Businesses handling personal information must not provide personal data to a third party without obtaining the identifiable person's consent in advance, except cases set forth below:
cases based on laws and regulations;
法令に基づく場合
Changes by (Act No. 56 of 2026)
cases in which there is a need to protect the life, wellbeing, or property of an individual, and it is difficult to obtain the consent of the identifiable person;
人の生命、身体又は財産の保護のために必要がある場合であって、本人の同意を得ることが困難であるとき。
Changes by (Act No. 56 of 2026)
cases in which there is a special need to improve public wellbeing or promote healthy child development, and it is difficult to obtain the consent of the identifiable person;
公衆衛生の向上又は児童の健全な育成の推進のために特に必要がある場合であって、本人の同意を得ることが困難であるとき。
cases in which there is a need to cooperate with a national government organ, local government, or person entrusted thereby with performing the functions prescribed by laws and regulations, and obtaining the consent of the identifiable person is likely to interfere with the performance of those functions.
国の機関若しくは地方公共団体又はその委託を受けた者が法令の定める事務を遂行することに対して協力する必要がある場合であって、本人の同意を得ることにより当該事務の遂行に支障を及ぼすおそれがあるとき。
cases in which the business handling personal information is an academic research institution or the equivalent, and providing the personal data for the purpose of publication of academic research results or teaching is unavoidable (excluding cases in which there is a risk of unjustly infringing on individual rights and interests);
Changes by (Act No. 56 of 2026)
cases in which the business handling personal information is an academic research institution or the equivalent, and needs to provide the personal data for the academic research purpose (including cases in which a part of the purpose of providing the personal data is for academic research purposes, and excluding cases in which there is a risk of unjustly infringing on individual rights and interests) (limited to cases in which the business handling personal information and the third party jointly conduct academic research);
cases in which the third party is an academic research institution or the equivalent, and the third party needs to handle the personal data for academic research purposes (including cases in which a part of the purpose of handling the personal data is for academic research purposes, and excluding cases in which there is a risk of unjustly infringing on individual rights and interests).
Changes by (Act No. 56 of 2026)
Notwithstanding the provisions of the preceding paragraph, if a business handling personal information agrees to cease to provide a third party with any personal data which can be used to identify the identifiable person, at the request of that person; the business notifies that person of the following information in advance or makes that information readily accessible to that person in advance, as provided for by Order of the Personal Information Protection Commission; and the business files a notification of this to the Commission, the business may provide that personal data to a third party; provided, however, that this does not apply to cases in which personal data which is to be provided to a third party is sensitive personal information, has been acquired in violation of the provisions of Article 20, paragraph (1), or has been provided by another business handling personal information pursuant to the provisions of the main clause of this paragraph (including personal data all or part of which has been reproduced or processed):
個人情報取扱事業者は、第三者に提供される個人データについて、本人の求めに応じて当該本人が識別される個人データの第三者への提供を停止することとしている場合であって、次に掲げる事項について、個人情報保護委員会規則で定めるところにより、あらかじめ、本人に通知し、又は本人が容易に知り得る状態に置くとともに、個人情報保護委員会に届け出たときは、前項の規定にかかわらず、当該個人データを第三者に提供することができる。ただし、第三者に提供される個人データが要配慮個人情報又は第二十条第一項の規定に違反して取得されたもの若しくは他の個人情報取扱事業者からこの項本文の規定により提供されたもの（その全部又は一部を複製し、又は加工したものを含む。）である場合は、この限りでない。
Changes by (Act No. 56 of 2026)
the name and address of a business handling personal information that provides personal information to a third party and, if it is a corporation, the name of its representative (or for an organization without legal personality that has made provisions for a representative or manager, the name of the representative or administrator; hereinafter the same applies in this Article, Article 30, paragraph (1), item (i), and Article 32, paragraph (1), item (i));
第三者への提供を行う個人情報取扱事業者の氏名又は名称及び住所並びに法人にあっては、その代表者（法人でない団体で代表者又は管理人の定めのあるものにあっては、その代表者又は管理人。以下この条、第三十条第一項第一号及び第三十二条第一項第一号において同じ。）の氏名
the fact that providing the data to the third party constitutes the purpose of use;
第三者への提供を利用目的とすること。
the details of the personal data it will provide to the third party;
第三者に提供される個人データの項目
the means or manner in which it will acquire the data it provides to the third party;
第三者に提供される個人データの取得の方法
the means or manner in which it will provide the data to the third party;
第三者への提供の方法
the fact that it will cease to provide personal data that can be used to identify the identifiable person to a third party at the request of the identifiable person;
the means of receiving the identifiable person's request;
本人の求めを受け付ける方法
other matters prescribed by Order of the Personal Information Protection Commission as those necessary to protect individual rights and interests.
その他個人の権利利益を保護するために必要なものとして個人情報保護委員会規則で定める事項
If there has been an alteration to the details set forth in item (i) of the preceding paragraph, or businesses handling personal information have ceased to provide personal data pursuant to the provisions of the preceding paragraph, the businesses must notify the identifiable person of this or make this readily accessible to the person, and notify the Personal Information Protection Commission of this, pursuant to Order of the Personal Information Protection Commission, without delay; and if the businesses seek to alter the details set forth in items (iii) through (v), item (vii), or item (viii) of that paragraph, the businesses must do so beforehand.
If a notification under paragraph (2) has been given, the Personal Information Protection Commission must disclose the details relating to the notification pursuant to Order of the Personal Information Protection Commission. The same applies to cases in which a notification under the preceding paragraph has been given.
