This Act comes into effect on September 1, 2021; provided, however, that the provisions set forth in the following items come into effect on the dates specified in those items:

①If there is consent of the identifiable person concerning the handling of personal information on the identifiable person that was given, before the date of enforcement of the provisions of Article 50 (hereinafter referred to as the "Article 50 Effective Date" in this Article), to an Appended Table 2 corporation or the equivalent (meaning a corporation listed in Appended Table 2 of the Act on the Protection of Personal Information as Amended by Article 50; the Japan Organization of Occupational Health and Safety that is deemed, pursuant to Article 58, paragraph (2) of the Act on the Protection of Personal Information as Amended by Article 50, to be a business handling personal information prescribed in Article 16, paragraph (2) of the Act on the Protection of Personal Information as Amended by Article 50, a business handling pseudonymized personal information prescribed in paragraph (5) of that Article, or a business handling information related to personal information prescribed in paragraph (7) of that Article; or a business handling personal information prescribed in paragraph (2) of that Article that is an academic research institution or the equivalent prescribed in paragraph (8) of that Article; the same applies hereinafter in this Article), and that consent is equivalent to consent to the effect of permitting the handling of personal information for a purpose other than the purpose of use specified pursuant to the provisions of Article 17, paragraph (1) of the Act on the Protection of Personal Information as Amended by Article 50, the consent referred to in Article 18, paragraph (1) or (2) of the Act on the Protection of Personal Information as Amended by Article 50 is deemed to have been given on the Article 50 Effective Date.

②If there is consent of the identifiable person concerning the handling of personal information on the identifiable person that was given to an Appended Table 2 corporation or the equivalent before the Article 50 Effective Date, and that consent is equivalent to consent to the effect of permitting the provision of personal data to a third party pursuant to the provisions of Article 27, paragraph (1) of the Act on the Protection of Personal Information as Amended by Article 50, the consent referred to in that paragraph is deemed to have been given on the Article 50 Effective Date.

③An Appended Table 2 corporation or the equivalent that intends to provide personal data to a third party pursuant to the provisions of Article 27, paragraph (2) of the Act on the Protection of Personal Information as Amended by Article 50 may, even before the Article 50 Effective Date, as provided by Order of the Personal Information Protection Commission, notify the identifiable person of matters equivalent to those set forth in the items of that paragraph and file a notification of them with the Personal Information Protection Commission. In this case, that notice and notification are deemed to be the notice and notification under the provisions of that paragraph on or after the Article 50 Effective Date.

④If, before the Article 50 Effective Date, an Appended Table 2 corporation or the equivalent has notified the identifiable person of matters equivalent to the matters that must be notified to the identifiable person or made readily accessible to the identifiable person pursuant to the provisions of Article 27, paragraph (5), item (iii) of the Act on the Protection of Personal Information as Amended by Article 50, that notice is deemed to be the notice under the provisions of that item on or after the Article 50 Effective Date.

⑤If there is consent of the identifiable person concerning the handling of personal information on the identifiable person that was given to an Appended Table 2 corporation or the equivalent before the Article 50 Effective Date, and that consent is equivalent to consent to the effect of permitting the provision of personal data to a third party in a foreign country pursuant to the provisions of Article 28, paragraph (1) of the Act on the Protection of Personal Information as Amended by Article 50, the consent referred to in that paragraph is deemed to have been given on the Article 50 Effective Date.

⑥The provisions of Article 28, paragraph (2) of the Act on the Protection of Personal Information as Amended by Article 50 apply to cases in which an Appended Table 2 corporation or the equivalent obtains the consent of the identifiable person pursuant to the provisions of Article 28, paragraph (1) of the Act on the Protection of Personal Information as Amended by Article 50 on or after the Article 50 Effective Date.

⑦The provisions of Article 28, paragraph (3) of the Act on the Protection of Personal Information as Amended by Article 50 apply to cases in which an Appended Table 2 corporation or the equivalent provides personal data, on or after the Article 50 Effective Date, to a third party in a foreign country prescribed in that paragraph.

⑧If there is consent of the identifiable person concerning the handling of information related to personal information on the identifiable person that was given to an Appended Table 2 corporation or the equivalent before the Article 50 Effective Date, and that consent is equivalent to consent to the effect of permitting the provision of information related to personal information to a third party pursuant to the provisions of Article 31, paragraph (1), item (i) of the Act on the Protection of Personal Information as Amended by Article 50, the consent referred to in that item is deemed to have been given on the Article 50 Effective Date.

