This Act comes into effect as of the date specified by Cabinet Order within a period not exceeding 2 years from the date of promulgation; provided, however, that the provisions set forth in the following items come into effect as of the dates specified respectively in those items.

A person that intends to provide personal data to a third party pursuant to the provisions of Article 23, paragraph (2) of the Act on the Protection of Personal Information as amended by Article 2 (hereinafter referred to as the "New Act on the Protection of Personal Information") may, even before the date on which this Act comes into effect (hereinafter referred to as "the Effective Date"), as provided by Order of the Personal Information Protection Commission, notify the identifiable person of matters equivalent to those set forth in item (v) of that paragraph and file a notification with the Personal Information Protection Commission of matters equivalent to those set forth in the items of that paragraph. In this case, that notice and notification are deemed, on or after the Effective Date, to be the notice and notification under the provisions of that paragraph.

If there is consent concerning the handling of personal information on the identifiable person that was given before the Effective Date, and that consent is equivalent to consent to the effect of permitting the provision of personal data to a third party in a foreign country under the provisions of Article 24 of the New Act on the Protection of Personal Information, the consent referred to in that Article is deemed to have been given.

①Recommendations, orders or other dispositions, or notices or other acts, made before the Effective Date, pursuant to the provisions of the Act on the Protection of Personal Information prior to its amendment by Article 2 (hereinafter referred to as the "Former Act on the Protection of Personal Information") or of orders based on it, by the competent minister prescribed in Article 36 or Article 49 of the Former Act on the Protection of Personal Information (hereinafter simply referred to as the "competent minister" in this Article) are deemed, on or after the Effective Date, to be recommendations, orders or other dispositions, or notices or other acts, made by the Personal Information Protection Commission pursuant to the corresponding provisions of the New Act on the Protection of Personal Information or of orders based on it.

②Applications, notifications, or other acts that have actually been made to the competent minister at the time this Act comes into effect pursuant to the provisions of the Former Act on the Protection of Personal Information or of orders based on it are deemed, on or after the Effective Date, to be applications, notifications, or other acts made to the Personal Information Protection Commission pursuant to the corresponding provisions of the New Act on the Protection of Personal Information or of orders based on it.

③With regard to a matter for which a notification or other procedure must be carried out with the competent minister before the Effective Date pursuant to the provisions of the Former Act on the Protection of Personal Information or of orders based on it, and for which that procedure has not been carried out before the Effective Date, on or after the Effective Date, those corresponding provisions apply by deeming that matter to be a matter for which that procedure must be carried out with the Personal Information Protection Commission pursuant to the corresponding provisions of the New Act on the Protection of Personal Information or of orders based on it and for which that procedure has not been carried out.

①A person who is serving as the chairperson or a commissioner of the former Specific Personal Information Protection Commission at the time the provisions set forth in Article 1, item (ii) of the Supplementary Provisions come into effect is deemed to have been appointed, on the item (ii) Effective Date, as the chairperson or a commissioner, respectively, of the Personal Information Protection Commission pursuant to the provisions of Article 54, paragraph (3) of the Act on the Protection of Personal Information as amended by Article 1 (hereinafter referred to as the "item (ii) New Personal Information Protection Act" in this Article). In this case, notwithstanding the provisions of Article 55, paragraph (1) of the item (ii) New Personal Information Protection Act, the term of office of the person deemed to have been so appointed is to be a period equal to the respective remaining term of office of that person as the chairperson or a commissioner of the former Specific Personal Information Protection Commission as of the item (ii) Effective Date.

②With regard to the commissioners of the Personal Information Protection Commission who are to be newly appointed upon the enforcement of the provisions set forth in Article 1, item (ii) of the Supplementary Provisions, acts necessary for the appointment of commissioners prescribed in Article 54, paragraph (3) of the item (ii) New Personal Information Protection Act may be carried out even before the item (ii) Effective Date.

③A person who is serving as a member of the secretarial staff of the former Specific Personal Information Protection Commission at the time the provisions set forth in Article 1, item (ii) of the Supplementary Provisions come into effect is to become a corresponding member of the secretarial staff of the Personal Information Protection Commission on the item (ii) Effective Date, under the same working conditions, unless otherwise notified by a letter of appointment.

