When preparing pseudonymized personal information (limited to those compiled in a pseudonymized personal information database or the equivalent; hereinafter the same applies in this Chapter and Chapter VI), businesses handling personal information must process personal information in accordance with standards prescribed by Order of the Personal Information Protection Commission as those necessary to make it impossible to identify a specific individual unless collated with other information.
個人情報取扱事業者は、仮名加工情報（仮名加工情報データベース等を構成するものに限る。以下この章及び第六章において同じ。）を作成するときは、他の情報と照合しない限り特定の個人を識別することができないようにするために必要なものとして個人情報保護委員会規則で定める基準に従い、個人情報を加工しなければならない。
When having prepared pseudonymized personal information or having acquired pseudonymized personal information and deleted or other related information (meaning information related to identifiers or their equivalent and individual identification codes that were deleted from personal information used to prepare the pseudonymized personal information, and the means of processing carried out pursuant to the provisions of the preceding paragraph; hereinafter the same applies in this Article and paragraph (7) as applied mutatis mutandis pursuant to paragraph (3) of the following Article following the deemed replacement of terms) related to the pseudonymized information, businesses handling personal information must take measures for the management of the security of deleted or other related information in accordance with standards prescribed by Order of the Personal Information Protection Commission as those necessary to prevent the leaking of deleted or other related information.
Notwithstanding the provision of Article 18 and except cases based on laws and regulations, a business handling pseudonymized personal information (limited to a business handling personal information; hereinafter the same applies in this Article) must not handle pseudonymized personal information (limited to personal information; hereinafter the same applies in this Article) beyond the necessary scope to achieve the purpose of use specified pursuant to the provisions of Article 17, paragraph (1).
With regard to applying the provisions of Article 21 related to pseudonymized personal information, the phrase "notify the identifiable person of that purpose of use or disclose this to the public" in paragraphs (1) and (3) of that Article is deemed to be replaced with "disclose that purpose of use"; the phrase "notifying the identifiable person of the purpose of use or disclosing this to the public" in the provisions of items (i) through (iii) of paragraph (4) of that Article is deemed to be replaced with "disclosing the purpose of use".
Businesses handling pseudonymized personal information must endeavor to erase personal data that constitutes pseudonymized personal information and deleted or other related information without delay when utilization of the personal data and the deleted or other related information has become unnecessary. In this case, the provisions of Article 22 do not apply.
Notwithstanding the provisions of Article 27, paragraphs (1) and (2), and Article 28, paragraph (1), and except cases based on laws and regulations, businesses handling pseudonymized personal information must not provide a third party with personal data that constitutes pseudonymized personal information. In this case, the term "each preceding paragraph" in Article 27, paragraph (5) is deemed to be replaced with "Article 41, paragraph (6)"; the phrase "notifies the person identifiable by that data of this in advance as well as the details of that data, the extent of the joint users, the users' purpose of use, and the name and address of the person responsible for managing the personal data, and, if the user is corporation, the name of its representative; or the business makes the foregoing information readily accessible to the person identifiable by that data in advance" in item (iii) of that paragraph is deemed to be replaced with "disclose this in advance as well as the details of that data, the extent of the joint users, the users' purpose of use, and the name and address of the person responsible for managing the personal data, and, if the user is corporation, the name of its representative"; the phrase "notify the person identifiable by that data of this or make this readily accessible to the person identifiable by that data, without delay" in Article 27, paragraph (6) is deemed to be replaced with "disclose this without delay"; the phrase "any of the items of Article 27, paragraph (1) or paragraph (5) (or any of the items of Article 27, paragraph (1), in cases of a provision of personal data under paragraph (1) of the preceding Article)" in the proviso of Article 29, paragraph (1), and the term "any of the items of Article 27, paragraph (1) or paragraph (5)" in the proviso of Article 30, paragraph (1) are deemed to be replaced with "cases based on laws and regulations or any of the items of Article 27, paragraph (5)".
仮名加工情報取扱事業者は、第二十七条第一項及び第二項並びに第二十八条第一項の規定にかかわらず、法令に基づく場合を除くほか、仮名加工情報である個人データを第三者に提供してはならない。この場合において、第二十七条第五項中「前各項」とあるのは「第四十一条第六項」と、同項第三号中「、本人に通知し、又は本人が容易に知り得る状態に置いて」とあるのは「公表して」と、同条第六項中「、本人に通知し、又は本人が容易に知り得る状態に置かなければ」とあるのは「公表しなければ」と、第二十九条第一項ただし書中「第二十七条第一項各号又は第五項各号のいずれか（前条第一項の規定による個人データの提供にあっては、第二十七条第一項各号のいずれか）」とあり、及び第三十条第一項ただし書中「第二十七条第一項各号又は第五項各号のいずれか」とあるのは「法令に基づく場合又は第二十七条第五項各号のいずれか」とする。
Businesses handling pseudonymized personal information, in handling that information, must not collate the pseudonymized personal information with other information in order to identify a person identifiable by personal information that was used to prepare the pseudonymized personal information.
Businesses handling pseudonymized personal information, in handling that information, must not use contact addresses and other information contained in the pseudonymized personal information for telephoning, for sending by mail or by correspondence delivery prescribed in Article 2, paragraph (2) of the Act on Correspondence Delivery by Private Business Operators (Act No. 99 of 2002) conducted by a general correspondence delivery operator prescribed in Article 2, paragraph (6) or a specified correspondence delivery operator prescribed in Article 2, paragraph (9), for delivering a telegram, for transmitting information using a facsimile machine or electronic or magnetic means (meaning means that use electronic data processing system or means that utilize other information communication technology as prescribed by Order of the Personal Information Protection Commission), or for visiting a residence.
仮名加工情報取扱事業者は、仮名加工情報を取り扱うに当たっては、電話をかけ、郵便若しくは民間事業者による信書の送達に関する法律（平成十四年法律第九十九号）第二条第六項に規定する一般信書便事業者若しくは同条第九項に規定する特定信書便事業者による同条第二項に規定する信書便により送付し、電報を送達し、ファクシミリ装置若しくは電磁的方法（電子情報処理組織を使用する方法その他の情報通信の技術を利用する方法であって個人情報保護委員会規則で定めるものをいう。）を用いて送信し、又は住居を訪問するために、当該仮名加工情報に含まれる連絡先その他の情報を利用してはならない。
The provisions of Article 17, paragraph (2), Article 26 and Articles 32 through 39 do not apply regarding pseudonymized personal information, personal data that constitutes pseudonymized personal information, and personal data the business holds that constitutes pseudonymized personal information.