Chapter IV Obligations of Businesses Handling Personal Information (Articles 53 to 59)
The law as Act Partially Amending the Act on the Protection of Personal Information, etc. (Act No. 56 of 2026) leaves it, with the words it changes marked.
The main text is read a page at a time: a chapter to a page, and a long chapter in runs of articles. The whole main text, and the supplementary provisions and appended tables this amendment changes. Those it leaves untouched are on the page for the text in force.
Article 53第五十三条
Complaint Processing（苦情の処理）
Article 53, paragraph (1)
If an identifiable person or other party files for a certified personal information protection organization to resolve a complaint about the handling of personal or other related information by a covered business, in addition to complying with any request for a consultation about this, providing the identifiable person or other party with the necessary advice, and investigating the circumstances to which the complaint pertains, the organization must notify the covered business of the substance and content of the complaint and request that it resolve the complaint expeditiously.
If a certified personal information protection organization finds that it is necessary in connection with the resolution of a complaint under a filing referred to in the preceding paragraph, the organization may request that the covered business provide a written or oral explanation or submit materials.
If a covered business has received a request under the preceding paragraph from a certified personal information protection organization, it must not refuse this request without a legitimate reason for doing so.
Article 54, paragraph (1)（個人情報保護指針）(Personal Information Protection Guidelines)Changed
In order to ensure the proper handling of personal or other related information by its covered businesses, a certified personal information protection organization must endeavor to create guidelines which follow the spirit of this Act (hereinafter referred to as "personal information protection guidelines" in this Section and Chapter VI), for how to specify the purpose of use of personal information, for measures to ensure its secure management, for procedures to deal with requests for disclosure or other handling, for other such matters, how to conduct statistical compilation or similar analysis concerning sensitive personal information, etc. for statistical compilation or similar analysis, provided personal information, etc. for statistical compilation or similar analysis, or provided personal data, etc. for statistical compilation or similar analysis, and the security measures for that information and other such matters, as well as how to produce pseudonymized processedpersonal information or anonymized personal information, and its security measures and other such matters, by listening to the opinions of representatives of customers or other relevant persons.
When having developed personal information protection guidelines pursuant to the provisions of the preceding paragraph, certified personal information protection organizations must notify the Personal Information Protection Commission of the personal information protection guidelines without delay pursuant to Order of the Personal Information Protection Commission. The same applies if the guidelines are modified.
When having been notified of personal information protection guidelines under the preceding paragraph, the Personal Information Protection Commission must disclose the personal information protection guidelines pursuant to Order of the Personal Information Protection Commission.
When personal information protection guidelines have been disclosed pursuant to the provisions of the preceding paragraph, certified personal information protection organizations must take measures against a covered business such as providing guidance or recommendations necessary to make the covered business comply with the personal information protection guidelines.
A certified personal information protection organization must not use information acquired in the course of certified services for purposes other than the certified services use for which the information is provided.
A person that is not a certified personal information protection organization must not use a name that refers to that person as a certified personal information protection organization, and must not use any other name that is confusingly similar to this.
Article 57, paragraph (1)（適用除外）(Exclusion from Application)Changed
The provisions of this the preceding Chapter do not apply to a business handling personal or other related information or business handling information related to personal information as set forth in one of the following items if all or part of the purpose for which it handles the information in question is the purpose prescribed in that item:
broadcasting organizations, newspapers, news services, and other journalistic organizations (this includes individuals who work in news reporting):use in news reporting;
放送機関、新聞社、通信社その他の報道機関（報道を業として行う個人を含む。） 報道の用に供する目的
Article 57, paragraph (1), item (ii)（適用除外）
a person in the business of creating literary works:use in the creation of literary works;
著述を業として行う者 著述の用に供する目的
Article 57, paragraph (1), item (iii)（適用除外）
a religious organization:use in a religious activity (this includes activities incidental to it);
宗教団体 宗教活動（これに付随する活動を含む。）の用に供する目的
Article 57, paragraph (1), item (iv)（適用除外）
a political organization:use in a political activity (this includes activities incidental to it).
政治団体 政治活動（これに付随する活動を含む。）の用に供する目的
Article 57, paragraph (2)（適用除外）
The "news reporting" prescribed in item (i) of the preceding paragraph means informing the general public of objective facts by presenting them as the truth (this includes stating an opinion or position based on those facts).
Article 57, paragraph (3)（適用除外）(Exclusion from Application)Changed
A business handling personal or other related information (excluding a business handling information related to personal information) as set forth in one of the items of paragraph (1) must, itself, endeavor to take the necessary and appropriate measures for managing the security of personal data, sensitive personal information, etc. for statistical compilation or similar analysis, provided personal information, etc. for statistical compilation or similar analysis, provided personal data, etc. for statistical compilation or similar analysis, pseudonymized personal information or anonymized personal information, and the necessary measures for processing complaints about the handling of personal or other related information (limited, in the case of information related to personal information, to that which constitutes sensitive personal information, etc. for statistical compilation or similar analysis, provided personal information, etc. for statistical compilation or similar analysis, and provided personal data, etc. for statistical compilation or similar analysis; hereinafter the same applies in this paragraph) and for otherwise ensuring the proper handling of personal or other related information and must also endeavor to disclose the content of those measures.
