Act on the Protection of Personal Information

The purpose of this Act is to protect the rights and interests of individuals while ensuring the smooth and proper management of the processes or services of administrative entities as well as ensuring due consideration of the value of personal information and the fact that the proper and effective application of personal information contributes to the creation of new industries and the realization of a vibrant economic society and an enriched quality life of the Japanese public; by setting forth the basic principles for the proper handling of personal information, creating a governmental basic policy with regard to this, establishing other matters to serve as a basis for measures to protect personal information, and clarifying the responsibilities of the national and local governments and establishing obligations that businesses and administrative entities that handle personal information are required to fulfill in accordance with their circumstances, as well as establishing the Personal Information Protection Commission, in light of the significantly expanding utilization of personal information as digital society evolves.

①"Personal information" in this Act means information relating to a living individual which falls under any of the following items:

②"Individual identification code" in this Act means one prescribed by Cabinet Order which consists of any character, letter, number, symbol or other codes falling under any of the following items:

③"Sensitive personal information" in this Act means personal information as to an identifiable person's race, creed, social status, medical history, criminal record, the fact of having suffered damage by a crime, or other identifiers or their equivalent prescribed by Cabinet Order as those of requiring special care so as not to cause unjust discrimination, prejudice or other disadvantages to that person.

④"Identifiable person" in relation to personal information in this Act means a specific individual identifiable by personal information.

⑤"Pseudonymized personal information" in this Act means information relating to an individual that can be prepared in a way that makes it not possible to identify a specific individual unless collated with other information by taking any of the measures prescribed in each following item in accordance with the divisions of personal information set forth in those items:

⑥"Anonymized personal information" in this Act means information relating to an individual that can be prepared in a way that makes it not possible to identify a specific individual by taking any of the measures prescribed in each following item in accordance with the divisions of personal information set forth in those items; and also make it not possible to restore that personal information:

⑦"Information related to personal information" in this Act means information relating to a living individual which doesn't fall under personal information, pseudonymized personal information and anonymized personal information.

⑧"Administrative organ" in this Act means the following:

⑨"Incorporated administrative agency or other prescribed corporation" in this Act means an incorporated administrative agency as prescribed in Article 2, paragraph (1) of the Act on General Rules for Incorporated Administrative Agency (Act No. 103 of 1999) and the corporation listed in the Appended Table 1.

⑩"Local incorporated administrative agency" in this Act means a local incorporated administrative agency as prescribed in Article 2, paragraph (1) of the Local Incorporated Administrative Agency Act (Act No. 118 of 2003).

⑪"Administrative entity" in this Act means the following organs:

The proper handling of personal information must be pursued in view of the fact that it should be handled prudently in line with the philosophy of respecting the autonomy of the individual.

The national government is responsible for comprehensively developing and implementing the necessary measures to ensure the proper handling of personal information by national government organs, local government organs, incorporated administrative agencies or other prescribed corporations, local incorporated administrative agencies, and businesses in conformity with the purport of this Act.

Local governments are responsible for developing and implementing necessary measures to ensure the proper handling of personal information by local government organs, local incorporated administrative agencies, and businesses within their territory based on its characteristics in conformity with the purport of this Act while considering the consistency with the measures taken by the national government.

The government is to take necessary legislative and other measures to ensure that there are special measures in place to protect personal information whose strict proper handling it is necessary to ensure in order to further protect the rights and interests of individuals, and also take necessary measures in collaboration with the governments of other countries to establish an internationally harmonized system for personal information through cooperation with international organizations and other international frameworks, in view of the nature of the personal information and the way in which it is used.

①The government must establish a basic policy on the protection of personal information (hereinafter referred to as a "basic policy") in order to further comprehensive and integrated measures to protect personal information.

②The basic policy is to provide for the following details:

③The Prime Minister must call for a cabinet decision on the basic policy developed by the Personal Information Protection Commission.

④Following a cabinet decision made under the preceding paragraph, the Prime Minister must disclose the basic policy to the public without delay.

⑤The provisions of the preceding two paragraphs apply mutatis mutandis to amendments to the basic policy.

①The national government is to take necessary measures so as to ensure the proper handling of personal information held by its organs.

②The national government is to take necessary measures so as to ensure the proper handling of personal information held by incorporated administrative agencies or other prescribed corporations.

The national government is to take the necessary measures, such as providing information and formulating guidelines to ensure that local governments and businesses properly and effectively implement the measures that they are required to take, in order to support measures to protect personal information which local governments formulate and implement, and in order to support actions that the people or businesses take to ensure the proper handling of personal information.

The national government is to take the necessary measures to ensure the appropriate and prompt processing of complaints arising between businesses and identifiable persons regarding the handling of personal information.

①The national government is to take the necessary measures to ensure that businesses handling personal information as prescribed in the following Chapter properly do so, by effecting an appropriate division of roles between the national and local governments.

②The national government is to take the necessary measures to ensure the proper handling of personal information by local governments and local incorporated administrative agencies prescribed in Chapter V.

①Local governments are to take the necessary measures in order to ensure the proper handling of personal information their organs hold.

②Local governments are to take the necessary measures in order to ensure the proper handling of personal information held by local incorporated administrative agencies they establish.

Local governments must endeavor to take the necessary measures to support businesses and residents within their territory so as to ensure the proper handling of personal information.

Local governments must endeavor to provide mediation for complaint processing and take other necessary measures to ensure that any complaint arising between a business and an identifiable person regarding the handling of personal information is processed appropriately and promptly.

The national and the local governments are to cooperate with one another in taking measures to protect personal information.

