Search provisions, jump to a law or an article
This text is not in force yetIt by 16 July 2028, on a day set by — at the latest in 2 years
Read the text in force →個人情報の保護に関する法律
Chapter V Obligations of Administrative Entities (Articles 69 to 72-2)
The law as Act Partially Amending the Act on the Protection of Personal Information, etc. (Act No. 56 of 2026) leaves it, with the words it changes marked.
The main text is read a page at a time: a chapter to a page, and a long chapter in runs of articles. The whole main text, and the supplementary provisions and appended tables this amendment changes. Those it leaves untouched are on the page for the text in force.
An administrative organ's head or administrative entity must not personally use or provide other persons with personal information the administrative entity holds for any purpose other than the purpose of use, except cases based on laws and regulations.
行政機関の長等は、法令に基づく場合を除き、利用目的以外の目的のために保有個人情報を自ら利用し、又は提供してはならない。
Notwithstanding the provisions of the preceding paragraph, when finding the case to fall under circumstances specified by any of the following items, an administrative organ's head or administrative entity may personally use or provide other persons with personal information the administrative entity holds for any purpose other than the purpose of use; provided, however, this does not apply if it is found that using that personal information personally or providing it to other persons for any purpose other than the purpose of use is likely to cause unjust prejudice to the rights or interests of the identifiable person or a third party:
前項の規定にかかわらず、行政機関の長等は、次の各号のいずれかに該当すると認めるときは、利用目的以外の目的のために保有個人情報を自ら利用し、又は提供することができる。ただし、保有個人情報を利用目的以外の目的のために自ら利用し、又は提供することによって、本人又は第三者の権利利益を不当に侵害するおそれがあると認められるときは、この限りでない。
if the personal information the administrative entity holds is used or provided with the identifiable person's consent, or if it is provided to the identifiable person;
本人の同意があるとき、又は本人に提供するとき。
if the administrative entity uses personal information it holds within the organ only to the extent necessary for managing processes or services under the jurisdiction provided by laws and regulations, and there are reasonable grounds for the use of that personal information;
行政機関等が法令の定める所掌事務又は業務の遂行に必要な限度で保有個人情報を内部で利用する場合であって、当該保有個人情報を利用することについて相当の理由があるとき。
if the personal information the administrative entity holds is provided to other administrative organ, incorporated administrative agency or other prescribed corporation, local government organ, or local incorporated administrative agency; the person that receives the information uses it only to the extent necessary for managing the processes or services under its jurisdiction provided by laws and regulations; and there are reasonable grounds for the use of that personal information;
他の行政機関、独立行政法人等、地方公共団体の機関又は地方独立行政法人に保有個人情報を提供する場合において、保有個人情報の提供を受ける者が、法令の定める事務又は業務の遂行に必要な限度で提供に係る個人情報を利用し、かつ、当該個人情報を利用することについて相当の理由があるとき。
beyond what is set forth in the preceding three items, if the personal information the administrative entity holds is provided exclusively for statisticalthe purpose orof statistical compilation or similar analysis or for academic research purpose; provision of the information to other persons is obviously beneficial to the identifiable person; or there are other special grounds for providing that personal information.
前三号に掲げる場合のほか、専ら統計の作成作成等又は学術研究の目的のために保有個人情報を提供するとき、本人以外の者に提供することが明らかに本人の利益になるとき、その他保有個人情報を提供することについて特別の理由があるとき。
The provisions of the preceding paragraph do not preclude the application of the provisions of other laws and regulations which restrict the use or provision of personal information an administrative entity holds.
前項の規定は、保有個人情報の利用又は提供を制限する他の法令の規定の適用を妨げるものではない。
When finding it particularly necessary for protecting the individual rights and interests, an administrative organ's head or administrative entity is to allow only particular departments, agencies, or employees within the organ to use personal information the administrative entity holds for any purpose other than the purpose of use.
行政機関の長等は、個人の権利利益を保護するため特に必要があると認めるときは、保有個人情報の利用目的以外の目的のための行政機関等の内部における利用を特定の部局若しくは機関又は職員に限るものとする。
When an administrative organ's head or administrative entity finds it necessary in providing personal information the administrative entity holds for the purpose of use or pursuant to the provisions of paragraph (2), item (iii) or (iv) of the preceding Article, they are to impose restrictions on the purpose or method of use of the personal information they provide or any other restrictions considered necessary on a person that receives that personal information, or request the person take necessary measures to prevent the leaking of and for the proper management of that personal information.
