Act on the Protection of Personal Information

The purpose of this Act is to protect the rights and interests of individuals while ensuring the smooth and proper management of the processes or services of administrative entities as well as ensuring due consideration of the value of personal information and the fact that the proper and effective application of personal information contributes to the creation of new industries and the realization of a vibrant economic society and an enriched quality life of the Japanese public; by setting forth the basic principles for the proper handling of personal information, creating a governmental basic policy with regard to this, establishing other matters to serve as a basis for measures to protect personal information, and clarifying the responsibilities of the national and local governments and establishing obligations that businesses and administrative entities that handle personal information are required to fulfill in accordance with their circumstances, as well as establishing the Personal Information Protection Commission, in light of the significantly expanding utilization of personal information as digital society evolves.

"Personal information" in this Act means information relating to a living individual which falls under any of the following items:

information containing a name, date of birth, or other identifier or the equivalent (meaning all items (excluding individual identification codes) made by writing, recording, sound or motion, or other means, in a document, drawing, or electronic or magnetic record (this includes a record created in electronic or magnetic form (meaning electronic form, magnetic form, or any other form that cannot be perceived with the human senses; the same applies in item (ii) of the following paragraph); hereinafter the same); hereinafter the same) which can be used to identify a specific individual (this includes any information that can be easily collated with other information and thereby used to identify that specific individual);

those containing an individual identification code.

"Individual identification code" in this Act means one prescribed by Cabinet Order which consists of any character, letter, number, symbol or other codes falling under any of the following items:

characters, letters, numbers, symbols or other codes converted in order to be provided for use by computers, used to identify a specific individual by a distinguishing physical feature of theirs;

characters, letters, numbers, symbols or other codes used to identify a specific user, purchaser, or recipient, which are assigned differently for each of them regarding the use of services for an individual or the purchase of goods for an individual, or which are stated or recorded in an electronic or magnetic means differently for each of them in a card or other document issued to an individual.

"Sensitive personal information" in this Act means personal information as to an identifiable person's race, creed, social status, medical history, criminal record, the fact of having suffered damage by a crime, or other identifiers or their equivalent prescribed by Cabinet Order as those of requiring special care so as not to cause unjust discrimination, prejudice or other disadvantages to that person.

"Identifiable person" in relation to personal information in this Act means a specific individual identifiable by personal information.

"Pseudonymized personal information" in this Act means information relating to an individual that can be prepared in a way that makes it not possible to identify a specific individual unless collated with other information by taking any of the measures prescribed in each following item in accordance with the divisions of personal information set forth in those items:

personal information falling under paragraph (1), item (i):deleting a part of the identifiers or their equivalent contained in the personal information (including replacing the part of the identifiers or their equivalent with other identifiers or their equivalent without following patterns that enable its restoration);

personal information falling under paragraph (1), item (ii):deleting all individual identification codes contained in the personal information (including replacing the individual identification codes with other identifiers or their equivalent without following patterns that enable restoration of the individual identification codes).

"Anonymized personal information" in this Act means information relating to an individual that can be prepared in a way that makes it not possible to identify a specific individual by taking any of the measures prescribed in each following item in accordance with the divisions of personal information set forth in those items; and also make it not possible to restore that personal information:

personal information falling under paragraph (1), item (i):deleting a part of the identifiers or their equivalent contained in the personal information (including replacing the part of the identifiers or their equivalent with other identifiers or their equivalent without following patterns that enable its restoration);

personal information falling under paragraph (1), item (ii):deleting all individual identification codes contained in the personal information (including replacing the individual identification codes with other identifiers or their equivalent without following patterns that enable restoration of the individual identification codes).

"Information related to personal information" in this Act means information relating to a living individual which doesn't fall under personal information, pseudonymized personal information and anonymized personal information.

"Contact-enabling information related to personal information" in this Act means information related to personal information that contains any of the following identifiers or the equivalent (including information that can be readily collated with other information and thereby enables any of the following identifiers or the equivalent to be identified):

the address of a residence, place of work or any other place where a specific individual is or was located (limited to one that can be used for sending to a specific individual by mail or by correspondence delivery prescribed in Article 2, paragraph (2) of the Act on Correspondence Delivery by Private Business Operators (Act No. 99 of 2002) (referred to as "correspondence delivery" in Article 41, paragraph (8) and Article 73, paragraph (4)) conducted by a general correspondence delivery operator prescribed in Article 2, paragraph (6) of that Act or a specified correspondence delivery operator prescribed in paragraph (9) of that Article, for delivering a telegram to a specific individual, or for visiting a specific individual);