①"Personal information database or the equivalent" in this Chapter and Chapter VIII means a collective body of information comprised of personal information, as set forth in the following (excluding those prescribed by Cabinet Order as having little possibility of harming individual rights and interests in consideration of how the information is used):

②"Business handling personal information" in this Chapter and Chapters VI through VIII means a person that uses a personal information database or the equivalent for business; provided, however, that this excludes persons set forth as follows:

③"Personal data" in this Chapter means personal information compiled in a personal information database or the equivalent.

④"Personal data the business holds" in this Chapter means personal data which a business handling personal information has the authority to disclose; to correct, add or delete content from; to cease to use; to erase; or to cease to provide to a third party, other than what Cabinet Order provides for as data which is likely to harm the public interest or other interests if its existence or non-existence is made clear.

⑤"Business handling pseudonymized personal information" in this Chapter and Chapters VI and VII means a person that uses a collective body of information consisting of pseudonymized personal information for business, which has been systematically organized to be searchable using a computer or is the equivalent as prescribed by Cabinet Order as systematically organized in order to be easily searchable for particular pseudonymized personal information (referred to as a "pseudonymized personal information database or the equivalent" in Article 41, paragraph (1)); provided, however, that this excludes persons set forth in each item of paragraph (2).

⑥"Business handling anonymized personal information" in this Chapter and Chapters VI and VII means a person that uses collective body of information consisting of anonymized personal information for business, which has been systematically organized to be searchable using a computer or is the equivalent prescribed by Cabinet Order as systematically organized in order to be easily searchable for particular anonymized personal information (referred to as an "anonymized personal information database or the equivalent" in Article 43, paragraph (1)); provided, however, that this excludes persons set forth in each item of paragraph (2).

⑦"Business handling information related to personal information" in this Chapter and Chapters VI and VII means a person that uses collective body of information consisting of information related to personal information for business, which has been systematically organized to be searchable using a computer or is the equivalent as prescribed by Cabinet Order as systematically organized in order to be easily searchable for particular information related to personal information (referred to as an "database or the equivalent of information related to personal information" in Article 31, paragraph (1)); provided, however, that this excludes persons set forth in each item of paragraph (2).

⑧"Academic research institution or the equivalent" in this Chapter means a university or other organization or group associated with academic studies, or a person belonging to it.

①In handling personal information, the business handling personal information must specify as much as possible the purpose for which it uses that information (hereinafter referred to as the "purpose of use").

②When altering the purpose of use, businesses handling personal information must not alter it beyond the extent that can be appreciably linked to what it was before the alteration.

①A business handling personal information must not handle personal information beyond the scope necessary for achieving the purpose of use specified pursuant to the provisions of the preceding Article without obtaining the identifiable person's consent to do so in advance.

②If, due to a merger or other such circumstances, a business handling personal information acquires personal information when succeeding to the business of another business handling personal information, it must not handle that personal information beyond the scope necessary for achieving the pre-succession purpose of use for that personal information without obtaining the identifiable person's consent to do so in advance.

③The provisions of the preceding two paragraphs do not apply in the following cases:

A business handling personal information must not utilize personal information in a way that there is a possibility of fomenting or inducing unlawful or unjust act.

①A business handling personal information must not acquire personal information by deception or other wrongful means.

②A business handling personal information must not acquire sensitive personal information without obtaining the identifiable person's consent in advance, except cases set forth in the following:

①Unless the purpose of use has already been disclosed to the public, a business handling personal information must promptly notify the identifiable person of that purpose of use or disclose this to the public once it has acquired personal information.

②Notwithstanding the provisions of the preceding paragraph, a business handling personal information must explicitly specify the purpose of use to the identifiable person, before acquiring their personal information which appears in a written agreement or other document (this includes an electronic or magnetic record; hereinafter the same applies in this paragraph) as a result of concluding an agreement with that person; or acquiring their personal information which appears in a document, directly from the person in question; provided, however, that this does not apply if there is an urgent necessity to dispense with this requirement in order to protect the life, wellbeing, or property of an individual.

③If a business handling personal information alters the purpose of use, it must notify identifiable persons of the altered purpose of use or disclose this to the public.

④The provisions of the preceding three paragraphs do not apply in the following cases:

Businesses handling personal information must endeavor to keep the content of personal data accurate and up to date, within the scope necessary for achieving the purpose of use, and delete the personal data without delay if they no longer require it.

Businesses handling personal information must take the necessary and appropriate measures for managing the security of personal data including preventing the leaking, loss or damage of the personal data they handle.

In having an employee handle personal data, businesses handling personal information must exercise the necessary and adequate supervision over that employee to ensure the secure management of the personal data.

If a business handling personal information entrusts another person with all or part of the handling of personal data, it must exercise the necessary and adequate supervision over the person it entrusts, so as to ensure the secure management of the personal data with whose handling it entrusts that person.

①Pursuant to Order of the Personal Information Protection Commission, businesses handling personal information must report leaks, loss or damage and other situations concerning the security of the personal data they handle, which are prescribed by Order of the Personal Information Protection Commission as those likely to harm individual rights and interests, to the Personal Information Protection Commission; provided, however, that this does not apply to cases in which another business handling personal information or administrative entity has entrusted the business in question with all or part of the handling of the personal data, and it has notified that other business handling personal information or administrative entity of the situation as prescribed by Order of the Personal Information Protection Commission.

②In cases prescribed in the preceding paragraph, businesses handling personal information (excluding those that have given a notice under the proviso of that paragraph) must notify the identifiable person of the occurrence of the situation, pursuant to Order of the Personal Information Protection Commission; provided, however, that this does not apply if it is difficult to notify the identifiable person of that occurrence, and the necessary alternative measures are taken to protect that person's rights and interests.