行政機関の長等は、利用目的のために又は前条第二項第三号若しくは第四号の規定に基づき、保有個人情報を提供する場合において、必要があると認めるときは、保有個人情報の提供を受ける者に対し、提供に係る個人情報について、その利用の目的若しくは方法の制限その他必要な制限を付し、又はその漏えいの防止その他の個人情報の適切な管理のために必要な措置を講ずることを求めるものとする。
Except in cases based on laws and regulations or set forth in Article 69, paragraph (2), item (iv), before an administrative organ's organ 's head or administrative entity provides personal information the administrative entity holds to a third party (excluding a person that has established a system that conforms to standards prescribed by Order of the Personal Information Protection Commission as necessary for continuously taking measures equivalent to the one that a business handling personal information (meaning a business handling personal information prescribed in Article 16, paragraph (2) ; the same applies in the following Article and Article 72-3, paragraphs (3) and (10)) is to take concerning the handling of personal data (meaning personal data prescribed in Article 16, paragraph (3) ; the same applies in Article 72-3, paragraph (6)) pursuant to the provisions of Section 2 of the preceding Chapter (referred to as "equivalent measures" in paragraph (3)); hereinafter the same applies in this paragraph and the following paragraph) in a foreign country (meaning a country or region located outside the territory of Japan; hereinafter the same applies in this Article) (excluding those prescribed by Order of the Personal Information Protection Commission as a foreign country that has established a personal information protection system recognized to have equivalent standards to that in Japan regarding the protection of individual rights and interests; hereinafter the same applies in this Article) for any purpose other than the purpose of use, the administrative organ's head or administrative entity must acquire the identifiable person's consent to the effect that the person approves the provision to a third party in a foreign country.
行政機関の長等は、外国（本邦の域外にある国又は地域をいう。以下この条において同じ。）（個人の権利利益を保護する上で我が国と同等の水準にあると認められる個人情報の保護に関する制度を有している外国として個人情報保護委員会規則で定めるものを除く。以下この条において同じ。）にある第三者（個人データ（第十六条第三項に規定する個人データのをいう。第七十二条の三第六項において同じ。）の取扱いについて前章第二節の規定により同個人情報取扱事業者（第十六条第二項に規定する個人情報取扱事業者をいう。次条並びに第七十二条の三第三項及び第十項において同じ。）が講ずべきこととされている措置に相当する措置（第三項において「相当措置」という。）を継続的に講ずるために必要なものとして個人情報保護委員会規則で定める基準に適合する体制を整備している者を除く。以下この項及び次項において同じ。）に利用目的以外の目的のために保有個人情報を提供する場合には、法令に基づく場合及び第六十九条第二項第四号に掲げる場合を除くほか、あらかじめ外国にある第三者への提供を認める旨の本人の同意を得なければならない。
When intending to obtain an identifiable person's consent pursuant to the provisions of the preceding paragraph, an administrative organ's head or administrative entity must provide the person in advance with information on the personal information protection system of the foreign country, on the measures the third party takes for the protection of personal information, and other information that serves as a reference to the person, pursuant to Order of the Personal Information Protection Commission.
行政機関の長等は、前項の規定により本人の同意を得ようとする場合には、個人情報保護委員会規則で定めるところにより、あらかじめ、当該外国における個人情報の保護に関する制度、当該第三者が講ずる個人情報の保護のための措置その他当該本人に参考となるべき情報を当該本人に提供しなければならない。
Except in those cases based on laws and regulations or set forth in Article 69, paragraph (2), item (iv), when an administrative organ's head or administrative entity has provided personal information the administrative entity holds to a third party in a foreign country (limited to a person that has established a system prescribed in paragraph (1)) for any purpose other than the purpose of use, the administrative organ's head or administrative entity must take necessary measures to ensure continuous implementation of the equivalent measures by the third party, and in response to the identifiable person's request, provide the person with information on the necessary measures, pursuant to Order of the Personal Information Protection Commission.
行政機関の長等は、保有個人情報を外国にある第三者（第一項に規定する体制を整備している者に限る。）に利用目的以外の目的のために提供した場合には、法令に基づく場合及び第六十九条第二項第四号に掲げる場合を除くほか、個人情報保護委員会規則で定めるところにより、当該第三者による相当措置の継続的な実施を確保するために必要な措置を講ずるとともに、本人の求めに応じて当該必要な措置に関する情報を当該本人に提供しなければならない。
Obligations Concerning Personal Information Whose Handling Has Been Entrusted
取扱いの委託を受けた個人情報に係る義務
An administrative entity that has been entrusted with all or part of the handling of personal information (including entrustment via two or more layers) by a business handling personal information or by another administrative entity must not, except in cases based on laws and regulations and cases in which there is an urgent need to respond to the rescue of human life, disaster relief, or other emergency situations (referred to as "cases based on laws and regulations, etc." in Article 72-3), handle the personal information whose handling has been entrusted to it (excluding that which becomes information related to personal information for that administrative entity) beyond the scope necessary for managing the entrusted services.
