Section 1 General Provisions
第一節 総則
第十六条（定義）
"Personal information database or the equivalent" in this Chapter and Chapter VIII means a collective body of information comprised of personal information, as set forth in the following (excluding those prescribed by Cabinet Order as having little possibility of harming individual rights and interests in consideration of how the information is used):
この章及び第八章において「個人情報データベース等」とは、個人情報を含む情報の集合物であって、次に掲げるもの（利用方法からみて個人の権利利益を害するおそれが少ないものとして政令で定めるものを除く。）をいう。
those systematically organized so as to be searchable for particular personal information using a computer;
特定の個人情報を電子計算機を用いて検索することができるように体系的に構成したもの
beyond what is set forth in the preceding item, those prescribed by Cabinet Order as having been systematically organized so as to be easily searchable for particular personal information.
"Business handling personal information" in this Chapter and Chapters VI through VIII means a person that uses a personal information database or the equivalent for business; provided, however, that this excludes persons set forth as follows:
この章及び第六章から第八章までにおいて「個人情報取扱事業者」とは、個人情報データベース等を事業の用に供している者をいう。ただし、次に掲げる者を除く。
national government organs;
国の機関
local governments;
地方公共団体
"Personal data" in this Chapter means personal information compiled in a personal information database or the equivalent.
この章において「個人データ」とは、個人情報データベース等を構成する個人情報をいう。
"Personal data the business holds" in this Chapter means personal data which a business handling personal information has the authority to disclose; to correct, add or delete content from; to cease to use; to erase; or to cease to provide to a third party, other than what Cabinet Order provides for as data which is likely to harm the public interest or other interests if its existence or non-existence is made clear.
この章において「保有個人データ」とは、個人情報取扱事業者が、開示、内容の訂正、追加又は削除、利用の停止、消去及び第三者への提供の停止を行うことのできる権限を有する個人データであって、その存否が明らかになることにより公益その他の利益が害されるものとして政令で定めるもの以外のものをいう。
"Business handling pseudonymized personal information" in this Chapter and Chapters VI and VII means a person that uses a collective body of information consisting of pseudonymized personal information for business, which has been systematically organized to be searchable using a computer or is the equivalent as prescribed by Cabinet Order as systematically organized in order to be easily searchable for particular pseudonymized personal information (referred to as a "pseudonymized personal information database or the equivalent" in Article 41, paragraph (1)); provided, however, that this excludes persons set forth in each item of paragraph (2).
"Business handling anonymized personal information" in this Chapter and Chapters VI and VII means a person that uses collective body of information consisting of anonymized personal information for business, which has been systematically organized to be searchable using a computer or is the equivalent prescribed by Cabinet Order as systematically organized in order to be easily searchable for particular anonymized personal information (referred to as an "anonymized personal information database or the equivalent" in Article 43, paragraph (1)); provided, however, that this excludes persons set forth in each item of paragraph (2).
"Business handling information related to personal information" in this Chapter and Chapters VI and VII means a person that uses collective body of information consisting of information related to personal information for business, which has been systematically organized to be searchable using a computer or is the equivalent as prescribed by Cabinet Order as systematically organized in order to be easily searchable for particular information related to personal information (referred to as an "database or the equivalent of information related to personal information" in Article 31, paragraph (1)); provided, however, that this excludes persons set forth in each item of paragraph (2).
"Academic research institution or the equivalent" in this Chapter means a university or other organization or group associated with academic studies, or a person belonging to it.
この章において「学術研究機関等」とは、大学その他の学術研究を目的とする機関若しくは団体又はそれらに属する者をいう。
Section 2 Obligations of Businesses Handling Personal Information and Businesses handling Information Related to Personal Information
第二節 個人情報取扱事業者及び個人関連情報取扱事業者の義務
Article 17Specifying the Purpose of Use
第十七条（利用目的の特定）
In handling personal information, the business handling personal information must specify as much as possible the purpose for which it uses that information (hereinafter referred to as the "purpose of use").
個人情報取扱事業者は、個人情報を取り扱うに当たっては、その利用の目的（以下「利用目的」という。）をできる限り特定しなければならない。
When altering the purpose of use, businesses handling personal information must not alter it beyond the extent that can be appreciably linked to what it was before the alteration.
