1/53

Act on the Protection of
Personal Information Tentativetranslation
Act No. 57 of May 30, 2003
Chapter I General Provisions(Purpose)
Article 1 This Act aims to protect anindividual's rights and interests whileconsidering the utility of personal
information including that the proper andeffective application of personal information
contributes to the creation of new industries
and the realization of a vibrant economic
society and an enriched quality of life for thepeople of Japan; by setting forth the overall
vision for the proper handling of personal
information, creating a governmental basic
policy with regard to this, and establishingother matters to serve as a basis for measures
to protect personal information, as well as byclarifying the responsibilities etc. of thecentral and local governments andestablishing obligations etc. that a personal
information handling business operator shallfulfill, in light of the significantly expanded
utilization of personal information as ouradvanced information- and communicationbased society evolves.
(Definition)
Article 2 "Personal information" in this Act

means that information relating to a living
individual which falls under any of eachfollowing item:(i) those containing a name, date of birth, orother descriptions etc. (meaning any andall matters (excluding an individual
identification code) stated, recorded orotherwise expressed using voice,movement or other methods in a

http://www.japaneselawtranslation.go.jp/law/detail_print

2018/05/14

2/53
document, drawing or electromagnetic
record (meaning a record kept in anelectromagnetic form (meaning anelectronic, magnetic or other forms thatcannot be recognized through the humansenses; the same shall apply in the
succeeding paragraph, item (ii)); the same
shall apply in Article 18, paragraph (2));
hereinafter the same) whereby a specificindividual can be identified (including
those which can be readily collated withother information and thereby identify a
specific individual)(ii) those containing an individual

identification code
(2) An "individual identification code" in thisAct means those prescribed by cabinet orderwhich are any character, letter, number,symbol or other codes falling under any ofeach following item.
(i) those able to identify a specificindividual that are a character, letter,number, symbol or other codes into whicha bodily partial feature of the specificindividual has been converted in order tobe provided for use by computers(ii) those character, letter, number, symbol

or other codes which are assigned inregard to the use of services provided to anindividual or to the purchase of goods soldto an individual, or which are stated orelectromagnetically recorded in a card orother document issued to an individual so
as to be able to identify a specific user orpurchaser, or recipient of issuance byhaving made the said codes differently
assigned or, stated or recoded for the saiduser or purchaser, or recipient of issuance(3) "Special care-required personal

information" in this Act means personal
information comprising a principal's race,
creed, social status, medical history, criminal

http://www.japaneselawtranslation.go.jp/law/detail_print

2018/05/14

3/53
record, fact of having suffered damage by acrime, or other descriptions etc. prescribedby cabinet order as those of which thehandling requires special care so as not tocause unfair discrimination, prejudice orother disadvantages to the principal.
(4) A "personal information database etc." inthis Act means those set forth in thefollowing which are a collective body of
information comprising personal information(excluding those prescribed by cabinet orderas having little possibility of harming an
individual's rights and interests considering
their utilization method).
(i) those systematically organized so as tobe able to search for particular personal
information using a computer;(ii) besides those set forth in the preceding

item, those prescribed by cabinet order as
having been systematically organized so
as to be able to easily search for particularpersonal information.
(5) A "personal information handling business

operator" in this Act means a person
providing a personal information databaseetc. for use in business; however, excluding aperson set forth in the following;(i) a central government organization;(ii) a local government;(iii) an incorporated administrative agency

etc. (meaning an independentadministrative agency etc. prescribed in
Article 2, paragraph (1) of the Act on theProtection of Personal Information Heldby Incorporated Administrative Agencies(Act No. 59 of 2003); hereinafter thesame);(iv) a local incorporated administrative

agency (meaning a local incorporated
administrative agency prescribed in

http://www.japaneselawtranslation.go.jp/law/detail_print

2018/05/14

4/53
Article 2, paragraph (1) of the Local
Incorporated Administrative Agencies Act(Act No. 118 of 2003); hereinafter thesame);(6) "Personal data" in this Act means personal

information constituting a personal
information database etc.
(7) "Retained personal data" in this Act means

personal data which a personal information
handling business operator has the authority
to disclose, correct, add or delete thecontents of, cease the utilization of, erase,and cease the third-party provision of, andwhich shall be neither those prescribed bycabinet order as likely to harm the public orother interests if their presence or absence ismade known nor those set to be deleted
within a period of no longer than one yearthat is prescribed by cabinet order.
(8) A "principal" in relation to personal

information in this Act means a specificindividual identifiable by personal
information.
(9) "Anonymously processed information" inthis Act means information relating to anindividual that can be produced fromprocessing personal information so as neither
to be able to identify a specific individual bytaking action prescribed in each following
item in accordance with the divisions of
personal information set forth in each said
item nor to be able to restore the personal
information.
(i) personal information falling underparagraph (1), item (i); Deleting a part ofdescriptions etc. contained in the said
personal information (including replacing
the said part of descriptions etc. with otherdescriptions etc. using a method with noregularity that can restore the said part ofdescriptions etc.)

