第二十六条（漏えい等の報告等）
Pursuant to Order of the Personal Information Protection Commission, businesses handling personal information must report leaks, loss or damage and other situations concerning the security of the personal data they handle, which are prescribed by Order of the Personal Information Protection Commission as those likely to harm individual rights and interests, to the Personal Information Protection Commission; provided, however, that this does not apply to cases in which another business handling personal information or administrative entity has entrusted the business in question with all or part of the handling of the personal data, and it has notified that other business handling personal information or administrative entity of the situation as prescribed by Order of the Personal Information Protection Commission.
In cases prescribed in the preceding paragraph, businesses handling personal information (excluding those that have given a notice under the proviso of that paragraph) must notify the identifiable person of the occurrence of the situation, pursuant to Order of the Personal Information Protection Commission; provided, however, that this does not apply if it is difficult to notify the identifiable person of that occurrence, and the necessary alternative measures are taken to protect that person's rights and interests.
Businesses handling personal information must not provide personal data to a third party without obtaining the identifiable person's consent in advance, except cases set forth below:
cases based on laws and regulations;
法令に基づく場合
cases in which there is a need to protect the life, wellbeing, or property of an individual, and it is difficult to obtain the consent of the identifiable person;
人の生命、身体又は財産の保護のために必要がある場合であって、本人の同意を得ることが困難であるとき。
cases in which there is a special need to improve public wellbeing or promote healthy child development, and it is difficult to obtain the consent of the identifiable person;
公衆衛生の向上又は児童の健全な育成の推進のために特に必要がある場合であって、本人の同意を得ることが困難であるとき。
cases in which there is a need to cooperate with a national government organ, local government, or person entrusted thereby with performing the functions prescribed by laws and regulations, and obtaining the consent of the identifiable person is likely to interfere with the performance of those functions.
国の機関若しくは地方公共団体又はその委託を受けた者が法令の定める事務を遂行することに対して協力する必要がある場合であって、本人の同意を得ることにより当該事務の遂行に支障を及ぼすおそれがあるとき。
cases in which the business handling personal information is an academic research institution or the equivalent, and providing the personal data for the purpose of publication of academic research results or teaching is unavoidable (excluding cases in which there is a risk of unjustly infringing on individual rights and interests);
cases in which the business handling personal information is an academic research institution or the equivalent, and needs to provide the personal data for the academic research purpose (including cases in which a part of the purpose of providing the personal data is for academic research purposes, and excluding cases in which there is a risk of unjustly infringing on individual rights and interests) (limited to cases in which the business handling personal information and the third party jointly conduct academic research);
cases in which the third party is an academic research institution or the equivalent, and the third party needs to handle the personal data for academic research purposes (including cases in which a part of the purpose of handling the personal data is for academic research purposes, and excluding cases in which there is a risk of unjustly infringing on individual rights and interests).
Notwithstanding the provisions of the preceding paragraph, if a business handling personal information agrees to cease to provide a third party with any personal data which can be used to identify the identifiable person, at the request of that person; the business notifies that person of the following information in advance or makes that information readily accessible to that person in advance, as provided for by Order of the Personal Information Protection Commission; and the business files a notification of this to the Commission, the business may provide that personal data to a third party; provided, however, that this does not apply to cases in which personal data which is to be provided to a third party is sensitive personal information, has been acquired in violation of the provisions of Article 20, paragraph (1), or has been provided by another business handling personal information pursuant to the provisions of the main clause of this paragraph (including personal data all or part of which has been reproduced or processed):
個人情報取扱事業者は、第三者に提供される個人データについて、本人の求めに応じて当該本人が識別される個人データの第三者への提供を停止することとしている場合であって、次に掲げる事項について、個人情報保護委員会規則で定めるところにより、あらかじめ、本人に通知し、又は本人が容易に知り得る状態に置くとともに、個人情報保護委員会に届け出たときは、前項の規定にかかわらず、当該個人データを第三者に提供することができる。ただし、第三者に提供される個人データが要配慮個人情報又は第二十条第一項の規定に違反して取得されたもの若しくは他の個人情報取扱事業者からこの項本文の規定により提供されたもの（その全部又は一部を複製し、又は加工したものを含む。）である場合は、この限りでない。
