Chapter V Obligations of Administrative Entities (Articles 72-3 to 73)
The law as Act on the Arrangement of Related Acts upon the Enforcement of the Act Partially Amending the Civil Code, etc. (Act No. 46 of 2026) leaves it, with the words it changes marked.
The main text is read a page at a time: a chapter to a page, and a long chapter in runs of articles. The whole main text, and the supplementary provisions and appended tables this amendment changes. Those it leaves untouched are on the page for the text in force.
Article 72-3第七十二条の三
Obligations Concerning Special Provisions for statistical compilation or similar analysis（統計作成等の特例に係る義務）
Article 72-3, paragraph (1)
An administrative organ's head or administrative entity that handles sensitive personal information, etc. for statistical compilation or similar analysis provided to it (including provision via two or more layers) by a special-provision acquirer of sensitive personal information must not, notwithstanding the provisions of Article 69, and except in cases based on laws and regulations, etc., handle that sensitive personal information, etc. for statistical compilation or similar analysis beyond the scope necessary for performing the act specified in the following items in accordance with the categories of cases set forth in those items:
if the special-provision acquirer of sensitive personal information has disclosed, pursuant to the provisions of Article 30-2, paragraph (2), the content of the statistical compilation or similar analysis that it intends to conduct using the sensitive personal information to which the sensitive personal information, etc. for statistical compilation or similar analysis relates (excluding the case set forth in item (iii)): the statistical compilation or similar analysis of the disclosed content;
if the special-provision acquirer of sensitive personal information has disclosed, pursuant to the provisions of Article 30-2, paragraph (2), that it handles the sensitive personal information to which the sensitive personal information, etc. for statistical compilation or similar analysis relates for the purpose of making a provision under the main clause of paragraph (5) of that Article (excluding the case set forth in the following item): that provision;
if the special-provision acquirer of sensitive personal information has disclosed, pursuant to the provisions of Article 30-2, paragraph (2), the content of the statistical compilation or similar analysis that it intends to conduct using the sensitive personal information to which the sensitive personal information, etc. for statistical compilation or similar analysis relates, and that it handles that sensitive personal information for the purpose of making a provision under the main clause of paragraph (5) of that Article: the statistical compilation or similar analysis of the disclosed content and that provision.
An administrative organ's head or administrative entity that has been provided with personal information pursuant to the main clause of Article 30-2, paragraph (5) must continuously disclose, by the method prescribed by Order of the Personal Information Protection Commission referred to in item (i) of that paragraph, the matters prescribed in that item (or, if those matters have been changed pursuant to the main clause of the following paragraph or in the case referred to in paragraph (4), those matters after the change) for the period during which it handles the provided personal information, etc. for statistical compilation or similar analysis relating to that personal information.
The administrative organ's head or administrative entity prescribed in the preceding paragraph may change the matters disclosed pursuant to the provisions of the preceding paragraph only if both the administrative organ's head or administrative entity and the business handling personal information that provided the personal information pursuant to the main clause of Article 30-2, paragraph (5) disclose in advance, by the method prescribed by Order of the Personal Information Protection Commission referred to in item (i) of that paragraph, that they will change those matters and the content of the change; provided, however, that this does not apply when changing the name of the administrative organ's head or administrative entity or other matters prescribed by Order of the Personal Information Protection Commission.
In the case referred to in the proviso to the preceding paragraph, the administrative organ's head or administrative entity prescribed in paragraph (2) must, promptly after making the change, disclose that it has made the change and the content of the change by the method prescribed by Order of the Personal Information Protection Commission referred to in Article 30-2, paragraph (5), item (i).
An administrative organ's head or administrative entity that handles provided personal information, etc. for statistical compilation or similar analysis must not, notwithstanding the provisions of Article 69, and except in cases based on laws and regulations, etc., handle that provided personal information, etc. for statistical compilation or similar analysis beyond the scope necessary for conducting the statistical compilation or similar analysis specified in the following items in accordance with the categories of cases set forth in those items:
if the provision under the main clause of Article 30-2, paragraph (5) relating to the provided personal information, etc. for statistical compilation or similar analysis was made to a special-provision recipient of personal information: the statistical compilation or similar analysis of the content that the special-provision recipient of personal information discloses pursuant to the provisions of paragraph (6) of that Article;
if the provision under the main clause of Article 30-2, paragraph (5) relating to the provided personal information, etc. for statistical compilation or similar analysis was made to an administrative organ's head or administrative entity: the statistical compilation or similar analysis of the content that the administrative organ's head or administrative entity discloses pursuant to the provisions of paragraph (2).
An administrative organ's head or administrative entity that has been provided with information related to personal information pursuant to the main clause of Article 31-3, paragraph (1) and has acquired it as personal data must continuously disclose, by the method prescribed by Order of the Personal Information Protection Commission referred to in item (i) of that paragraph, the matters prescribed in that item (or, if those matters have been changed pursuant to the main clause of the following paragraph or in the case referred to in paragraph (8), those matters after the change) for the period during which it handles the provided personal data, etc. for statistical compilation or similar analysis relating to that information related to personal information.
The administrative organ's head or administrative entity prescribed in the preceding paragraph may change the matters disclosed pursuant to the provisions of the preceding paragraph only if both the administrative organ's head or administrative entity and the business handling information related to personal information prescribed in Article 16, paragraph (8) that provided the information related to personal information pursuant to the main clause of Article 31-3, paragraph (1) disclose in advance, by the method prescribed by Order of the Personal Information Protection Commission referred to in item (i) of that paragraph, that they will change those matters and the content of the change; provided, however, that this does not apply when changing the name of the administrative organ's head or administrative entity or other matters prescribed by Order of the Personal Information Protection Commission.