a telephone number (limited to one that can be used for telephoning a specific individual or for transmitting information to a specific individual using a facsimile machine);

an email address (meaning an email address prescribed in Article 2, item (iii) of the Act on Regulation of Transmission of Specified Electronic Mail (Act No. 26 of 2002), limited to one that can be used for sending electronic mail prescribed in item (i) of that Article to a specific individual);

a code assigned so as to enable the identification of a person using telecommunications facilities (meaning telecommunications facilities prescribed in Article 2, item (ii) of the Telecommunications Business Act (Act No. 86 of 1984); the same applies hereinafter in this item) or of telecommunications facilities (limited to one that can be used for communicating information to a specific individual by means of telecommunications (meaning telecommunications prescribed in item (i) of that Article));

beyond what is set forth in the preceding items, identifiers or the equivalent prescribed by Order of the Personal Information Protection Commission as those that can be used for contacting a specific individual or otherwise communicating information to a specific individual.

"administrative organ" in this Act means the following:

organs within the Cabinet (excluding the Cabinet Office and the Disaster Management Agency) or under the jurisdiction of the Cabinet which are established pursuant to the provisions of laws;

the Cabinet Office, the Imperial Household Agency, and organs prescribed in Article 49, paragraphs (1) and (2) of the Act for Establishment of the Cabinet Office (Act No. 89 of 1999) (if, under these organs, an organ designated by Cabinet Order as prescribed in item (v) is established, that organ designated by Cabinet Order is excluded);

the Disaster Management Agency (excluding facilities and other organs designated by Cabinet Order as prescribed in item (vi));

organs prescribed in Article 3, paragraph (2) of the National Government Organization Act (Act No. 120 of 1948) (if, under these organs, an organ designated by Cabinet Order as prescribed in item (vii) is established, that organ designated by Cabinet Order is excluded);

organs referred to in Articles 39 and 55 of the Act for Establishment of the Cabinet Office and in Article 16, paragraph (2) of the Imperial Household Agency Act (Act No. 70 of 1947), and extraordinary organs referred to in Articles 40 and 56 of the Act for Establishment of the Cabinet Office (including as applied mutatis mutandis pursuant to Article 18, paragraph (1) of the Imperial Household Agency Act), that are designated by Cabinet Order;

facilities and other organs referred to in Article 15 of the Act for Establishment of the Disaster Management Agency (Act No. 61 of 2026) that are designated by Cabinet Order;

facilities and other organs referred to in Article 8-2 of the National Government Organization Act, and extraordinary organs referred to in Article 8-3 of that Act, that are designated by Cabinet Order;

the Board of Audit.

"Incorporated administrative agency or other prescribed corporation" in this Act means an incorporated administrative agency as prescribed in Article 2, paragraph (1) of the Act on General Rules for Incorporated Administrative Agencies (Act No. 103 of 1999) and the corporation listed in the Appended Table 1.

"local incorporated administrative agency" in this Act means a local incorporated administrative agency as prescribed in Article 2, paragraph (1) of the Local Independent Administrative Agency Act (Act No. 118 of 2003).

"administrative entity" in this Act means the following organs:

administrative organs;

local government organs (excluding assemblies; the same applies hereinafter except the following Chapter, Chapter III and Article 69, paragraph (2), item (iii));

incorporated administrative agencies or other prescribed corporations (excluding corporations listed in the Appended Table 2; the same applies in Article 16, paragraph (2), item (iii), Article 63, Article 78, paragraph (1), item (vii), (a) and (b), Article 89, paragraphs (4) through (6), Article 119, paragraphs (5) through (7), and Article 125, paragraph (2));

local incorporated administrative agencies (excluding those whose main purpose is providing the service listed in Article 21, item (i) of the Local Independent Administrative Agency Act, or those whose purpose is providing the service listed in item (ii) or (iii) of that Article (limited to the part relating to (h)); the same applies in Article 16, paragraph (2), item (iv), Article 63, Article 78, paragraph (1), item (vii), (a) and (b), Article 89, paragraphs (7) through (9), Article 119, paragraphs (8) through (10), and Article 125, paragraph (2)).

"Statistical compilation or similar analysis" in this Act means an act of compiling statistics or otherwise creating information on the trends or properties of a large amount of information (excluding such trend or property information that concerns individuals) by extracting information relating to the elements constituting that information from the large amount of information and conducting classification, comparison or other analysis, which is prescribed by Order of the Personal Information Protection Commission as being unlikely to harm individual rights and interests.

The proper handling of personal information must be pursued in view of the fact that it should be handled prudently in line with the philosophy of respecting the autonomy of the individual.