the name and address of a business handling personal information that provides personal information to a third party and, if it is a corporation, the name of its representative (or for an organization without legal personality that has made provisions for a representative or manager, the name of the representative or administrator; hereinafter the same applies in this Article, Article 30, paragraph (1), item (i), and Article 32, paragraph (1), item (i));
第三者への提供を行う個人情報取扱事業者の氏名又は名称及び住所並びに法人にあっては、その代表者（法人でない団体で代表者又は管理人の定めのあるものにあっては、その代表者又は管理人。以下この条、第三十条第一項第一号及び第三十二条第一項第一号において同じ。）の氏名
the fact that providing the data to the third party constitutes the purpose of use;
第三者への提供を利用目的とすること。
the details of the personal data it will provide to the third party;
第三者に提供される個人データの項目
the means or manner in which it will acquire the data it provides to the third party;
第三者に提供される個人データの取得の方法
the means or manner in which it will provide the data to the third party;
第三者への提供の方法
the fact that it will cease to provide personal data that can be used to identify the identifiable person to a third party at the request of the identifiable person;
the means of receiving the identifiable person's request;
本人の求めを受け付ける方法
other matters prescribed by Order of the Personal Information Protection Commission as those necessary to protect individual rights and interests.
その他個人の権利利益を保護するために必要なものとして個人情報保護委員会規則で定める事項
If there has been an alteration to the details set forth in item (i) of the preceding paragraph, or businesses handling personal information have ceased to provide personal data pursuant to the provisions of the preceding paragraph, the businesses must notify the identifiable person of this or make this readily accessible to the person, and notify the Personal Information Protection Commission of this, pursuant to Order of the Personal Information Protection Commission, without delay; and if the businesses seek to alter the details set forth in items (iii) through (v), item (vii), or item (viii) of that paragraph, the businesses must do so beforehand.
If a notification under paragraph (2) has been given, the Personal Information Protection Commission must disclose the details relating to the notification pursuant to Order of the Personal Information Protection Commission. The same applies to cases in which a notification under the preceding paragraph has been given.
In the following cases, a person receiving personal data is not to fall under a third party regarding applying the provisions of each preceding paragraph:
the businesses handling personal information entrusts a person with all or part of the handling of personal data within the scope necessary for achieving the purpose of use;
the personal data is provided when a person succeeds to the business due to a merger or other such circumstances;
合併その他の事由による事業の承継に伴って個人データが提供される場合
the personal data is provided to specific persons who have joint use of that data, and the business notifies the person identifiable by that data of this in advance as well as the details of that data, the extent of the joint users, the users' purpose of use, and the name and address of the person responsible for managing the personal data, and, if the user is corporation, the name of its representative; or the business makes the foregoing information readily accessible to the person identifiable by that data in advance.
If there has been an alteration to the name and address of the person responsible for managing the personal data or, in cases of a corporation, to the name of the representative, as provided for in item (iii) of the preceding paragraph, the business handling personal information must notify the person identifiable by that data of this or make this readily accessible to the person identifiable by that data, without delay; and if the business intends to alter a user's purpose of use or the person responsible for the management as provided for in that item, the business must do so beforehand.
Except cases set forth in the items of paragraph (1) of the preceding Article, before businesses handling personal information provide personal data to a third party (excluding a person that establishes a system that conforms to standards prescribed by Order of the Personal Information Protection Commission as necessary for continuously taking measures equivalent to those that a business handling personal information must take concerning the handling of personal data pursuant to the provisions of this Section (referred to as "equivalent measures" in paragraph (3)); hereinafter the same applies in this paragraph, the following paragraph and Article 31, paragraph (1), item (ii)) in a foreign country (meaning a country or region located outside the territory of Japan; hereinafter the same applies in this Article and Article 31, paragraph (1), item (ii)) (excluding those prescribed by Order of the Personal Information Protection Commission as a foreign country that has established a personal information protection system recognized to have equivalent standards to that in Japan regarding the protection of individual rights and interests; hereinafter the same applies in this Article and Article 31, paragraph (1), item (ii)), the businesses must obtain an identifiable person's consent to the effect that the person approves the provision to a third party in a foreign country. In this case, the provisions of the preceding Article do not apply.