個人情報取扱事業者は、利用目的を変更する場合には、変更前の利用目的と関連性を有すると合理的に認められる範囲を超えて行ってはならない。
Article 18Restriction Due to Purpose of use
第十八条（利用目的による制限）
A business handling personal information must not handle personal information beyond the scope necessary for achieving the purpose of use specified pursuant to the provisions of the preceding Article without obtaining the identifiable person's consent to do so in advance.
If, due to a merger or other such circumstances, a business handling personal information acquires personal information when succeeding to the business of another business handling personal information, it must not handle that personal information beyond the scope necessary for achieving the pre-succession purpose of use for that personal information without obtaining the identifiable person's consent to do so in advance.
The provisions of the preceding two paragraphs do not apply in the following cases:
前二項の規定は、次に掲げる場合については、適用しない。
cases based on laws and regulations (including local ordinances; hereinafter the same applies in this Chapter);
法令（条例を含む。以下この章において同じ。）に基づく場合
cases in which there is a need to protect the life, wellbeing, or property of an individual, and it is difficult to obtain the consent of the identifiable person;
人の生命、身体又は財産の保護のために必要がある場合であって、本人の同意を得ることが困難であるとき。
cases in which there is a special need to improve public wellbeing or promote healthy child development, and it is difficult to obtain the consent of the identifiable person;
公衆衛生の向上又は児童の健全な育成の推進のために特に必要がある場合であって、本人の同意を得ることが困難であるとき。
cases in which there is a need to cooperate with a national government organ, local government, or person entrusted thereby with performing the functions prescribed by laws and regulations, and obtaining the consent of the identifiable person is likely to interfere with the performance of those functions;
国の機関若しくは地方公共団体又はその委託を受けた者が法令の定める事務を遂行することに対して協力する必要がある場合であって、本人の同意を得ることにより当該事務の遂行に支障を及ぼすおそれがあるとき。
cases in which the business handling personal information is an academic research institution or the equivalent, and needs to handle the personal information for the purpose of using it in academic research (hereinafter referred to as "academic research purposes" in this Chapter) (including cases in which a part of the purpose of handling the personal information is for academic research purposes, and excluding cases in which there is a risk of unjustly infringing on individual rights and interests);
cases in which personal data is provided to an academic research institution or the equivalent, and they need to handle the personal data for academic research purposes (including cases in which a part of the purpose of handling the personal data is for academic research purposes, and excluding cases in which there is a risk of unjustly infringing on individual rights and interests).
Article 19Prohibition of Inappropriate Use
第十九条（不適正な利用の禁止）
A business handling personal information must not utilize personal information in a way that there is a possibility of fomenting or inducing unlawful or unjust act.
個人情報取扱事業者は、違法又は不当な行為を助長し、又は誘発するおそれがある方法により個人情報を利用してはならない。
第二十条（適正な取得）
A business handling personal information must not acquire personal information by deception or other wrongful means.
個人情報取扱事業者は、偽りその他不正の手段により個人情報を取得してはならない。
A business handling personal information must not acquire sensitive personal information without obtaining the identifiable person's consent in advance, except cases set forth in the following:
cases based on laws and regulations;
法令に基づく場合
cases in which there is a need to protect the life, wellbeing, or property of an individual, and it is difficult to obtain the consent of the identifiable person;
人の生命、身体又は財産の保護のために必要がある場合であって、本人の同意を得ることが困難であるとき。
cases in which there is a special need to improve public wellbeing or promote healthy child development, and it is difficult to obtain the consent of the identifiable person;
公衆衛生の向上又は児童の健全な育成の推進のために特に必要がある場合であって、本人の同意を得ることが困難であるとき。
cases in which there is a need to cooperate with a national government organ, local government, or person entrusted thereby with performing the functions prescribed by laws and regulations, and the consent of the identifiable person is likely to interfere with the performance of those functions;
国の機関若しくは地方公共団体又はその委託を受けた者が法令の定める事務を遂行することに対して協力する必要がある場合であって、本人の同意を得ることにより当該事務の遂行に支障を及ぼすおそれがあるとき。
cases in which the business handling personal information is an academic research institution or the equivalent, and needs to handle the sensitive personal information for academic research purposes (including cases in which a part of the purpose of handling the sensitive personal information is for academic research purposes, and excluding cases in which there is a risk of unjustly infringing on individual rights and interests);
cases of acquiring the sensitive personal information from an academic research institution or the equivalent and it is necessary to acquire that information for academic research purpose (including cases in which a part of the purpose of acquiring the sensitive personal information is for academic research purposes, excluding cases in which there is a risk of unjustly infringing on individual rights and interests) (limited to cases in which the business handling personal information and the academic research institution or the equivalent jointly conduct academic research);
cases in which the sensitive personal information is open to the public by a person identifiable by that information, a national government organ, a local government, an academic research institution or the equivalent, a person set forth in each item of Article 57, paragraph (1), or other person prescribed by Order of the Personal Information Protection Commission;
other cases prescribed by Cabinet Order as equivalent to the cases set forth in each preceding item.