The provisions of Articles 32 through 39 and Section 4 do not apply to a business handling personal information or a business handling anonymized personal information set forth as follows:
a local incorporated administrative agency whose main purpose is providing the service listed in Article 21, item (i) of the Local Incorporated Administrative Agency Act, or whose purpose is providing the service listed in item (ii) or item (iii) of that Article (limited to the part relating to (h)).
The handling of personal information, pseudonymized personal information, or information related to personal information conducted by a person set forth in each following items in the business prescribed in each item is deemed to be the handling of personal information by a business handling personal information, the handling of pseudonymized personal information by a business handling pseudonymized personal information, or the handling of information related to personal information by a business handling information related to personal information; and the provisions in this Chapter (excluding Articles 32 through 39 and Section 4) and Chapters VI through VIII apply to it:
Article 58, paragraph (2), item (i)（別表第二に掲げる法人等についての適用の特例）Exception to Application for Corporations, etc. Set Forth in Appended Table 2Changed
a local government organ: operation of a hospital, a clinic prescribed in Article 1-5, paragraph (12) of the Medical Care Act (Act No. 205 of 1948) (referred to as a "hospital" in the following item), a clinic prescribed in paragraph (2) of that Article, , and aan university prescribed in Article 1 of the School Education Act (Act No. 26 of 1947);
Article 58-2, paragraph (1)（取扱いの方法が契約により定められている受託個人情報取扱事業者等についての適用の特例）Exception to Application for Entrusted Businesses Handling Personal or Other Related Information Whose Method of Handling Is Stipulated by ContractAdded
With regard to the handling of personal or other related information (referred to as "entrusted personal or other related information" in items (i) and (ii)) by a business handling personal or other related information that has been entrusted with all or part of the handling of the personal or other related information by another business handling personal or other related information or by an administrative entity (hereinafter referred to as an "entrusted business handling personal or other related information" in this Article), if the matters set forth in the following items are stipulated, pursuant to Order of the Personal Information Protection Commission, in the contract for the entrustment between that other business handling personal or other related information or administrative entity (referred to as the "entrustor" in item (ii)) and the entrusted business handling personal or other related information, and the handling is carried out in accordance with the provisions of the contract concerning the matters set forth in item (i) within the scope necessary for managing the entrusted services, the provisions of Sections 2 through 4 (excluding Articles 23 through 26, Article 30-2, paragraph (14), Article 30-3, Article 31-3, paragraph (10), Article 40-2, paragraph (1), Article 41, paragraphs (2) and (9), Article 42, paragraph (3), Article 43, paragraphs (2) and (6), and Article 46) and paragraph (1) of the following Article do not apply; and for the purpose of applying the provisions of Article 30-2, paragraph (14), Article 31-3, paragraph (10), Article 41, paragraph (9), Article 42, paragraph (3), Article 43, paragraph (6), and Article 46, the phrase "までの規定は" (the provisions of Articles 23 through 25) in Article 30-2, paragraph (14) and Article 31-3, paragraph (10) is deemed to be replaced with "までの規定は、" (the provisions of Articles 23 through 25, followed by a reading comma); the phrase "by a business handling personal information, and the provisions of the main clause of Article 29, paragraph (1) and paragraph (2) of that Article apply mutatis mutandis to cases in which a business handling personal information provides sensitive personal information, etc. for statistical compilation or similar analysis (limited to that which constitutes information related to personal information prescribed in Article 31, paragraph (1)) to a special-provision recipient of personal information pursuant to the main clause of paragraph (5) (limited to cases in which the special-provision recipient of personal information is expected to acquire the sensitive personal information, etc. for statistical compilation or similar analysis as personal data), respectively" in Article 30-2, paragraph (14) and the phrase "by a business handling personal information, and the provisions of the main clause of Article 29, paragraph (1) and paragraph (2) of that Article apply mutatis mutandis to cases in which a business handling information related to personal information provides information related to personal information to a special-provision recipient of information related to personal information pursuant to the main clause of paragraph (1), respectively" in Article 31-3, paragraph (10) are deemed to be replaced with "by a business handling personal information"; the phrase "pseudonymized personal information, personal data that constitutes pseudonymized personal information, and personal data the business holds that constitutes pseudonymized personal information" in Article 41, paragraph (9) is deemed to be replaced with "personal data that constitutes pseudonymized personal information", and the phrase "Article 17, paragraph (2), Article 26 and Articles 32 through 39" in that paragraph is deemed to be replaced with "Article 26"; the phrase "and paragraphs (7) and (8) of the preceding Article apply" in Article 42, paragraph (3) is deemed to be replaced with "apply", the phrase "by a business handling pseudonymized personal information, and the provisions of Article 40 apply mutatis mutandis to the handling of pseudonymized personal information by a business handling pseudonymized personal information, respectively" in that paragraph is deemed to be replaced with "by a business handling pseudonymized personal information", and the phrase "'leaking'; and the term 'not' in Article 41, paragraph (7) is replaced with 'neither acquire deleted or other related information, nor'" in that paragraph is deemed to be replaced with "'leaking'"; and the phrase "measures for managing the security of the anonymized personal information, and the necessary measures for processing complaints about the preparation or other handling of the anonymized personal information, or for otherwise ensuring the proper handling of the anonymized personal information" in Article 43, paragraph (6) and the phrase "measures for managing the security of anonymized personal information and the necessary measures to ensure the proper handling of anonymized personal information such as processing complaints about the handling of anonymized personal information" in Article 46 are deemed to be replaced with "measures for managing the security of the anonymized personal information" and "measures for managing the security of anonymized personal information", respectively.