①Businesses handling personal information must not provide personal data to a third party without obtaining the identifiable person's consent in advance, except cases set forth below:

②Notwithstanding the provisions of the preceding paragraph, if a business handling personal information agrees to cease to provide a third party with any personal data which can be used to identify the identifiable person, at the request of that person; the business notifies that person of the following information in advance or makes that information readily accessible to that person in advance, as provided for by Order of the Personal Information Protection Commission; and the business files a notification of this to the Commission, the business may provide that personal data to a third party; provided, however, that this does not apply to cases in which personal data which is to be provided to a third party is sensitive personal information, has been acquired in violation of the provisions of Article 20, paragraph (1), or has been provided by another business handling personal information pursuant to the provisions of the main clause of this paragraph (including personal data all or part of which has been reproduced or processed):

③If there has been an alteration to the details set forth in item (i) of the preceding paragraph, or businesses handling personal information have ceased to provide personal data pursuant to the provisions of the preceding paragraph, the businesses must notify the identifiable person of this or make this readily accessible to the person, and notify the Personal Information Protection Commission of this, pursuant to Order of the Personal Information Protection Commission, without delay; and if the businesses seek to alter the details set forth in items (iii) through (v), item (vii), or item (viii) of that paragraph, the businesses must do so beforehand.

④If a notification under paragraph (2) has been given, the Personal Information Protection Commission must disclose the details relating to the notification pursuant to Order of the Personal Information Protection Commission. The same applies to cases in which a notification under the preceding paragraph has been given.

⑤In the following cases, a person receiving personal data is not to fall under a third party regarding applying the provisions of each preceding paragraph:

⑥If there has been an alteration to the name and address of the person responsible for managing the personal data or, in cases of a corporation, to the name of the representative, as provided for in item (iii) of the preceding paragraph, the business handling personal information must notify the person identifiable by that data of this or make this readily accessible to the person identifiable by that data, without delay; and if the business intends to alter a user's purpose of use or the person responsible for the management as provided for in that item, the business must do so beforehand.

①Except cases set forth in the items of paragraph (1) of the preceding Article, before businesses handling personal information provide personal data to a third party (excluding a person that establishes a system that conforms to standards prescribed by Order of the Personal Information Protection Commission as necessary for continuously taking measures equivalent to those that a business handling personal information must take concerning the handling of personal data pursuant to the provisions of this Section (referred to as "equivalent measures" in paragraph (3)); hereinafter the same applies in this paragraph, the following paragraph and Article 31, paragraph (1), item (ii)) in a foreign country (meaning a country or region located outside the territory of Japan; hereinafter the same applies in this Article and Article 31, paragraph (1), item (ii)) (excluding those prescribed by Order of the Personal Information Protection Commission as a foreign country that has established a personal information protection system recognized to have equivalent standards to that in Japan regarding the protection of individual rights and interests; hereinafter the same applies in this Article and Article 31, paragraph (1), item (ii)), the businesses must obtain an identifiable person's consent to the effect that the person approves the provision to a third party in a foreign country. In this case, the provisions of the preceding Article do not apply.

②Before intending to obtain the identifiable person's consent pursuant to the provisions of the preceding paragraph, businesses handling personal information must provide that person with information on the personal information protection system of the foreign country, on the measures the third party takes for the protection of personal information, and other information that is to serve as a reference to that person, pursuant to Order of the Personal Information Protection Commission.

③When having provided personal data to a third party (limited to a person establishing a system prescribed in paragraph (1)) in a foreign country, businesses handling personal information must take necessary measures to ensure continuous implementation of the equivalent measures by the third party, and provide information on the necessary measures to the identifiable person at the request of that person, pursuant to Order of the Personal Information Protection Commission.

①When having provided personal data to a third party (excluding a person set forth in each item of Article 16, paragraph (2); hereinafter the same applies in this Article and the following Article (including as applied mutatis mutandis pursuant to Article 31, paragraph (3) following the deemed replacement of terms)), businesses handling personal information must prepare a record pursuant to Order of the Personal Information Protection Commission on the date of the provision of the personal data, the name of the third party, and other matters prescribed by Order of the Personal Information Protection Commission; provided, however, that this does not apply to cases in which the provision of personal data falls under any of the items of Article 27, paragraph (1) or paragraph (5) (or any of the items of Article 27, paragraph (1), in cases of a provision of personal data under paragraph (1) of the preceding Article).

②A business handling personal information must keep a record under the preceding paragraph for a period of time prescribed by Order of the Personal Information Protection Commission from the date when it prepared the record.

①When receiving personal data from a third party, businesses handling personal information must confirm matters set forth in the following pursuant to Order of the Personal Information Protection Commission; provided, however, that this does not apply to cases in which the provision of personal data falls under any of the items of Article 27, paragraph (1) or paragraph (5):

②If a business handling personal information conducts confirmation under the preceding paragraph, a third party referred to in the preceding paragraph must not deceive the business handling personal information on a matter relating to the confirmation.

③When having given confirmation under paragraph (1), a business handling personal information must prepare a record pursuant to Order of the Personal Information Protection Commission on the date when it received the personal data, matters concerning the confirmation, and other matters prescribed by Order of the Personal Information Protection Commission.

④Businesses handling personal information must keep a record referred to in the preceding paragraph for a period of time prescribed by Order of the Personal Information Protection Commission from the date when it prepared the record.

①Except cases set forth in each item of Article 27, paragraph (1), if it is assumed that a third party acquires information related to personal information (limited to those compiled in a database or the equivalent of information related to personal information; hereinafter the same applies in this Chapter and Chapter VI) as personal data, businesses handling information related to personal information must not provide the information related to personal information to the third party without confirming the matters set forth as follows pursuant to Order of the Personal Information Protection Commission:

②The provisions of Article 28, paragraph (3) apply mutatis mutandis to cases in which a business handling information related to personal information provides information related to personal information pursuant to the provisions of the preceding paragraph. In this case, the phrase ", and provide information on the necessary measures to the identifiable person at the request of that person," in Article 28, paragraph (3) is deemed to be replaced with ",".

