Chapter IV Obligations of Businesses Handling Personal Information (Articles 42 to 52)
The law as Act Partially Amending the Act on the Protection of Personal Information, etc. (Act No. 56 of 2026) leaves it, with the words it changes marked.
The main text is read a page at a time: a chapter to a page, and a long chapter in runs of articles. The whole main text, and the supplementary provisions and appended tables this amendment changes. Those it leaves untouched are on the page for the text in force.
Article 42第四十二条
Restrictions on Provision of Pseudonymized Personal Information to Third Parties（仮名加工情報の第三者提供の制限等）
Article 42, paragraph (1)（仮名加工情報の第三者提供の制限等）(Restrictions on Provision of Pseudonymized Personal Information to Third Parties)Changed
Except in cases based on laws and regulations, businesses handling pseudonymized personal information must not provide pseudonymized personal information (excluding those that constitute personal information; hereinafter the same applies in the following paragraph and paragraph (3)this Article) to a third party.
The provisions of Article 27, paragraphs (5) and (6) apply mutatis mutandis to a person receiving pseudonymized personal information. In this case, the term "each preceding paragraph" in Article 27, paragraph (5) is deemed to be replaced with "Article 42, paragraph (1)"; the term "business handling personal information" in item (i) of the paragraph is deemed to be replaced with "business handling pseudonymized personal information"; the phrase "notifies the person identifiable by that data of this in advance as well as the details of that data, the extent of the joint users, the users' purpose of use, and the name and address of the person responsible for managing the personal data, and, if the user is corporation, the name of its representative; or the business makes the foregoing information readily accessible to the person identifiable by that data in advance" in item (iii) of the paragraph is deemed to be replaced with "disclose this in advance as well as the details of that data, the extent of the joint users, the users' purpose of use, and the name and address of the person responsible for managing the personal data, and, if the user is corporation, the name of its representative"; the term "business handling personal information" in Article 27, paragraph (6) is deemed to be replaced with "businesses handling pseudonymized personal information", and the phrase " notify the person identifiable by that data of this or make this readily accessible to the person identifiable by that data, without delay" is deemed to be replaced with "disclose this without delay" in Article 27, paragraph (6).
Article 42, paragraph (3)（仮名加工情報の第三者提供の制限等）(Restrictions on Provision of Pseudonymized Personal Information to Third Parties)Changed
The provisions of Articles 23 through 25, Article 40, and paragraphs (7) and (8) of the preceding Article apply mutatis mutandis to the handling of pseudonymized personal information (limited to those compiled in a pseudonymized personal information database or the equivalent) by a business handling pseudonymized personal information, and the provisions of Article 40 apply mutatis mutandis to the handling of pseudonymized personal information by a business handling pseudonymized personal information, respectively. In this case, the phrase "leaking, loss or damage" in Article 23 is deemed to be replaced with "leaking"; and the term "not" in Article 41, paragraph (7) is replaced with "neither acquire deleted or other related information, nor".
Article 42, paragraph (4)（仮名加工情報の第三者提供の制限等）(Restrictions on Provision of Pseudonymized Personal Information to Third Parties)Added
The provisions of Article 31-2 apply mutatis mutandis to the handling, by a business handling pseudonymized personal information, of pseudonymized personal information that contains an identifier or the equivalent set forth in any of the items of Article 2, paragraph (8) (including information that can be readily collated with other information and thereby enables that identifier or the equivalent to be identified).
Article 43, paragraph (1)（匿名加工情報の作成等）(Preparation of Anonymized Personal Information)Changed
When preparing anonymized personal information (limited to those compiled in an anonymized personal information database or the equivalent; hereinafter the same applies in this Chapter (excluding paragraph (6) of this Article, Article 46, Article 46-2, and Chapter VIArticle 54, paragraph (1))), businesses handling personal information must process personal information in accordance with standards prescribed by Order of the Personal Information Protection Commission as those necessary to make it impossible to identify a specific individual and restore the information to its original state.
When having prepared anonymized personal information, businesses handling personal information must take measures for the management of the security of information relating to identifiers or their equivalent and individual identification codes that were deleted from personal information used to prepare the anonymized personal information, and information on the means of processing carried out pursuant to the provisions of the preceding paragraph, in accordance with standards prescribed by Order of the Personal Information Protection Commission as those necessary to prevent the leaking of that information.