Article 58-2, paragraph (1), item (i)（取扱いの方法が契約により定められている受託個人情報取扱事業者等についての適用の特例）Exception to Application for Entrusted Businesses Handling Personal or Other Related Information Whose Method of Handling Is Stipulated by ContractAdded
matters prescribed by Order of the Personal Information Protection Commission as the method of handling entrusted personal or other related information (excluding matters concerning measures for the secure management of entrusted personal or other related information and matters that are not likely to hinder the protection of individual rights and interests);
Article 58-2, paragraph (1), item (ii)（取扱いの方法が契約により定められている受託個人情報取扱事業者等についての適用の特例）Exception to Application for Entrusted Businesses Handling Personal or Other Related Information Whose Method of Handling Is Stipulated by ContractAdded
if the entrusted business handling personal or other related information learns that a situation prescribed in Article 26, paragraph (1) has arisen with regard to entrusted personal or other related information, or that entrusted personal or other related information has been handled beyond the scope necessary for managing the entrusted services or in violation of the provisions of the contract concerning the matters set forth in the preceding item, promptly reporting this to the entrustor;
Article 58-2, paragraph (1), item (iii)（取扱いの方法が契約により定められている受託個人情報取扱事業者等についての適用の特例）Exception to Application for Entrusted Businesses Handling Personal or Other Related Information Whose Method of Handling Is Stipulated by ContractAdded
other matters prescribed by Order of the Personal Information Protection Commission.
その他個人情報保護委員会規則で定める事項
Article 58-3第五十八条の三Caption added
Responsibilities, etc. of Businesses Handling Personal or Other Related Information Concerning the Handling of Personal or Other Related Information of Minors
Article 58-3, paragraph (1)（未成年者の個人情報等の取扱いに関する個人情報取扱事業者等の責務等）Responsibilities, etc. of Businesses Handling Personal or Other Related Information Concerning the Handling of Personal or Other Related Information of MinorsAdded
A business handling personal or other related information must, with regard to the handling of personal or other related information concerning minors, comply with the provisions of this Act, and also endeavor to take necessary measures so as not to harm the rights or interests of minors, after giving primary consideration to their best interests in accordance with their age and degree of development.
Article 58-3, paragraph (2)（未成年者の個人情報等の取扱いに関する個人情報取扱事業者等の責務等）Responsibilities, etc. of Businesses Handling Personal or Other Related Information Concerning the Handling of Personal or Other Related Information of MinorsAdded
When making a request for disclosure or other handling (or, for the legal representative of the identifiable person under 16 years of age, when making a request for disclosure or other handling or giving the consent under Article 35, paragraph (9), item (i); under Article 18, paragraph (1) or (2), the part of Article 20, paragraph (2) other than the items, the part of Article 27, paragraph (1) other than the items, or Article 28, paragraph (1), as applied following the deemed replacement of terms pursuant to Article 40-2, paragraph (1); or under Article 31, paragraph (1), item (i), as applied following the deemed replacement of terms pursuant to Article 35, paragraph (7), item (i) or (ii) or Article 40-2, paragraph (2)), the legal representative of the identifiable person who is a minor must give primary consideration to the best interests of that identifiable person.
Responsibilities of Academic Research Institutions or the Equivalent（学術研究機関等の責務）
Article 59, paragraph (1)
Academic research organizations or the equivalent which are businesses handling personal information must endeavor to comply with the provisions of this Act as well as personally take necessary measures for ensuring the appropriate handling of personal information for academic research purposes, and endeavor to the public the content of those measures.