③The provisions of paragraphs (2) through (4) of the preceding Article apply mutatis mutandis to cases in which a business handling information related to personal information conducts confirmation pursuant to the provisions of paragraph (1). In this case, the phrase "received" in paragraph (3) of the preceding Article is deemed to be replaced with "provided."

①Businesses handling personal information must make the following information about the personal data they hold accessible to identifiable persons (making that information accessible includes providing answers without delay as requested by identifiable persons):

②If an identifiable person requests that a business handling personal information notify that person of the purpose of use of the personal data the business holds that can be used to identify that person, the business must notify the person of this without delay; provided, however, that this does not apply in a case falling under one of the following items:

③If a business handling personal information decides not to notify the identifiable person of the purpose of use of the personal data the business holds as requested pursuant to the preceding paragraph, the business must notify the identifiable person of this without delay.

①An identifiable person may request that a business handling personal information disclose personal data the business holds that can identify that person through electronic or magnetic records or other means as prescribed by Order of the Personal Information Protection Commission.

②When having received a request under the preceding paragraph, a business handling personal information must disclose personal data the business holds to an identifiable person without delay by means that person requests pursuant to the provisions of that paragraph (or by paper-based document, in cases in which disclosing the data by that means would require a costly expenditure or prove otherwise difficult); provided, however, that in cases in which disclosing that data falls under any of each following, all or a part of it may not be disclosed:

③If a business handling personal information decides not to disclose all or part of the personal data the business holds as requested pursuant to the provisions of paragraph (1), if that data does not exist, or if it is difficult to disclose that data by the means the identifiable person requests pursuant to the provisions of that paragraph, the business must notify that person of this without delay.

④If, pursuant to the provisions of any other law or regulation, all or part of the personal data an business holds that can be used to identify an identifiable person is to be disclosed to the identifiable person by a means equivalent to what is prescribed in the main clause of paragraph (2), the provisions of paragraphs (1) and (2) do not apply to either the whole or the relevant part of the personal data the business holds.

⑤The provisions of paragraphs (1) through (3) apply mutatis mutandis to records referred to in Article 29, paragraph (1) and Article 30, paragraph (3) that is related to personal data that can be used to identify the identifiable person (excluding those prescribed by Cabinet Order as likely to harm the public or other interests if its existence or non-existence is made clear; referred to as a "record of provision to a third party" in Article 37, paragraph (2)).

①If the content of personal data a business holds that can be used to identify the identifiable person is not factual, the person may request that the business handling personal information make a correction, addition, or deletion (hereinafter referred to as a "correction" in this Article) on the content of the personal data the business holds.

②Except in cases in which special procedures concerning correction of the content is prescribed by the provisions of other laws or regulations, when a business handling personal information has been requested to make a correction pursuant to the provisions of the preceding paragraph, the business must conduct necessary investigation without delay to the extent necessary to achieve the purpose of use, and based on its result, make corrections to the contents of the personal data the business holds.

③If a business handling personal information has made a correction to all or part of the contents of the personal data the business holds in connection with a request under paragraph (1), or has made a decision not to make a correction, the business must notify the identifiable person to that effect without delay (including the content of a correction, if the business has made it).

①Identifiable persons may request that a business handling personal information cease to use or delete the personal data the business holds that can be used to identify that person (hereinafter referred to as a "ceasing to use or deleting personal data" in this Article), if the personal data the business holds is being handled in violation of the provisions of Article 18 or 19, or has been obtained in violation of the provisions of Article 20.

②If a business handling personal information has received a request under the preceding paragraph, and there are found to be grounds for that request, the business must cease to use or delete the personal data the business holds to the extent necessary to redress the violation without delay; provided, however, that this does not apply if ceasing to use or deleting the personal data the business holds would require a costly expenditure or prove otherwise difficult, and the businesses take the necessary alternative measures to protect the rights and interests of the identifiable person.

③Identifiable persons may request that a business handling personal information cease to provide a third party with the personal data the business holds that can be used to identify the person, if the personal data the business holds is being provided to a third party in violation of the provisions of Article 27, paragraph (1) or Article 28.

④If a business handling personal information has received a request under the preceding paragraph, and there are found to be grounds for that request, the business must cease to provide a third party with the personal data the business holds without delay; provided, however, that this does not apply if ceasing to provide a third party with the personal data the business holds would require a costly expenditure or prove otherwise difficult, and the businesses take the necessary alternative measures to protect an identifiable person's rights and interests.

⑤An identifiable person may request that a business handling personal information cease to use or delete the personal data the business holds that can be used to identify the person, or cease to provide a third party with the personal data the business holds, if it has ceased to be necessary for the business to use that personal data, if the situation concerning that personal data as prescribed in the main text of Article 26, paragraph (1) has occurred, or if handling that personal data is likely to harm the identifiable person's rights and interests.

⑥If a business handling personal information has received a request under the preceding paragraph, and there are found to be grounds for that request, the business must cease to use or delete the personal data the business holds, or cease to provide a third party with the data the business holds to the extent necessary to prevent an infringement of the identifiable person's rights and interests without delay; provided, however, that this does not apply if ceasing to use or deleting the personal data the business holds or ceasing to provide a third-party with that personal data would require a costly expenditure or prove otherwise difficult, and the businesses take the necessary alternative measures to protect the identifiable person's rights and interests.