http://www.japaneselawtranslation.go.jp/law/detail_print

2018/05/14

5/53(ii) personal information falling underparagraph (1), item (ii); Deleting all
individual identification codes containedin the said personal information (including
replacing the said individual identification
codes with other descriptions etc. using amethod with no regularity that can restore
the said personal identification codes)(10) An "anonymously processed information

handling business operator" in this Act
means a person who provides for use inbusiness a collective body of information
comprising anonymously processed
information which has been systematicallyorganized so as to be able to search using acomputer for specific anonymously
processed information or similar othersprescribed by cabinet order as systematicallyorganized so as to be able to search easily forspecific anonymously processed information(referred to as an "anonymously processed
information database etc." in Article 36,
paragraph (1)). However, a person set forthin each item of paragraph (5) is excluded.
(Overall Vision)
Article 3 Personal information, considering it

should be carefully handled under the visionof respecting the personality of an individual,
shall be made subject to proper handling.
Chapter II Responsibilities etc. of theCentral and Local Governments(Responsibilities of the Central Government)
Article 4 The central government shall havethe responsibilities for comprehensively
developing and implementing necessary
measures to ensure the proper handling of
personal information in conformity with the
purport of this Act.
(Responsibilities of the Local Governments)

http://www.japaneselawtranslation.go.jp/law/detail_print

2018/05/14

6/53
Article 5 The local governments shall have theresponsibilities for developing andimplementing necessary measures to ensure
the proper handling of personal information
based on the characteristics of their local
area in conformity with the purport of thisAct.
(Legislative Action etc.)
Article 6 The government shall, considering

the nature and utilization method of personal
information, take necessary legislative andother action so as to be able to take discreet
action for protecting personal informationthat especially requires ensuring the strict
implementation of its proper handling inorder to seek enhanced protection of anindividual's rights and interests, and shalltake necessary action in collaboration withthe governments in other countries toconstruct an internationally conformablesystem concerning personal information
through fostering cooperation with aninternational organization and otherinternational framework.
Chapter III Measures etc. for theProtection of Personal Information
Section 1 Basic Policy on theProtection of Personal Information
Article 7 The government shall establish abasic policy on the protection of personal
information (hereinafter referred to as a"basic policy") in order to seek tocomprehensively and integrally promotemeasures concerning the protection of
personal information.
(2) A basic policy shall prescribe those mattersset forth in the following.
(i) a basic direction for promoting measuresconcerning the protection of personal
information

http://www.japaneselawtranslation.go.jp/law/detail_print

2018/05/14

7/53(ii) a matter concerning action to be takenby the central government for theprotection of personal information(iii) a basic matter concerning action to betaken by a local government for theprotection of personal information(iv) a basic matter concerning action to betaken by an incorporated administrative
agency etc. for the protection of personal
information(v) a basic matter concerning action to betaken by a local incorporated
administrative agency for the protection of
personal information(vi) a basic matter concerning action to betaken by a personal information handlingbusiness operator, an anonymously
processed information handling business
operator and an accredited personal
information protection organizationprescribed in Article 50, paragraph (1) forthe protection of personal information(vii) a matter concerning dealing smoothlywith a complaint about the handling of
personal information(viii) other important matters concerning

promoting measures for the protection of
personal information.
(3) The Prime Minister shall call for a cabinet

decision on a basic policy developed by the
Personal Information Protection
Commission.
(4) The Prime Minister shall, when a cabinet

decision was made pursuant to the provisionsof the preceding paragraph, disclose a basic
policy to the public without delay.
(5) The provisions under the preceding two

paragraphs shall apply mutatis mutandis
when altering a basic policy.