⑨The provisions of Article 28, paragraph (3) of the Act on the Protection of Personal Information as Amended by Article 50, which are applied mutatis mutandis with terms replaced pursuant to Article 31, paragraph (2) of the Act on the Protection of Personal Information as Amended by Article 50, apply to cases in which an Appended Table 2 corporation or the equivalent provides information related to personal information, on or after the Article 50 Effective Date, to a third party in a foreign country prescribed in Article 28, paragraph (3) of the Act on the Protection of Personal Information as Amended by Article 50.

⑩If there is consent of the identifiable person concerning the handling of personal information on the identifiable person that was given, before the Article 50 Effective Date, to an administrative entity prescribed in Article 2, paragraph (11) of the Act on the Protection of Personal Information as Amended by Article 50 (excluding the Japan Organization of Occupational Health and Safety that is deemed, pursuant to Article 58, paragraph (2) of the Act on the Protection of Personal Information as Amended by Article 50, to be a business handling personal information prescribed in Article 16, paragraph (2) of the Act on the Protection of Personal Information as Amended by Article 50; hereinafter referred to as the "administrative entity" in this Article), and that consent is equivalent to consent to the effect of permitting the personal use or provision of personal information the administrative entity holds for a purpose other than the purpose of use specified pursuant to the provisions of Article 61, paragraph (1) of the Act on the Protection of Personal Information as Amended by Article 50, the consent referred to in Article 69, paragraph (2), item (i) of the Act on the Protection of Personal Information as Amended by Article 50 is deemed to have been given on the Article 50 Effective Date.

⑪If there is consent of the identifiable person concerning the handling of personal information on the identifiable person that was given to an administrative entity before the Article 50 Effective Date, and that consent is equivalent to consent to the effect of permitting the provision of personal information the administrative entity holds to a third party in a foreign country pursuant to the provisions of Article 71, paragraph (1) of the Act on the Protection of Personal Information as Amended by Article 50, the consent referred to in that paragraph is deemed to have been given on the Article 50 Effective Date.

⑫The provisions of Article 71, paragraph (2) of the Act on the Protection of Personal Information as Amended by Article 50 apply to cases in which an administrative entity obtains the consent of the identifiable person pursuant to the provisions of Article 71, paragraph (1) of the Act on the Protection of Personal Information as Amended by Article 50 on or after the Article 50 Effective Date.

⑬The provisions of Article 71, paragraph (3) of the Act on the Protection of Personal Information as Amended by Article 50 apply to cases in which an administrative entity provides personal information the administrative entity holds, on or after the Article 50 Effective Date, to a third party in a foreign country prescribed in that paragraph.

⑭Regarding the application of Article 74, paragraph (1) of the Act on the Protection of Personal Information as Amended by Article 50 to a personal information file prescribed in Article 60, paragraph (2) of the Act on the Protection of Personal Information as Amended by Article 50 that an administrative organ prescribed in Article 2, paragraph (8) of the Act on the Protection of Personal Information as Amended by Article 50 actually holds on the Article 50 Effective Date, the phrase "intends to hold" in that paragraph is deemed to be replaced with "holds", and the term "Before" is deemed to be replaced with "Promptly after the enforcement of Article 50 of the Act on the Arrangement of Related Acts for the Formation of a Digital Society (Act No. 37 of 2021), when".

①The national government, in order to ensure the proper handling, under the provisions of the Act on the Protection of Personal Information as Amended by Article 51 (hereinafter referred to as the "Act on the Protection of Personal Information as Amended by Article 51" in this Article, the following Article and Article 10, paragraph (1) of the Supplementary Provisions), of personal information that local government organs and local incorporated administrative agencies hold, is to, after ascertaining the state of implementation of the preparatory acts necessary for the enforcement of the Act on the Protection of Personal Information as Amended by Article 51 in local government organs and local incorporated administrative agencies by requesting local governments to submit necessary materials or by other means, give technical advice or recommendations on those preparatory acts if it finds it necessary.

②Notification under the provisions of Article 167, paragraph (1) of the Act on the Protection of Personal Information as Amended by Article 51 may also be made before the date of enforcement of the provisions of Article 51 (referred to as the "Article 51 Effective Date" in the following Article).