その他前各号に掲げる場合に準ずるものとして政令で定める場合
Article 21Notification of a Purpose of Use when Acquiring Personal Information
第二十一条（取得に際しての利用目的の通知等）
Unless the purpose of use has already been disclosed to the public, a business handling personal information must promptly notify the identifiable person of that purpose of use or disclose this to the public once it has acquired personal information.
Notwithstanding the provisions of the preceding paragraph, a business handling personal information must explicitly specify the purpose of use to the identifiable person, before acquiring their personal information which appears in a written agreement or other document (this includes an electronic or magnetic record; hereinafter the same applies in this paragraph) as a result of concluding an agreement with that person; or acquiring their personal information which appears in a document, directly from the person in question; provided, however, that this does not apply if there is an urgent necessity to dispense with this requirement in order to protect the life, wellbeing, or property of an individual.
If a business handling personal information alters the purpose of use, it must notify identifiable persons of the altered purpose of use or disclose this to the public.
The provisions of the preceding three paragraphs do not apply in the following cases:
前三項の規定は、次に掲げる場合については、適用しない。
notifying the identifiable person of the purpose of use or disclosing this to the public is likely to harm the life, wellbeing, property, or other rights or interests of the identifiable person or a third party;
notifying the identifiable person of the purpose of use or disclosing this to the public is likely to harm the rights or legitimate interests of the business handling personal information;
it is necessary for the business to cooperate with a national government organ or a local government in performing the functions prescribed by laws and regulations, and notifying the identifiable person of the purpose of use or disclosing this to the public is likely to interfere with the performance of those functions;
the purpose of use is considered to be clear, in light of the circumstances in which the personal information is acquired.
取得の状況からみて利用目的が明らかであると認められる場合
Article 22Maintaining the Accuracy of Data
第二十二条（データ内容の正確性の確保等）
Businesses handling personal information must endeavor to keep the content of personal data accurate and up to date, within the scope necessary for achieving the purpose of use, and delete the personal data without delay if they no longer require it.
Businesses handling personal information must take the necessary and appropriate measures for managing the security of personal data including preventing the leaking, loss or damage of the personal data they handle.
個人情報取扱事業者は、その取り扱う個人データの漏えい、滅失又は毀損の防止その他の個人データの安全管理のために必要かつ適切な措置を講じなければならない。
Article 24Supervision of Employees
第二十四条（従業者の監督）
In having an employee handle personal data, businesses handling personal information must exercise the necessary and adequate supervision over that employee to ensure the secure management of the personal data.
個人情報取扱事業者は、その従業者に個人データを取り扱わせるに当たっては、当該個人データの安全管理が図られるよう、当該従業者に対する必要かつ適切な監督を行わなければならない。
Article 25Supervision of an Entrusted Person
第二十五条（委託先の監督）
If a business handling personal information entrusts another person with all or part of the handling of personal data, it must exercise the necessary and adequate supervision over the person it entrusts, so as to ensure the secure management of the personal data with whose handling it entrusts that person.
個人情報取扱事業者は、個人データの取扱いの全部又は一部を委託する場合は、その取扱いを委託された個人データの安全管理が図られるよう、委託を受けた者に対する必要かつ適切な監督を行わなければならない。