Article 42Restrictions on Provision of Pseudonymized Personal Information to Third Parties
第四十二条（仮名加工情報の第三者提供の制限等）
Except in cases based on laws and regulations, businesses handling pseudonymized personal information must not provide pseudonymized personal information (excluding those that constitute personal information; the same applies in the following paragraph and paragraph (3)) to a third party.
The provisions of Article 27, paragraphs (5) and (6) apply mutatis mutandis to a person receiving pseudonymized personal information. In this case, the term "each preceding paragraph" in Article 27, paragraph (5) is deemed to be replaced with "Article 42, paragraph (1)"; the term "business handling personal information" in item (i) of the paragraph is deemed to be replaced with "business handling pseudonymized personal information"; the phrase "notifies the person identifiable by that data of this in advance as well as the details of that data, the extent of the joint users, the users' purpose of use, and the name and address of the person responsible for managing the personal data, and, if the user is corporation, the name of its representative; or the business makes the foregoing information readily accessible to the person identifiable by that data in advance" in item (iii) of the paragraph is deemed to be replaced with "disclose this in advance as well as the details of that data, the extent of the joint users, the users' purpose of use, and the name and address of the person responsible for managing the personal data, and, if the user is corporation, the name of its representative"; the term "business handling personal information" in Article 27, paragraph (6) is deemed to be replaced with "businesses handling pseudonymized personal information", and the phrase " notify the person identifiable by that data of this or make this readily accessible to the person identifiable by that data, without delay" is deemed to be replaced with "disclose this without delay" in Article 27, paragraph (6).
The provisions of Articles 23 through 25, Article 40, and paragraphs (7) and (8) of the preceding Article apply mutatis mutandis to the handling of pseudonymized personal information by a business handling pseudonymized personal information. In this case, the phrase "leaking, loss or damage" in Article 23 is deemed to be replaced with "leaking"; and the term "not" in Article 41, paragraph (7) is replaced with "neither acquire deleted or other related information, nor".