When having prepared anonymized personal information, businesses handling personal information must disclose the categories of information on an individual that is contained in the anonymized personal information, pursuant to Order of the Personal Information Protection Commission.
Businesses handling personal information, before providing anonymized personal information it prepared to a third party, must disclose the categories of information on an individual that is contained in the anonymized personal information the business will provide to the third party, and the means of providing this, and state to the third party explicitly that the information the business will provide is anonymized personal information, pursuant to Order of the Personal Information Protection Commission.
Businesses handling personal information, when handling anonymized personal information it prepared by itself, must not collate the anonymized personal information with other information in order to identify a person identifiable by personal information that was used to prepare that anonymized personal information.
When having prepared anonymized personal information, businesses handling personal information must endeavor to take the necessary and appropriate measures for managing the security of the anonymized personal information, and the necessary measures for processing complaints about the preparation or other handling of the anonymized personal information, or for otherwise ensuring the proper handling of the anonymized personal information; and endeavor to disclose the content of those measures.
Article 44, paragraph (1)（匿名加工情報の提供）(Providing Anonymized Personal Information)Changed
Businesses handling anonymized personal information, before providing anonymized personal information (excluding those into which they have processed personal information themselves; hereinafter the same applies in this SectionArticle through Article 46) to a third party, must disclose the categories of information on an individual that is contained in the anonymized personal information it will provide to the third party, and the means of providing this, and state to the third party explicitly that the information it will provide is anonymized personal information, pursuant to Order of the Personal Information Protection Commission.
Businesses handling anonymized personal information, when handling anonymized personal information, must neither acquire information relating to identifiers or their equivalent or individual identification codes deleted from the personal information and information relating to methods of processing carried out pursuant to the provisions of Article 43, paragraph (1) or Article 116, paragraph (1) (including cases in which it is applied mutatis mutandis pursuant to Article 116, paragraph (2)), nor collate the anonymized personal information with other information in order to identify a person identifiable by personal information that was used to prepare that anonymized personal information.
Measures for Managing the Security of Anonymized Personal Information（安全管理措置等）
Article 46, paragraph (1)
Businesses handling anonymized personal information must endeavor to take the necessary and appropriate measures for managing the security of anonymized personal information and the necessary measures to ensure the proper handling of anonymized personal information such as processing complaints about the handling of anonymized personal information, and must endeavor to disclose the content of those measures.
Article 46-2, paragraph (1)（連絡等が可能な匿名加工情報の不適正な取扱いの禁止）Prohibition of Inappropriate Handling of Anonymized Personal Information Enabling Contact, etc.Added
The provisions of Article 31-2 apply mutatis mutandis to the handling, by a business handling anonymized personal information, of anonymized personal information that contains an identifier or the equivalent set forth in any of the items of Article 2, paragraph (8) (including information that can be readily collated with other information and thereby enables that identifier or the equivalent to be identified).
A corporation (or an organization without legal personality that has made provisions for a representative or manager; the same applies in item (iii), (b) of the following Article) seeking to perform services as set forth in one of the following items with the aim of ensuring that a business handling personal or other related information, pseudonymized personal (excluding a business handling information, or anonymized related to personal information (; hereinafter referred to as "the same applies in this Section) handles the personal or other related information" in this Chapter) ( (limited, in the business in question is hereinafter referred case of information related to personal information, to as a "business handlingthat which constitutes sensitive personal information, etc. for statistical compilation or other related similar analysis, provided personal information" in this Chapter) handles the , etc. for statistical compilation or similar analysis, and provided personal informationdata, etc. for statistical compilation or similar analysis; hereinafter the same applies in this Section) properly may receive certification from the Personal Information Protection Commission:
complaint processing under Article 53 regarding the handling of personal or other related information by businesses handling personal or other related information which are covered by the corporation's services (hereinafter each such business is referred to as a "covered business");
providing covered businesses with information about things that contribute to ensuring the proper handling of personal or other related information;
個人情報等の適正な取扱いの確保に寄与する事項についての対象事業者に対する情報の提供
Article 47, paragraph (1), item (iii)（認定）
services beyond what is set forth in the preceding two items which are necessary for ensuring the proper handling of personal or other related information by covered businesses.