⑦If a business handling personal information have ceased to use or deleted, or decided not to cease to use or delete all or part of personal data the business holds in connection with a request under paragraph (1) or (5), or the business has ceased to provide a third party or decided not to cease to provide a third party with all or part of personal data the business holds in connection with a request under paragraph (3) or (5), the business must notify the identifiable person to that effect without delay.

If, pursuant to the provisions of Article 32, paragraph (3), Article 33, paragraph (3) (including as applied mutatis mutandis pursuant to paragraph (5) of that Article); Article 34, paragraph (3) or paragraph (7) of the preceding Article, a business handling personal information notifies an identifiable person that it will not take all or part of the measures which the person has requested the business take, or that it will take different measures, the business must endeavor to explain its reasons for this to the person.

①As regards a request under Article 32, paragraph (2), or a request under Article 33, paragraph (1) (including as applied mutatis mutandis pursuant to paragraph (5) of that Article; the same applies in paragraph (1) of the following Article and Article 39), Article 34, paragraph (1), Article 35, paragraph (1), (3), or (5) (hereinafter referred to as a "request for disclosure or other handling" in this Article and Article 54, paragraph (1)), a business handling personal information may decide on a method of receiving a request as prescribed by Cabinet Order. In such a case, an identifiable person must request disclosure or other handling in that way.

②A business handling personal information may request an identifiable person requesting disclosure or other handling to present sufficient information to identify the personal data the business holds or the record of provision to a third party that would be subject to the disclosure or other handling. In such a case, the business handling personal information must provide information to help the person identify the relevant personal data the business holds or the relevant record of provision to a third party, or take other appropriate measures in consideration of the identifiable person's convenience, so as to allow the person to easily and accurately request disclosure or other handling.

③A person may request disclosure or other handling through an agent, as prescribed by Cabinet Order.

④In establishing procedures for dealing with requests for disclosure and other handling pursuant to the preceding three paragraphs, a business handling personal information must take care to ensure that the procedures do not impose an excessive burden on identifiable persons.

①If a business handling personal information receives a request for a notification of the purpose of use under Article 32, paragraph (2) or a request for disclosure under Article 33, paragraph (1), it may collect a fee for taking the relevant measures.

②If a business handling personal information collects a fee pursuant to the provisions of the preceding paragraph, it must fix the amount of that fee within a scope that can be considered reasonable in consideration of actual costs.

①When seeking to file a lawsuit in connection with a request under Article 33, paragraph (1), Article 34, paragraph (1), or Article 35, paragraph (1), (3), or (5), the identifiable person may not file the lawsuit unless the identifiable person had previously issued a request against a person who should become a defendant in the lawsuit and two weeks have elapsed since the arrival day of the issued request; provided, however, that this does not apply if the person who should become a defendant in the lawsuit has rejected the request.

②A request under the preceding paragraph is deemed as having been arrived at the time when it should have normally been arrived.

③The provisions of the preceding two paragraphs apply mutatis mutandis to a petition for a provisional disposition order in connection with a request under Article 33, paragraph (1), Article 34, paragraph (1), or Article 35, paragraph (1), (3), or (5).

①A business handling personal information must endeavor to process complaints about the handling of personal information appropriately and promptly.

②A business handling personal information must endeavor to establish the necessary systems for achieving the purpose referred to in the preceding paragraph.

①When preparing pseudonymized personal information (limited to those compiled in a pseudonymized personal information database or the equivalent; hereinafter the same applies in this Chapter and Chapter VI), businesses handling personal information must process personal information in accordance with standards prescribed by Order of the Personal Information Protection Commission as those necessary to make it impossible to identify a specific individual unless collated with other information.

②When having prepared pseudonymized personal information or having acquired pseudonymized personal information and deleted or other related information (meaning information related to identifiers or their equivalent and individual identification codes that were deleted from personal information used to prepare the pseudonymized personal information, and the means of processing carried out pursuant to the provisions of the preceding paragraph; hereinafter the same applies in this Article and paragraph (7) as applied mutatis mutandis pursuant to paragraph (3) of the following Article following the deemed replacement of terms) related to the pseudonymized information, businesses handling personal information must take measures for the management of the security of deleted or other related information in accordance with standards prescribed by Order of the Personal Information Protection Commission as those necessary to prevent the leaking of deleted or other related information.

③Notwithstanding the provision of Article 18 and except cases based on laws and regulations, a business handling pseudonymized personal information (limited to a business handling personal information; hereinafter the same applies in this Article) must not handle pseudonymized personal information (limited to personal information; hereinafter the same applies in this Article) beyond the necessary scope to achieve the purpose of use specified pursuant to the provisions of Article 17, paragraph (1).

④With regard to applying the provisions of Article 21 related to pseudonymized personal information, the phrase "notify the identifiable person of that purpose of use or disclose this to the public" in paragraphs (1) and (3) of that Article is deemed to be replaced with "disclose that purpose of use"; the phrase "notifying the identifiable person of the purpose of use or disclosing this to the public" in the provisions of items (i) through (iii) of paragraph (4) of that Article is deemed to be replaced with "disclosing the purpose of use".

⑤Businesses handling pseudonymized personal information must endeavor to erase personal data that constitutes pseudonymized personal information and deleted or other related information without delay when utilization of the personal data and the deleted or other related information has become unnecessary. In this case, the provisions of Article 22 do not apply.