①If there is consent of the identifiable person concerning the handling of personal information on the identifiable person that was given, before the Article 51 Effective Date, to a specified local incorporated administrative agency or the equivalent (meaning a person listed in Article 58, paragraph (1), item (ii) of the Act on the Protection of Personal Information as Amended by Article 51, or a person listed in Article 58, paragraph (2), item (i) of the Act on the Protection of Personal Information as Amended by Article 51 that is deemed, pursuant to paragraph (2) of that Article, to be a business handling personal information prescribed in Article 16, paragraph (2) of the Act on the Protection of Personal Information as Amended by Article 51, a business handling pseudonymized personal information prescribed in paragraph (5) of that Article, or a business handling information related to personal information prescribed in paragraph (7) of that Article; the same applies hereinafter in this Article), and that consent is equivalent to consent to the effect of permitting the handling of personal information for a purpose other than the purpose of use specified pursuant to the provisions of Article 17, paragraph (1) of the Act on the Protection of Personal Information as Amended by Article 51, the consent referred to in Article 18, paragraph (1) or (2) of the Act on the Protection of Personal Information as Amended by Article 51 is deemed to have been given on the Article 51 Effective Date.

②If there is consent of the identifiable person concerning the handling of personal information on the identifiable person that was given to a specified local incorporated administrative agency or the equivalent before the Article 51 Effective Date, and that consent is equivalent to consent to the effect of permitting the provision of personal data to a third party pursuant to the provisions of Article 27, paragraph (1) of the Act on the Protection of Personal Information as Amended by Article 51, the consent referred to in that paragraph is deemed to have been given on the Article 51 Effective Date.

③A specified local incorporated administrative agency or the equivalent that intends to provide personal data to a third party pursuant to the provisions of Article 27, paragraph (2) of the Act on the Protection of Personal Information as Amended by Article 51 may, even before the Article 51 Effective Date, as provided by Order of the Personal Information Protection Commission, notify the identifiable person of matters equivalent to those set forth in the items of that paragraph and file a notification of them with the Personal Information Protection Commission. In this case, that notice and notification are deemed to be the notice and notification under the provisions of that paragraph on or after the Article 51 Effective Date.

④If, before the Article 51 Effective Date, a specified local incorporated administrative agency or the equivalent has notified the identifiable person of matters equivalent to the matters that must be notified to the identifiable person or made readily accessible to the identifiable person pursuant to the provisions of Article 27, paragraph (5), item (iii) of the Act on the Protection of Personal Information as Amended by Article 51, that notice is deemed to be the notice under the provisions of that item on or after the Article 51 Effective Date.

⑤If there is consent of the identifiable person concerning the handling of personal information on the identifiable person that was given to a specified local incorporated administrative agency or the equivalent before the Article 51 Effective Date, and that consent is equivalent to consent to the effect of permitting the provision of personal data to a third party in a foreign country pursuant to the provisions of Article 28, paragraph (1) of the Act on the Protection of Personal Information as Amended by Article 51, the consent referred to in that paragraph is deemed to have been given on the Article 51 Effective Date.

⑥The provisions of Article 28, paragraph (2) of the Act on the Protection of Personal Information as Amended by Article 51 apply to cases in which a specified local incorporated administrative agency or the equivalent obtains the consent of the identifiable person pursuant to the provisions of Article 28, paragraph (1) of the Act on the Protection of Personal Information as Amended by Article 51 on or after the Article 51 Effective Date.

⑦The provisions of Article 28, paragraph (3) of the Act on the Protection of Personal Information as Amended by Article 51 apply to cases in which a specified local incorporated administrative agency or the equivalent provides personal data, on or after the Article 51 Effective Date, to a third party in a foreign country prescribed in that paragraph.

⑧If there is consent of the identifiable person concerning the handling of information related to personal information on the identifiable person that was given to a specified local incorporated administrative agency or the equivalent before the Article 51 Effective Date, and that consent is equivalent to consent to the effect of permitting the provision of information related to personal information to a third party pursuant to the provisions of Article 31, paragraph (1), item (i) of the Act on the Protection of Personal Information as Amended by Article 51, the consent referred to in that item is deemed to have been given on the Article 51 Effective Date.