個人情報取扱事業者又は他の行政機関等から個人情報の取扱いの全部又は一部の委託（二以上の段階にわたる委託を含む。）を受けた行政機関等は、法令に基づく場合及び人命の救助、災害の救援その他非常の事態への対応のため緊急の必要がある場合（第七十二条の三において「法令に基づく場合等」という。）を除くほか、その取扱いを委託された個人情報（当該行政機関等において個人関連情報となるものを除く。）を、当該委託を受けた業務の遂行に必要な範囲を超えて取り扱ってはならない。
Provisions on Deemed Replacement of Terms Concerning the Handling of Personal Information of Persons under 16 Years of Age
十六歳未満の者の個人情報の取扱いに関する読替規定
With regard to the application of the provisions of Article 62, Article 68, paragraph (2), Article 69, paragraph (2), and Article 71 to the personal information of a person under 16 years of age in cases in which an administrative entity handles that personal information (excluding the cases set forth in the following items), the phrase "to that person" in Article 62 and the phrase "notify an identifiable person" in Article 68, paragraph (2) are deemed to be replaced with "to the legal representative of that person" and "notify the legal representative of the identifiable person", respectively; the phrase "to the identifiable person" in item (i) of Article 68, paragraph (2) is deemed to be replaced with "to the legal representative of the identifiable person"; in Article 69, paragraph (2), item (i), the phrase "the identifiable person's consent" is deemed to be replaced with "the consent of the legal representative of the identifiable person", and the phrase "provided to the identifiable person" is deemed to be replaced with "provided to the identifiable person or the legal representative of the identifiable person"; the term "identifiable person" in Article 71, paragraphs (1) and (2) is deemed to be replaced with "legal representative of the identifiable person"; and the term "identifiable person" in paragraph (3) of that Article is deemed to be replaced with "identifiable person or the legal representative of the identifiable person".
行政機関等が十六歳未満の者の個人情報を取り扱う場合（次に掲げる場合を除く。）における当該個人情報についての第六十二条、第六十八条第二項、第六十九条第二項及び第七十一条の規定の適用については、第六十二条及び第六十八条第二項中「本人に」とあるのは「本人の法定代理人に」と、同項第一号中「本人へ」とあるのは「本人の法定代理人へ」と、第六十九条第二項第一号中「本人の」とあるのは「本人の法定代理人の」と、「本人に」とあるのは「本人若しくはその法定代理人に」と、第七十一条第一項及び第二項中「本人」とあるのは「本人の法定代理人」と、同条第三項中「本人」とあるのは「本人又はその法定代理人」とする。
cases in which the administrative organ's head or administrative entity has a legitimate reason for not knowing that the personal information is that of a person under 16 years of age;
行政機関の長等が、当該個人情報が十六歳未満の者のものであることを知らないことについて正当な理由がある場合
cases in which the legal representative of the identifiable person has permitted the identifiable person to carry on a business, and the administrative entity has acquired the personal information in connection with that business;
本人の法定代理人が当該本人の営業を許可していた場合であって、当該行政機関等が当該営業に関して当該個人情報を取得したとき。
cases in which the identifiable person has no legal representative, or in which the administrative organ's head or administrative entity has reasonable grounds to believe that the identifiable person has no legal representative.
本人に法定代理人がない場合又は行政機関の長等が本人に法定代理人がないと信ずるに足りる相当な理由がある場合
When finding it necessary in providing information related to personal information to a third party (limited to cases in which it is assumed that the third party acquires the information related to personal information as personal information), an administrative organ's head or administrative entity is to impose restrictions on the purpose or method of use of information related to personal information that they provide or any other restrictions considered necessary on the third party, or request the person take necessary measures to prevent the leaking of and for the proper management of the information.
行政機関の長等は、第三者に個人関連情報を提供する場合（当該第三者が当該個人関連情報を個人情報として取得することが想定される場合に限る。）において、必要があると認めるときは、当該第三者に対し、提供に係る個人関連情報について、その利用の目的若しくは方法の制限その他必要な制限を付し、又はその漏えいの防止その他の個人関連情報の適切な管理のために必要な措置を講ずることを求めるものとする。
Prohibition of Inappropriate Handling of Contact-Enabling Information Related to Personal Information
連絡可能個人関連情報の不適正な取扱いの禁止
An administrative organ's head or administrative entity must not utilize contact-enabling information related to personal information using a method that has the possibility of fomenting or inducing unlawful or unjust act.
行政機関の長等は、違法又は不当な行為を助長し、又は誘発するおそれがある方法により連絡可能個人関連情報を利用してはならない。
An administrative organ's head or administrative entity must not acquire contact-enabling information related to personal information by deception or other wrongful means.
行政機関の長等は、偽りその他不正の手段により連絡可能個人関連情報を取得してはならない。