⑥Notwithstanding the provisions of Article 27, paragraphs (1) and (2), and Article 28, paragraph (1), and except cases based on laws and regulations, businesses handling pseudonymized personal information must not provide a third party with personal data that constitutes pseudonymized personal information. In this case, the term "each preceding paragraph" in Article 27, paragraph (5) is deemed to be replaced with "Article 41, paragraph (6)"; the phrase "notifies the person identifiable by that data of this in advance as well as the details of that data, the extent of the joint users, the users' purpose of use, and the name and address of the person responsible for managing the personal data, and, if the user is corporation, the name of its representative; or the business makes the foregoing information readily accessible to the person identifiable by that data in advance" in item (iii) of that paragraph is deemed to be replaced with "disclose this in advance as well as the details of that data, the extent of the joint users, the users' purpose of use, and the name and address of the person responsible for managing the personal data, and, if the user is corporation, the name of its representative"; the phrase "notify the person identifiable by that data of this or make this readily accessible to the person identifiable by that data, without delay" in Article 27, paragraph (6) is deemed to be replaced with "disclose this without delay"; the phrase "any of the items of Article 27, paragraph (1) or paragraph (5) (or any of the items of Article 27, paragraph (1), in cases of a provision of personal data under paragraph (1) of the preceding Article)" in the proviso of Article 29, paragraph (1), and the term "any of the items of Article 27, paragraph (1) or paragraph (5)" in the proviso of Article 30, paragraph (1) are deemed to be replaced with "cases based on laws and regulations or any of the items of Article 27, paragraph (5)".

⑦Businesses handling pseudonymized personal information, in handling that information, must not collate the pseudonymized personal information with other information in order to identify a person identifiable by personal information that was used to prepare the pseudonymized personal information.

⑧Businesses handling pseudonymized personal information, in handling that information, must not use contact addresses and other information contained in the pseudonymized personal information for telephoning, for sending by mail or by correspondence delivery prescribed in Article 2, paragraph (2) of the Act on Correspondence Delivery by Private Business Operators (Act No. 99 of 2002) conducted by a general correspondence delivery operator prescribed in Article 2, paragraph (6) or a specified correspondence delivery operator prescribed in Article 2, paragraph (9), for delivering a telegram, for transmitting information using a facsimile machine or electronic or magnetic means (meaning means that use electronic data processing system or means that utilize other information communication technology as prescribed by Order of the Personal Information Protection Commission), or for visiting a residence.

⑨The provisions of Article 17, paragraph (2), Article 26 and Articles 32 through 39 do not apply regarding pseudonymized personal information, personal data that constitutes pseudonymized personal information, and personal data the business holds that constitutes pseudonymized personal information.

①Except in cases based on laws and regulations, businesses handling pseudonymized personal information must not provide pseudonymized personal information (excluding those that constitute personal information; the same applies in the following paragraph and paragraph (3)) to a third party.

②The provisions of Article 27, paragraphs (5) and (6) apply mutatis mutandis to a person receiving pseudonymized personal information. In this case, the term "each preceding paragraph" in Article 27, paragraph (5) is deemed to be replaced with "Article 42, paragraph (1)"; the term "business handling personal information" in item (i) of the paragraph is deemed to be replaced with "business handling pseudonymized personal information"; the phrase "notifies the person identifiable by that data of this in advance as well as the details of that data, the extent of the joint users, the users' purpose of use, and the name and address of the person responsible for managing the personal data, and, if the user is corporation, the name of its representative; or the business makes the foregoing information readily accessible to the person identifiable by that data in advance" in item (iii) of the paragraph is deemed to be replaced with "disclose this in advance as well as the details of that data, the extent of the joint users, the users' purpose of use, and the name and address of the person responsible for managing the personal data, and, if the user is corporation, the name of its representative"; the term "business handling personal information" in Article 27, paragraph (6) is deemed to be replaced with "businesses handling pseudonymized personal information", and the phrase " notify the person identifiable by that data of this or make this readily accessible to the person identifiable by that data, without delay" is deemed to be replaced with "disclose this without delay" in Article 27, paragraph (6).

③The provisions of Articles 23 through 25, Article 40, and paragraphs (7) and (8) of the preceding Article apply mutatis mutandis to the handling of pseudonymized personal information by a business handling pseudonymized personal information. In this case, the phrase "leaking, loss or damage" in Article 23 is deemed to be replaced with "leaking"; and the term "not" in Article 41, paragraph (7) is replaced with "neither acquire deleted or other related information, nor".

①When preparing anonymized personal information (limited to those compiled in an anonymized personal information database or the equivalent; hereinafter the same applies in this Chapter and Chapter VI), businesses handling personal information must process personal information in accordance with standards prescribed by Order of the Personal Information Protection Commission as those necessary to make it impossible to identify a specific individual and restore the information to its original state.

②When having prepared anonymized personal information, businesses handling personal information must take measures for the management of the security of information relating to identifiers or their equivalent and individual identification codes that were deleted from personal information used to prepare the anonymized personal information, and information on the means of processing carried out pursuant to the provisions of the preceding paragraph, in accordance with standards prescribed by Order of the Personal Information Protection Commission as those necessary to prevent the leaking of that information.

③When having prepared anonymized personal information, businesses handling personal information must disclose the categories of information on an individual that is contained in the anonymized personal information, pursuant to Order of the Personal Information Protection Commission.

④Businesses handling personal information, before providing anonymized personal information it prepared to a third party, must disclose the categories of information on an individual that is contained in the anonymized personal information the business will provide to the third party, and the means of providing this, and state to the third party explicitly that the information the business will provide is anonymized personal information, pursuant to Order of the Personal Information Protection Commission.

⑤Businesses handling personal information, when handling anonymized personal information it prepared by itself, must not collate the anonymized personal information with other information in order to identify a person identifiable by personal information that was used to prepare that anonymized personal information.

⑥When having prepared anonymized personal information, businesses handling personal information must endeavor to take the necessary and appropriate measures for managing the security of the anonymized personal information, and the necessary measures for processing complaints about the preparation or other handling of the anonymized personal information, or for otherwise ensuring the proper handling of the anonymized personal information; and endeavor to disclose the content of those measures.