In the following cases, a person receiving personal data is not to fall under a third party regarding applying the provisions of each preceding paragraph:
the businesses handling personal information entrusts a person with all or part of the handling of personal data within the scope necessary for achieving the purpose of use;
the personal data is provided when a person succeeds to the business due to a merger or other such circumstances;
合併その他の事由による事業の承継に伴って個人データが提供される場合
the personal data is provided to specific persons who have joint use of that data, and the business notifies the person identifiable by that data of this in advance as well as the details of that data, the extent of the joint users, the users' purpose of use, and the name and address of the person responsible for managing the personal data, and, if the user is corporation, the name of its representative; or the business makes the foregoing information readily accessible to the person identifiable by that data in advance.
If there has been an alteration to the name and address of the person responsible for managing the personal data or, in cases of a corporation, to the name of the representative, as provided for in item (iii) of the preceding paragraph, the business handling personal information must notify the person identifiable by that data of this or make this readily accessible to the person identifiable by that data, without delay; and if the business intends to alter a user's purpose of use or the person responsible for the management as provided for in that item, the business must do so beforehand.
Read this with the articles around it
sensitive personal information
「要配慮個人情報」
Personal information that includes the identifiable person's race, creed, social status, medical history or criminal record, the fact that the person has been harmed by a crime, or other descriptions that a Cabinet Order (政令) names as needing special care in handling so that the person does not suffer unfair discrimination, prejudice or other disadvantage.
Defined inArticle 2, paragraph (3)· applies throughout the law
identifiable person
「本人」
The particular individual whom a given piece of personal information identifies.
Defined inArticle 2, paragraph (4)
personal data
「個人データ」
In Chapter IV, personal information that makes up a personal information database or the equivalent (個人情報データベース等).
Defined inArticle 16, paragraph (3)· applies only in this chapter
academic research institution or the equivalent
「学術研究機関等」
In Chapter IV, a university or other body or organization whose purpose is academic research, or a person belonging to one.
Defined inArticle 16, paragraph (8)· applies only in this chapter
purpose of use
「利用目的」
The purpose for which personal information is used, which Article 17, paragraph (1) requires a business handling personal information (個人情報取扱事業者) to specify as far as possible when it handles personal information.
Short name set inArticle 17, paragraph (1)
academic research purposes
「学術研究目的」
In Chapter IV, the purpose of using personal information for academic research.
Short name set inArticle 18, paragraph (3), item (v)· applies only in this chapter
Personal Information Protection Commission
個人情報保護委員会
The commission the Act on the Protection of Personal Information sets up under Article 49, paragraph (3) of the Act for Establishment of the Cabinet Office (内閣府設置法), under the Prime Minister's jurisdiction (Act on the Protection of Personal Information, Article 130). It is made up of a chairperson and eight commissioners, four of them part-time, whom the Prime Minister appoints with the consent of both Houses of the Diet, and they exercise their authority independently (Articles 133 and 134). Its work includes supervising how businesses handle personal information and the related kinds of information (pseudonymized personal information, anonymized personal information and information related to personal information), monitoring how administrative organs and other public bodies (行政機関等) handle them, matters concerning certified personal information protection organizations (認定個人情報保護団体), and monitoring or supervising how specific personal information (特定個人情報) is handled (Article 132) — personal information that contains an individual number (個人番号), or a code used in its place other than a resident record code (Act on the Use of Numbers to Identify a Specific Individual in Administrative Procedures, Article 2, paragraph (9)). Over businesses that handle personal information and the related kinds of information it may, as far as is needed to enforce the Act's rules for them, require reports and material, have its officials enter their offices, ask questions and inspect, and give guidance and advice (Articles 146 and 147). Where a business breaks certain of those rules and the Commission finds it necessary to protect individuals, it may recommend that the business stop or correct the breach; where the business, without a legitimate reason, does not take the recommended measures and the Commission finds that a serious infringement of an individual's rights and interests is imminent, it may order it to take them; and where certain breaches seriously harm an individual's rights and interests and call for urgent action, it may order the business to stop or correct them without a recommendation first. It may make public that a business has disobeyed an order (Article 148). It may make Rules of the Personal Information Protection Commission (個人情報保護委員会規則) on the matters in its charge, to carry out an Act or a Cabinet Order (政令) or under a special delegation from one (Article 145).
Written by AI using Act on the Protection of Personal Information, Arts. 130, 132, 133, 134, 145, 146, 147, 148 and Act on the Use of Numbers to Identify a Specific Individual in Administrative Procedures, Art. 2 as a reference.
Rules of the Personal Information Protection Commission
個人情報保護委員会規則
Rules the Personal Information Protection Commission (個人情報保護委員会) makes on the matters in its charge, to carry out an Act or a Cabinet Order (政令) or under a special delegation from one (Act on the Protection of Personal Information, Article 145). The Commission is set up under Article 49, paragraph (3) of the Act for Establishment of the Cabinet Office (内閣府設置法) and comes under the Prime Minister (Article 130). It is made up of a chair and eight members, four of them part-time, whom the Prime Minister appoints with the consent of both Houses of the Diet, and they exercise their authority independently (Articles 133 and 134). Its work includes supervising how businesses handle personal information, monitoring how administrative organs and similar bodies handle it, and monitoring or supervising how specific personal information (特定個人情報) is handled (Article 132) — personal information that contains an individual number (個人番号), or a code used in its place other than a resident record code (Act on the Use of Numbers to Identify a Specific Individual in Administrative Procedures, Article 2, paragraph (9)). Where that Act leaves a detail to be set by these Rules (個人情報保護委員会規則で定める), the Rules are where it is written.
Written by AI using Act on the Protection of Personal Information, Arts. 130, 132, 133, 134, 145 and Act on the Use of Numbers to Identify a Specific Individual in Administrative Procedures, Art. 2 as a reference.