The law as Act Partially Amending the Act on the Protection of Personal Information, etc. (Act No. 56 of 2026) leaves it, with the words it changes marked.
The main text is read a page at a time: a chapter to a page, and a long chapter in runs of articles. The whole main text, and the supplementary provisions and appended tables this amendment changes. Those it leaves untouched are on the page for the text in force.
With regard to matters equivalent to the matters set forth in the items of Article 21-2, paragraph (1) of the Act on the Protection of Personal Information as amended by the provisions of Article 1 (excluding the amending provisions set forth in Article 1, item (iii) of the Supplementary Provisions; the same applies in paragraph (2) of the following Article) (hereinafter referred to as the "New Act on the Protection of Personal Information"), if the identifiable person has been notified of those matters before the Effective Date, that notice is deemed to have been given under that paragraph.
If there is consent, given before the Effective Date, concerning the creation of a code equivalent to a specified biometric individual identification code prescribed in Article 16, paragraph (5) of the New Act on the Protection of Personal Information or the acquisition of information equivalent to specified biometric personal information prescribed in that paragraph, and that consent is equivalent to the consent under Article 35, paragraph (7), item (i) or item (ii) of the New Act on the Protection of Personal Information (including the cases in which these provisions are applied following the deemed replacement of terms pursuant to Article 40-2, paragraph (1)), the consent under the relevant item is deemed to have been given.
If there is consent, given before the Effective Date by the legal representative of the identifiable person, concerning the handling of personal information (meaning personal information prescribed in Article 2, paragraph (1) of the Act on the Protection of Personal Information; the same applies hereinafter) or information related to personal information prescribed in paragraph (7) of that Article, and that consent is equivalent to the consent under Article 35, paragraph (9), item (i) of the New Act on the Protection of Personal Information; Article 18, paragraph (1) or paragraph (2), the part of Article 20, paragraph (2) other than the items, the part of Article 27, paragraph (1) other than the items, Article 28, paragraph (1), or Article 35, paragraph (7), item (i) or item (ii) of the New Act on the Protection of Personal Information as applied following the deemed replacement of terms pursuant to Article 40-2, paragraph (1) of the New Act on the Protection of Personal Information; Article 31, paragraph (1), item (i) of the New Act on the Protection of Personal Information as applied following the deemed replacement of terms pursuant to Article 40-2, paragraph (2) of the New Act on the Protection of Personal Information; or Article 69, paragraph (2), item (i) or Article 71, paragraph (1) of the New Act on the Protection of Personal Information as applied following the deemed replacement of terms pursuant to Article 71-3 of the New Act on the Protection of Personal Information, the consent under the relevant provision is deemed to have been given.
If there is the consent of the identifiable person, given before the Effective Date, under the provisions of Article 18, paragraph (1) or paragraph (2), the part of Article 20, paragraph (2) other than the items, the part of Article 27, paragraph (1) other than the items, or Article 28, paragraph (1) of the Act on the Protection of Personal Information prior to the amendment by the provisions of Article 1 (hereinafter referred to as the "Former Act on the Protection of Personal Information"), under the provisions of Article 31, paragraph (1), item (i) of the Former Act on the Protection of Personal Information, or under the provisions of Article 69, paragraph (2), item (i) or Article 71, paragraph (1) of the Former Act on the Protection of Personal Information, the consent of the legal representative of that identifiable person is deemed to have been given under the provisions of Article 18, paragraph (1) or paragraph (2), the part of Article 20, paragraph (2) other than the items, the part of Article 27, paragraph (1) other than the items, or Article 28, paragraph (1) of the New Act on the Protection of Personal Information as applied following the deemed replacement of terms pursuant to Article 40-2, paragraph (1) of the New Act on the Protection of Personal Information, under the provisions of Article 31, paragraph (1), item (i) of the New Act on the Protection of Personal Information as applied following the deemed replacement of terms pursuant to Article 40-2, paragraph (2) of the New Act on the Protection of Personal Information, or under the provisions of Article 69, paragraph (2), item (i) or Article 71, paragraph (1) of the New Act on the Protection of Personal Information as applied following the deemed replacement of terms pursuant to Article 71-3 of the New Act on the Protection of Personal Information, respectively.
With regard to matters equivalent to the matters set forth in the items of Article 21-2, paragraph (1) or the items of Article 27, paragraph (2) of the New Act on the Protection of Personal Information as applied following the deemed replacement of terms pursuant to Article 40-2, paragraph (1) of the New Act on the Protection of Personal Information, or the matters prescribed in Article 27, paragraph (5), item (iii) of that Act, if the legal representative of the identifiable person has been notified of those matters before the Effective Date, that notice is deemed to have been given under the relevant provision.
If, before the Effective Date, a notice has been given to the identifiable person under the provisions of Article 27, paragraph (2) or paragraph (5), item (iii) of the Former Act on the Protection of Personal Information, a notice to the legal representative of that identifiable person is deemed to have been given under the provisions of Article 27, paragraph (2) or paragraph (5), item (iii) of the New Act on the Protection of Personal Information as applied following the deemed replacement of terms pursuant to Article 40-2, paragraph (1) of the New Act on the Protection of Personal Information, respectively.
The provisions of Article 148, paragraphs (1) through (3) of the New Act on the Protection of Personal Information apply to acts in violation of the New Act on the Protection of Personal Information committed on or after the Effective Date, and the provisions then in force continue to govern acts in violation of the Former Act on the Protection of Personal Information committed before the Effective Date.
The provisions of Articles 148-3 through 148-16 of the New Act on the Protection of Personal Information apply to acts subject to administrative monetary penalty prescribed in Article 148-4 of the New Act on the Protection of Personal Information committed on or after the Effective Date.
Every three years after this Act comes into effect, the Government is to review the status of enforcement of the New Act on the Protection of Personal Information, taking into consideration international trends concerning the protection of personal information, the advancement of information and communications technology, the circumstances of the creation and development of new industries utilizing personal information that accompany that advancement, and other factors, and if it finds it necessary, is to take required measures based on the results.