the ten years before the case was first investigated, the business received a surcharge order that has become final and went on with the act after it, and it is halved where the business reports the facts to the Commission itself, unless it does so expecting an order because of an investigation. It covers acts done from that day.This is the rule from a day still to be set, 16 July 2028 at the latest.(Art. 148-3(1), Art. 148-3(2), Art. 148-5(1), Art. 148-6(1), Art. 148-8(1), Suppl. Prov. Art. 8(1)) (the provisions it rests on)
• A person dissatisfied with a public body's decision on disclosure, correction or stopping use, or with its failure to decide, may file a request for review (審査請求) under the Administrative Complaint Review Act (行政不服審査法), a separate Act. Unless it dismisses the request as unlawful or grants it in full without overriding a third party's written objection, the body deciding it must consult the Information Disclosure and Personal Information Protection Review Board (情報公開・個人情報保護審査会) — for the Board of Audit, a board a separate Act sets, and for local government bodies and local incorporated administrative agencies, the body that Act provides for them.(Art. 104(1), Art. 105(1), Art. 105(3), Art. 106(1)) (the provisions it rests on)