⑨The provisions of Article 28, paragraph (3) of the Act on the Protection of Personal Information as Amended by Article 51, which are applied mutatis mutandis with terms replaced pursuant to Article 31, paragraph (2) of the Act on the Protection of Personal Information as Amended by Article 51, apply to cases in which a specified local incorporated administrative agency or the equivalent provides information related to personal information, on or after the Article 51 Effective Date, to a third party in a foreign country prescribed in Article 28, paragraph (3) of the Act on the Protection of Personal Information as Amended by Article 51.

⑩If there is consent of the identifiable person concerning the handling of personal information on the identifiable person that was given, before the Article 51 Effective Date, to a person listed in Article 2, paragraph (11), item (ii) or (iv) of the Act on the Protection of Personal Information as Amended by Article 51 (excluding a person listed in Article 58, paragraph (2), item (i) of the Act on the Protection of Personal Information as Amended by Article 51 that is deemed, pursuant to Article 58, paragraph (2) of the Act on the Protection of Personal Information as Amended by Article 51, to be a business handling personal information prescribed in Article 16, paragraph (2) of the Act on the Protection of Personal Information as Amended by Article 51; the same applies hereinafter in this Article), and that consent is equivalent to consent to the effect of permitting the personal use or provision of personal information the administrative entity holds for a purpose other than the purpose of use specified pursuant to the provisions of Article 61, paragraph (1) of the Act on the Protection of Personal Information as Amended by Article 51, the consent referred to in Article 69, paragraph (2), item (i) of the Act on the Protection of Personal Information as Amended by Article 51 is deemed to have been given on the Article 51 Effective Date.

⑪If there is consent of the identifiable person concerning the handling of personal information on the identifiable person that was given, before the Article 51 Effective Date, to a person listed in Article 2, paragraph (11), item (ii) or (iv) of the Act on the Protection of Personal Information as Amended by Article 51, and that consent is equivalent to consent to the effect of permitting the provision of personal information the administrative entity holds to a third party in a foreign country pursuant to the provisions of Article 71, paragraph (1) of the Act on the Protection of Personal Information as Amended by Article 51, the consent referred to in that paragraph is deemed to have been given on the Article 51 Effective Date.

⑫The provisions of Article 71, paragraph (2) of the Act on the Protection of Personal Information as Amended by Article 51 apply to cases in which a person listed in Article 2, paragraph (11), item (ii) or (iv) of the Act on the Protection of Personal Information as Amended by Article 51 obtains the consent of the identifiable person pursuant to the provisions of Article 71, paragraph (1) of the Act on the Protection of Personal Information as Amended by Article 51 on or after the Article 51 Effective Date.

⑬The provisions of Article 71, paragraph (3) of the Act on the Protection of Personal Information as Amended by Article 51 apply to cases in which a person listed in Article 2, paragraph (11), item (ii) or (iv) of the Act on the Protection of Personal Information as Amended by Article 51 provides personal information the administrative entity holds, on or after the Article 51 Effective Date, to a third party in a foreign country prescribed in Article 71, paragraph (3) of the Act on the Protection of Personal Information as Amended by Article 51.

①The part concerning the relevant act of a provision of a local government's Prefectural or Municipal Ordinance that provides for the punishment of an act regulated by the Act on the Protection of Personal Information as Amended by Article 51 ceases to be effective at the same time as the provisions of Article 51 come into effect.

②In the case where a provision of a Prefectural or Municipal Ordinance ceases to be effective pursuant to the provisions of the preceding paragraph, if the local government concerned does not provide otherwise by Prefectural or Municipal Ordinance, with regard to the punishment of violations committed before the provision ceases to be effective, the provisions then in force continue to govern even after it ceases to be effective.

With regard to the application of penal provisions to acts committed before this Act (or, for the provisions set forth in the items of Article 1 of the Supplementary Provisions, those provisions; the same applies hereinafter in this Article) comes into effect and to acts committed after this Act comes into effect in the cases where the provisions then in force continue to govern pursuant to the provisions of these Supplementary Provisions, the provisions then in force continue to govern.

Beyond what is provided for in these Supplementary Provisions, the transitional measures necessary in connection with the enforcement of this Act (including transitional measures concerning penal provisions) are specified by Cabinet Order.

In order to make it possible to identify an individual by using the individual's name written in hiragana or katakana in applications, notifications, notices of dispositions, and other procedures relating to administrative entities, the Government is to consider specific measures for this, including making an individual's name written in hiragana or katakana a matter to be entered in the family register, aiming to do so within one year after the promulgation of this Act, and is to take necessary measures based on the results.