With regard to the application of penal provisions to acts committed before this Act (or, for the provisions set forth in Article 1, item (ii) of the Supplementary Provisions, those provisions) comes into effect and to acts committed on or after the item (ii) Effective Date in the cases where the provisions then in force continue to govern pursuant to the preceding Article, the provisions then in force continue to govern.

Beyond what is provided for in these Supplementary Provisions, transitional measures necessary for the enforcement of this Act are specified by Cabinet Order.

In formulating the guidelines prescribed in Article 8 of the New Act on the Protection of Personal Information to ensure that businesses, etc. properly and effectively implement the measures that they are required to take, the Personal Information Protection Commission is to give consideration so that the business activities of small-scale businesses in particular are carried out smoothly, in view of the fact that persons listed in Article 2, paragraph (3), item (v) of the Former Act on the Protection of Personal Information newly become businesses handling personal information upon the enforcement of this Act.

①By the Effective Date, the Government is to, in light of the purpose of the provisions of the New Act on the Protection of Personal Information, review how the handling of the personal information as set forth in Article 2, paragraph (2) of the Act on the Protection of Personal Information Held by Administrative Organs that is held by administrative organs as set forth in paragraph (1) of that Article and of the personal information as set forth in Article 2, paragraph (2) of the Act on the Protection of Personal Information Held by Incorporated Administrative Agencies, etc. (Act No. 59 of 2003) that is held by incorporated administrative agencies or other prescribed corporations as set forth in paragraph (1) of that Article (hereinafter collectively referred to as "personal information held by administrative organs, etc." in this Article) should be regulated, including having the Personal Information Protection Commission give guidance, advice, etc. in a unified and cross-cutting manner concerning the handling of anonymized personal information the administrative entity holds, from the perspective of promoting the smooth and prompt use of anonymized personal information (meaning anonymized personal information as set forth in Article 2, paragraph (9) of the New Act on the Protection of Personal Information, and including anonymized personal information the administrative entity holds (meaning anonymized personal information obtained by processing personal information held by administrative organs, etc.; the same applies hereinafter in this paragraph)), and take required measures based on the results.

②The Government is to, around three years after this Act comes into effect, review the improvement of the formulation and promotion of the basic policy on the protection of personal information and the other functions under the jurisdiction of the Personal Information Protection Commission, taking into consideration the status of the development of the personnel structure, the securing of financial resources and other measures necessary to carry out those functions effectively, and, if it finds it necessary, take required measures based on the results.

③In addition to the matters provided for in the preceding paragraph, the Government is to, around three years after this Act comes into effect, review the status of the enforcement of the New Act on the Protection of Personal Information, taking into consideration international trends concerning the protection of personal information, the advancement of information and communications technology, the status of the creation and development of new industries utilizing personal information that accompany that advancement, etc., and, if it finds it necessary, take required measures based on the results.

④The Government is to, around three years after the provisions set forth in Article 1, item (vi) of the Supplementary Provisions come into effect, review measures for financial institutions as set forth in Article 2, paragraph (1) of the Deposit Insurance Act (Act No. 34 of 1971) to be appropriately provided with Individual Numbers by depositors, etc. as set forth in paragraph (3) of that Article, or for agricultural and fishery cooperatives as set forth in Article 2, paragraph (1) of the Agricultural and Fishery Cooperatives Savings Insurance Act (Act No. 53 of 1973) to be appropriately provided with Individual Numbers by savers, etc. as set forth in paragraph (3) of that Article, and the status of the enforcement of the Number Use Act as amended by Article 7, and, if it finds it necessary, take required measures based on the results while gaining citizens' understanding.

⑤In view of the importance of the precise formulation and implementation of measures concerning cybersecurity (meaning cybersecurity as set forth in Article 2 of the Basic Act on Cybersecurity (Act No. 104 of 2014)) in ensuring the security of personal information held by national administrative entities, the Government is to review the development, etc. of systems for the formulation and implementation of measures at national administrative entities based on the standards set forth in Article 13 of that Act, and take required measures based on the results.

⑥The Government is to, in light of the status of the enforcement of the New Act on the Protection of Personal Information, the status of the implementation of the measures referred to in paragraph (1), and other circumstances, review what the legal system concerning the protection of personal information should be, including consolidating the provisions concerning the protection of personal information as set forth in Article 2, paragraph (1) of the New Act on the Protection of Personal Information and of personal information held by administrative organs, etc., and providing for them in an integrated manner.