In the case referred to in the proviso to the preceding paragraph, the administrative organ's head or administrative entity prescribed in paragraph (6) must, promptly after making the change, disclose that it has made the change and the content of the change by the method prescribed by Order of the Personal Information Protection Commission referred to in Article 31-3, paragraph (1), item (i).
An administrative organ's head or administrative entity that handles provided personal data, etc. for statistical compilation or similar analysis must not, notwithstanding the provisions of Article 69, and except in cases based on laws and regulations, etc., handle that provided personal data, etc. for statistical compilation or similar analysis beyond the scope necessary for conducting the statistical compilation or similar analysis specified in the following items in accordance with the categories of cases set forth in those items:
if the provision under the main clause of Article 31-3, paragraph (1) relating to the provided personal data, etc. for statistical compilation or similar analysis was made to a special-provision recipient of information related to personal information: the statistical compilation or similar analysis of the content that the special-provision recipient of information related to personal information discloses pursuant to the provisions of paragraph (2) of that Article;
if the provision under the main clause of Article 31-3, paragraph (1) relating to the provided personal data, etc. for statistical compilation or similar analysis was made to an administrative organ's head or administrative entity: the statistical compilation or similar analysis of the content that the administrative organ's head or administrative entity discloses pursuant to the provisions of paragraph (6).
An administrative organ's head or administrative entity that handles sensitive personal information, etc. for statistical compilation or similar analysis, provided personal information, etc. for statistical compilation or similar analysis, or provided personal data, etc. for statistical compilation or similar analysis must not, notwithstanding the provisions of Article 69, and except in cases based on laws and regulations, etc., provide that sensitive personal information, etc. for statistical compilation or similar analysis, provided personal information, etc. for statistical compilation or similar analysis, or provided personal data, etc. for statistical compilation or similar analysis to a third party (excluding a business handling personal information, or an administrative organ's head or administrative entity, that has been entrusted with the handling of that sensitive personal information, etc. for statistical compilation or similar analysis, provided personal information, etc. for statistical compilation or similar analysis, or provided personal data, etc. for statistical compilation or similar analysis).
An administrative organ's head or administrative entity must take the necessary and appropriate measures for the secure management of sensitive personal information, etc. for statistical compilation or similar analysis, provided personal information, etc. for statistical compilation or similar analysis, or provided personal data, etc. for statistical compilation or similar analysis, including preventing the leaking of the sensitive personal information, etc. for statistical compilation or similar analysis, provided personal information, etc. for statistical compilation or similar analysis, or provided personal data, etc. for statistical compilation or similar analysis it handles (excluding those that constitute personal information the administrative entity holds; hereinafter the same applies in this paragraph).
The provisions of paragraphs (1) and (5) and the preceding three paragraphs apply mutatis mutandis to cases in which a person that has been entrusted (including entrustment via two or more layers) with the handling of sensitive personal information, etc. for statistical compilation or similar analysis, provided personal information, etc. for statistical compilation or similar analysis, or provided personal data, etc. for statistical compilation or similar analysis by an administrative organ's head or administrative entity conducts the entrusted business, and the provisions of Article 70 apply mutatis mutandis to cases in which an administrative organ's head or administrative entity provides sensitive personal information, etc. for statistical compilation or similar analysis, provided personal information, etc. for statistical compilation or similar analysis, or provided personal data, etc. for statistical compilation or similar analysis (excluding those that constitute personal information the administrative entity holds), respectively.
Obligations on the Handling of Pseudonymized Personal Information（仮名加工情報の取扱いに係る義務）
Article 73, paragraph (1)
Except in cases based on laws and regulations, an administrative organ's head or administrative entity must not provide pseudonymized personal information (excluding those that are personal information; hereinafter the same applies in this Article and Article 128) to a third party (excluding a person entrusted with the handling of the pseudonymized personal information).
An administrative organ's head or administrative entity must take necessary and appropriate measures for managing the security of personal data including preventing the leaking of pseudonymized personal information they handle.
Except cases based on laws and regulations, in handling pseudonymized personal information, an administrative organ's head or administrative entity must neither acquire deleted or other related information (meaning identifiers or their equivalent, individual identification codes, and information on the method of processing as performed under Article 41, paragraph (1) that have been deleted from the personal information used to prepare the pseudonymized personal information), nor collate the pseudonymized personal information with other information, in order to identify the person identifiable by personal information that was used to prepare that pseudonymized personal information.
Except cases based on laws and regulations, in handling pseudonymized personal information, an administrative organ's head or administrative entity must not utilize a contact address and other information contained in the pseudonymized personal information for telephoning, for sending by mail or by correspondence delivery, for delivering a telegram, for transmitting information using a facsimile machine or electronic or magnetic means (meaning means that use electronic data processing system or means that utilize other information communication technology as prescribed by Order of the Personal Information Protection Commission), or for visiting a residence.
The provisions of each preceding paragraph apply mutatis mutandis to cases in which a person that has been entrusted (including entrustment via two or more layers) with the handling of pseudonymized personal information by an administrative organ's head or administrative entity conducts the entrusted business.
The provisions of Article 72-2 apply mutatis mutandis to the handling, by an administrative organ's head or administrative entity, of pseudonymized personal information that contains an identifier or the equivalent set forth in any of the items of Article 2, paragraph (8) (including information that can be readily collated with other information and thereby enables that identifier or the equivalent to be identified).
The day a law or an amendment starts to apply. It is often months or years after promulgation, so that people have time to prepare. The Ministry of Justice's English usually says a law "comes into force" or "comes into effect", and sometimes calls the day its "enforcement date". Its "enforcement" more often means the word's other sense, carrying a law out, as in an Order for Enforcement (施行令), the Cabinet Order (政令) that sets out the details for carrying out an Act.