前二号に掲げるもののほか、対象事業者の個人情報等の適正な取扱いの確保に関し必要な業務
Article 47, paragraph (2)（認定）
The certification set forth in the preceding paragraph may be limited in respect of the type or scope of services of businesses handling personal or other related information that are covered.
A person seeking the certification referred to in paragraph (1) must apply to the Personal Information Protection Commission as prescribed by Cabinet Order.
After granting a certification under paragraph (1), the Personal Information Protection Commission must make a public notice to that effect (including the scope of services concerning the certification, in cases of the certification limiting the scope of services pursuant to the provisions of paragraph (2)).
A person falling under one of the following items may not be certified as referred to in paragraph (1) of the preceding Article:
次の各号のいずれかに該当する者は、前条第一項の認定を受けることができない。
Article 48, paragraph (1), item (i)
a person that has been sentenced pursuant to any provision of this Act, if two years have not yet passed since the person finished serving the sentence or ceased to be subject to its enforcement;
a person whose certification has been revoked pursuant to the provisions of Article 155, paragraph (1), if two years have not yet passed since the revocation;
第百五十五条第一項の規定により認定を取り消され、その取消しの日から二年を経過しない者
Article 48, paragraph (1), item (iii)
a person with an executive officer (or with a representative or manager, in an organization without legal personality that has made provisions for a representative or manager; hereinafter the same applies in this Article) that falls under one of the following categories:
a person that has been sentenced to imprisonment or a heavier punishment or that has been sentenced pursuant to any provision of this Act, if two years have not yet passed since the person finished serving the sentence or ceased to be subject to its enforcement;
a person that, during the 30 days before the revocation, was the officer of a corporation whose certification has been revoked pursuant to the provisions of Article 155, paragraph (1), if two years have not yet passed since the revocation.
The Personal Information Protection Commission must not grant a certification unless it finds the application for certification referred to in Article 47, paragraph (1) to conform to all of the following requirements:
the applicant has established the necessary methods of business implementation to allow it to perform the services set forth in the items of Article 47, paragraph (1) properly and reliably;
the applicant's knowledge, capabilities, and financial base are sufficient to allow it to perform the services set forth in the items of Article 47, paragraph (1) properly and reliably;
if the applicant engages in business other than the services set forth in the items of Article 47, paragraph (1), its engagement in that business is unlikely to give rise to unfairness in the services set forth in the items of that paragraph.
If a person that has received certification under Article 47, paragraph (1) (including that limiting the scope of services pursuant to the provisions of paragraph (2) of that Article; the same applies in paragraph (1) of the following Article and Article 155, paragraph (1), item (v)) seeks to alter the scope of services concerning the certification, the person must receive certification from the Personal Information Protection Commission; provided, however, that this does not apply to a minor alteration as prescribed by Order of the Personal Information Protection Commission.
The provisions of Article 47, paragraphs (3) and (4) and the preceding Article apply mutatis mutandis to the certification of alteration referred to in the preceding paragraph.
第四十七条第三項及び第四項並びに前条の規定は、前項の変更の認定について準用する。
Article 51第五十一条
Notification of Discontinuation（廃止の届出）
Article 51, paragraph (1)
Before intending to discontinue the services subject to certification (hereinafter referred to as "certified services" in this Section and Chapter VI), a person that has received certification under Article 47, paragraph (1) (including the certification of alteration under paragraph (1) of the preceding Article) (the person in question is hereinafter referred to as a "certified personal information protection organization" in this Section and Chapter VI) must notify the Personal Information Protection Commission to that effect as prescribed by Cabinet Order.
Upon receiving notification under the preceding paragraph, the Personal Information Protection Commission must issue public notice indicating this.
個人情報保護委員会は、前項の規定による届出があったときは、その旨を公示しなければならない。
Article 52第五十二条
Covered Businesses（対象事業者）
Article 52, paragraph (1)
A certified personal information protection organization's covered businesses must be comprised of businesses handling personal or other related information that have agreed to be covered by its certified services. In this case, if a covered business does not comply with the personal information protection guidelines prescribed in Article 54, paragraph (1) even though measures pursuant to Article 54, paragraph (4) were taken, the covered business may be excluded from being covered by the certified services.