Businesses handling anonymized personal information, before providing anonymized personal information (excluding those into which they have processed personal information themselves; hereinafter the same applies in this Section) to a third party, must disclose the categories of information on an individual that is contained in the anonymized personal information it will provide to the third party, and the means of providing this, and state to the third party explicitly that the information it will provide is anonymized personal information, pursuant to Order of the Personal Information Protection Commission.

Businesses handling anonymized personal information, when handling anonymized personal information, must neither acquire information relating to identifiers or their equivalent or individual identification codes deleted from the personal information and information relating to methods of processing carried out pursuant to the provisions of Article 43, paragraph (1) or Article 116, paragraph (1) (including cases in which it is applied mutatis mutandis pursuant to Article 116, paragraph (2)), nor collate the anonymized personal information with other information in order to identify a person identifiable by personal information that was used to prepare that anonymized personal information.

Businesses handling anonymized personal information must endeavor to take the necessary and appropriate measures for managing the security of anonymized personal information and the necessary measures to ensure the proper handling of anonymized personal information such as processing complaints about the handling of anonymized personal information, and must endeavor to disclose the content of those measures.

①A corporation (or an organization without legal personality that has made provisions for a representative or manager; the same applies in item (iii), (b) of the following Article) seeking to perform services as set forth in one of the following items with the aim of ensuring that a business handling personal information, pseudonymized personal information, or anonymized personal information (hereinafter referred to as "personal or other related information" in this Chapter) (the business in question is hereinafter referred to as a "business handling personal or other related information" in this Chapter) handles the personal information properly may receive certification from the Personal Information Protection Commission:

②The certification set forth in the preceding paragraph may be limited in respect of the type or scope of services of businesses handling personal or other related information that are covered.

③A person seeking the certification referred to in paragraph (1) must apply to the Personal Information Protection Commission as prescribed by Cabinet Order.

④After granting a certification under paragraph (1), the Personal Information Protection Commission must make a public notice to that effect (including the scope of services concerning the certification, in cases of the certification limiting the scope of services pursuant to the provisions of paragraph (2)).

A person falling under one of the following items may not be certified as referred to in paragraph (1) of the preceding Article:

The Personal Information Protection Commission must not grant a certification unless it finds the application for certification referred to in Article 47, paragraph (1) to conform to all of the following requirements:

①If a person that has received certification under Article 47, paragraph (1) (including that limiting the scope of services pursuant to the provisions of paragraph (2) of that Article; the same applies in paragraph (1) of the following Article and Article 155, paragraph (1), item (v)) seeks to alter the scope of services concerning the certification, the person must receive certification from the Personal Information Protection Commission; provided, however, that this does not apply to a minor alteration as prescribed by Order of the Personal Information Protection Commission.

②The provisions of Article 47, paragraphs (3) and (4) and the preceding Article apply mutatis mutandis to the certification of alteration referred to in the preceding paragraph.

①Before intending to discontinue the services subject to certification (hereinafter referred to as "certified services" in this Section and Chapter VI), a person that has received certification under Article 47, paragraph (1) (including the certification of alteration under paragraph (1) of the preceding Article) (the person in question is hereinafter referred to as a "certified personal information protection organization" in this Section and Chapter VI) must notify the Personal Information Protection Commission to that effect as prescribed by Cabinet Order.

②Upon receiving notification under the preceding paragraph, the Personal Information Protection Commission must issue public notice indicating this.

①A certified personal information protection organization's covered businesses must be comprised of businesses handling personal or other related information that have agreed to be covered by its certified services. In this case, if a covered business does not comply with the personal information protection guidelines prescribed in Article 54, paragraph (1) even though measures pursuant to Article 54, paragraph (4) were taken, the covered business may be excluded from being covered by the certified services.

②A certified personal information protection organization must disclose the names of its covered businesses.

①If an identifiable person or other party files for a certified personal information protection organization to resolve a complaint about the handling of personal or other related information by a covered business, in addition to complying with any request for a consultation about this, providing the identifiable person or other party with the necessary advice, and investigating the circumstances to which the complaint pertains, the organization must notify the covered business of the substance and content of the complaint and request that it resolve the complaint expeditiously.

②If a certified personal information protection organization finds that it is necessary in connection with the resolution of a complaint under a filing referred to in the preceding paragraph, the organization may request that the covered business provide a written or oral explanation or submit materials.

③If a covered business has received a request under the preceding paragraph from a certified personal information protection organization, it must not refuse this request without a legitimate reason for doing so.

①In order to ensure the proper handling of personal or other related information by its covered businesses, a certified personal information protection organization must endeavor to create guidelines which follow the spirit of this Act (hereinafter referred to as "personal information protection guidelines" in this Section and Chapter VI), for how to specify the purpose of use of personal information, for measures to ensure its secure management, for procedures to deal with requests for disclosure or other handling, for other such matters, as well as how to produce pseudonymized processed information or anonymized personal information, and its security measures and other such matters, by listening to the opinions of representatives of customers or other relevant persons.

②When having developed personal information protection guidelines pursuant to the provisions of the preceding paragraph, certified personal information protection organizations must notify the Personal Information Protection Commission of the personal information protection guidelines without delay pursuant to Order of the Personal Information Protection Commission. The same applies if the guidelines are modified.

③When having been notified of personal information protection guidelines under the preceding paragraph, the Personal Information Protection Commission must disclose the personal information protection guidelines pursuant to Order of the Personal Information Protection Commission.