個人情報取扱事業者は、外国（本邦の域外にある国又は地域をいう。以下この条及び第三十一条第一項第二号において同じ。）（個人の権利利益を保護する上で我が国と同等の水準にあると認められる個人情報の保護に関する制度を有している外国として個人情報保護委員会規則で定めるものを除く。以下この条及び同号において同じ。）にある第三者（個人データの取扱いについてこの節の規定により個人情報取扱事業者が講ずべきこととされている措置に相当する措置（第三項において「相当措置」という。）を継続的に講ずるために必要なものとして個人情報保護委員会規則で定める基準に適合する体制を整備している者を除く。以下この項及び次項並びに同号において同じ。）に個人データを提供する場合には、前条第一項各号に掲げる場合を除くほか、あらかじめ外国にある第三者への提供を認める旨の本人の同意を得なければならない。この場合においては、同条の規定は、適用しない。
Before intending to obtain the identifiable person's consent pursuant to the provisions of the preceding paragraph, businesses handling personal information must provide that person with information on the personal information protection system of the foreign country, on the measures the third party takes for the protection of personal information, and other information that is to serve as a reference to that person, pursuant to Order of the Personal Information Protection Commission.
When having provided personal data to a third party (limited to a person establishing a system prescribed in paragraph (1)) in a foreign country, businesses handling personal information must take necessary measures to ensure continuous implementation of the equivalent measures by the third party, and provide information on the necessary measures to the identifiable person at the request of that person, pursuant to Order of the Personal Information Protection Commission.
Article 29Preparing of Records on Provision of Personal Data to Third Parties
第二十九条（第三者提供に係る記録の作成等）
When having provided personal data to a third party (excluding a person set forth in each item of Article 16, paragraph (2); hereinafter the same applies in this Article and the following Article (including as applied mutatis mutandis pursuant to Article 31, paragraph (3) following the deemed replacement of terms)), businesses handling personal information must prepare a record pursuant to Order of the Personal Information Protection Commission on the date of the provision of the personal data, the name of the third party, and other matters prescribed by Order of the Personal Information Protection Commission; provided, however, that this does not apply to cases in which the provision of personal data falls under any of the items of Article 27, paragraph (1) or paragraph (5) (or any of the items of Article 27, paragraph (1), in cases of a provision of personal data under paragraph (1) of the preceding Article).
A business handling personal information must keep a record under the preceding paragraph for a period of time prescribed by Order of the Personal Information Protection Commission from the date when it prepared the record.
個人情報取扱事業者は、前項の記録を、当該記録を作成した日から個人情報保護委員会規則で定める期間保存しなければならない。
Article 30Confirmation on Receiving Personal Data from a Third Party
第三十条（第三者提供を受ける際の確認等）
When receiving personal data from a third party, businesses handling personal information must confirm matters set forth in the following pursuant to Order of the Personal Information Protection Commission; provided, however, that this does not apply to cases in which the provision of personal data falls under any of the items of Article 27, paragraph (1) or paragraph (5):
the name and address of the third party and, if the third party is a corporation, the name of its representative;
当該第三者の氏名又は名称及び住所並びに法人にあっては、その代表者の氏名
background of the acquisition of the personal data by the third party.
当該第三者による当該個人データの取得の経緯
If a business handling personal information conducts confirmation under the preceding paragraph, a third party referred to in the preceding paragraph must not deceive the business handling personal information on a matter relating to the confirmation.
When having given confirmation under paragraph (1), a business handling personal information must prepare a record pursuant to Order of the Personal Information Protection Commission on the date when it received the personal data, matters concerning the confirmation, and other matters prescribed by Order of the Personal Information Protection Commission.
Businesses handling personal information must keep a record referred to in the preceding paragraph for a period of time prescribed by Order of the Personal Information Protection Commission from the date when it prepared the record.
個人情報取扱事業者は、前項の記録を、当該記録を作成した日から個人情報保護委員会規則で定める期間保存しなければならない。