④When personal information protection guidelines have been disclosed pursuant to the provisions of the preceding paragraph, certified personal information protection organizations must take measures against a covered business such as providing guidance or recommendations necessary to make the covered business comply with the personal information protection guidelines.

A certified personal information protection organization must not use information acquired in the course of certified services for purposes other than the certified services use for which the information is provided.

A person that is not a certified personal information protection organization must not use a name that refers to that person as a certified personal information protection organization, and must not use any other name that is confusingly similar to this.

①The provisions of this Chapter do not apply to a business handling personal or other related information or business handling information related to personal information as set forth in one of the following items if all or part of the purpose for which it handles the information in question is the purpose prescribed in that item:

②The "news reporting" prescribed in item (i) of the preceding paragraph means informing the general public of objective facts by presenting them as the truth (this includes stating an opinion or position based on those facts).

③A business handling personal or other related information as set forth in one of the items of paragraph (1) must, itself, endeavor to take the necessary and appropriate measures for managing the security of personal data, pseudonymized personal information or anonymized personal information, and the necessary measures for processing complaints about the handling of personal or other related information and for otherwise ensuring the proper handling of personal or other related information and must also endeavor to disclose the content of those measures.

①The provisions of Articles 32 through 39 and Section 4 do not apply to a business handling personal information or a business handling anonymized personal information set forth as follows:

②The handling of personal information, pseudonymized personal information, or information related to personal information conducted by a person set forth in each following items in the business prescribed in each item is deemed to be the handling of personal information by a business handling personal information, the handling of pseudonymized personal information by a business handling pseudonymized personal information, or the handling of information related to personal information by a business handling information related to personal information; and the provisions in this Chapter (excluding Articles 32 through 39 and Section 4) and Chapters VI through VIII apply to it:

Academic research organizations or the equivalent which are businesses handling personal information must endeavor to comply with the provisions of this Act as well as personally take necessary measures for ensuring the appropriate handling of personal information for academic research purposes, and endeavor to the public the content of those measures.

①"Personal information the administrative entity holds" in this Chapter and Chapter VIII means personal information that an employee of an administrative entity (in a case of an incorporated administrative agency or other prescribed corporation or a local incorporated administrative agency, its officer is included; hereinafter the same applies in this Chapter and Chapter VIII) prepares or acquires in the course of that employee's duties, and that administrative entity holds for organizational use by its employees; provided, however, that the personal information the administrative entity holds is limited to personal information recorded in administrative or similar documents (meaning administrative documents prescribed in Article 2, paragraph (2) of the Act on Access to Information Held by Administrative Organs (Act No. 42 of 1999; hereinafter referred to as the "Administrative Organs Information Disclosure Act" in this Chapter)), corporate documents (meaning corporate documents prescribed in Article 2, paragraph (2) of the Act on Access to Information Held by Incorporated Administrative Agencies (Act No. 140 of 2001); hereinafter referred to as "Incorporated Administrative Agencies Information Disclosure Act" in this Chapter; those documents include those listed in item (iv) of that paragraph), or local government documents (meaning documents, drawings, or electronic or magnetic records that an employee of a local government organ or local incorporated administrative agency prepares or acquires in the course of that employee's duties, and that local government organ or local incorporated administrative agency holds for organizational use by its employees; and excluding those prescribed by Cabinet Order as equivalent to those set forth in the items of Article 2, paragraph (2) of the Administrative Organs Information Disclosure Act) (the above-mentioned documents are hereinafter collectively referred to as "administrative or similar documents" in this Chapter).

②"Personal information file" in this Chapter and Chapter VIII means a collective body of information comprised of personal information the administrative entity holds, as set forth below:

③"Anonymized personal information the administrative entity holds" in this Chapter means any anonymized personal information that can be prepared in a way that processes all or a part of personal information the administrative entity holds that constitutes a personal information file that falls under all of the following items (if a part of that personal information the administrative entity holds contains non-disclosure information prescribed in Article 5 of the Administrative Organs Information Disclosure Act (excluding information listed in item (i) of that Article, and including information prescribed in the proviso of item (ii) of that Article; hereinafter the same applies in this paragraph), non-disclosure information prescribed in Article 5 of the Incorporated Administrative Agencies Information Disclosure Act (excluding information listed in item (i) of that Article, and including information prescribed in the proviso of item (ii) of that Article), or non-disclosure information prescribed in the information disclosure ordinance of local government (meaning a local government's ordinance which provides for the resident's or other equivalent person's right to request the disclosure of information the local government organ or local incorporated administrative agency holds; hereinafter the same applies in this Chapter) (that non-disclosure information means information equivalent to non-disclosure information prescribed in Article 5 of the Administrative Organs Information Disclosure Act), the part containing the above-mentioned non-disclosure information is excluded):

④The term "anonymized personal information file the administrative entity holds" in this Chapter means a collective body of information comprised of anonymized personal information the administrative entity holds, as set forth below:

⑤The term "sensitive personal information prescribed by local ordinance" in this Chapter means personal information (excluding sensitive personal information) that is held by a local government organ or local incorporated administrative agency and that is comprised of identifiers or their equivalent prescribed by a local government's ordinance, accounting for the regional characteristics and other circumstances, as those of which the handling requires special care so as not to cause unfair discrimination, prejudice, or other disadvantage to the identifiable person.

①Administrative entities may hold personal information only when necessary for conducting processes and functions under the jurisdiction provided by laws and regulations (including local ordinances; the same applies in Article 66, paragraph (2), items (iii) and (iv), Article 69, paragraph (2), items (ii) and (iii), and Section 4), and must specify the purpose of use of personal information as much as possible when holding this information.

②Administrative entities must not hold personal information beyond the extent necessary for the purpose of use specified pursuant to the provisions of the preceding paragraph.