http://www.japaneselawtranslation.go.jp/law/detail_print

2018/05/14

8/53
Section 2 Measures by the Central
Government(Support to a Local Government etc.)
Article 8 The central government shall provide

information, develop guidelines to ensure theproper and effective implementation ofaction to be taken by a business operator etc.,
and take other necessary action in order tosupport measures for the protection of
personal information developed or
implemented by a local government andactivities undertaken by a Japanese citizen,
or a business operator etc. in relation toseeking the proper handling of personal
information.
(Action for Dealing with a Complaint)
Article 9 The central government shall takenecessary action to seek the proper andprompt dealing of a complaint caused
between a business operator and a principal
about the handling of personal information.
(Action for Ensuring the Proper Handling of
Personal Information)
Article 10 The central government shall,through the appropriate division of roles
between a local government and itself, takenecessary action prescribed in the succeeding
Chapter in order to ensure the proper
handling of personal information by apersonal information handling business
operator.
Section 3 Measures by the Local
Governments(Protection of Personal Information Retainedby a Local Government etc.)
Article 11 A local government shall,considering the nature of personal
information it retains, the purpose ofretaining the personal information, and so on,
strive to take necessary action so as to ensure

http://www.japaneselawtranslation.go.jp/law/detail_print

2018/05/14

9/53
the proper handling of the retained personal
information.
(2) A local government shall, in response to

the characteristics and business contents of a
local incorporated administrative agency thatit has established, strive to take necessary
action so as to ensure the proper handling of
personal information that the agency retains.
(Support to a Business Operator etc. in a
Local Area)
Article 12 A local government shall, in orderto ensure the proper handling of personal
information, strive to take necessary action
to support a business operator and a resident
in a local area.
(Mediation etc. for Dealing with aComplaint)
Article 13 A local government shall, in order

for a complaint caused between a business
operator and a principal about the handlingof personal information to be dealt withappropriately and promptly, strive to mediate
dealing with the complaint and take othernecessary action.
Section 4 Cooperation between theCentral and Local Governments
Article 14 The central and local governments

shall cooperate with one another in
implementing measures relating to theprotection of personal information.
Chapter IV Obligations etc. of a
Personal Information HandlingBusiness Operator
Section 1 Obligations of a Personal
Information Handling Business
Operator(Specifying a Utilization Purpose)

http://www.japaneselawtranslation.go.jp/law/detail_print

2018/05/14

10/53
Article 15 A personal information handlingbusiness operator shall, in handling personal
information, specify the purpose of utilizing
the personal information (hereinafter referred
to as a "utilization purpose") as explicitly as
possible.
(2) A personal information handling business

operator shall, in case of altering a utilization
purpose, not do so beyond the scope
recognized reasonably relevant to the prealtered utilization purpose.
(Restriction due to a Utilization Purpose)
Article 16 A personal information handlingbusiness operator shall not handle personal
information without obtaining in advance a
principal's consent beyond the necessary
scope to achieve a utilization purpose
specified pursuant to the provisions under thepreceding Article.
(2) A personal information handling business

operator shall, in case of having acquired
personal information accompanied withsucceeding a business from another personal
information handling business operator
because of a merger or other reason, nothandle the personal information withoutobtaining in advance a principal's consent
beyond the necessary scope to achieve thepre-succession utilization purpose of the said
personal information.
(3) The provisions under the preceding two

paragraphs shall not apply to those cases set
forth in the following.
(i) cases based on laws and regulations(ii) cases in which there is a need to protect

a human life, body or fortune, and when it
is difficult to obtain a principal's consent(iii) cases in which there is a special need toenhance public hygiene or promote

http://www.japaneselawtranslation.go.jp/law/detail_print

2018/05/14

11/53fostering healthy children, and when it isdifficult to obtain a principal's consent(iv) cases in which there is a need tocooperate in regard to a central
government organization or a local
government, or a person entrusted by them
performing affairs prescribed by laws andregulations, and when there is a possibility
that obtaining a principal's consent wouldinterfere with the performance of the saidaffairs(Proper Acquisition)
Article 17 A personal information handlingbusiness operator shall not acquire personal
information by deceit or other impropermeans.
(2) A personal information handling business

operator shall, except in those cases set forthin the following, not acquire special carerequired personal information withoutobtaining in advance a principal's consent.
(i) cases based on laws and regulations(ii) cases in which there is a need to protect

a human life, body or fortune, and when it
is difficult to obtain a principal's consent(iii) cases in which there is a special need toenhance public hygiene or promote
fostering healthy children, and when it isdifficult to obtain a principal's consent(iv) cases in which there is a need tocooperate in regard to a central
government organization or a local
government, or a person entrusted by them
performing affairs prescribed by laws andregulations, and when there is a possibility
that obtaining a principal's consent wouldinterfere with the performance of the saidaffairs(v) cases in which the said special care-required personal information is being

http://www.japaneselawtranslation.go.jp/law/detail_print

2018/05/14

12/53open to the public by a principal, agovernment organization, a local
government, a person set forth in each
item of Article 76, paragraph (1) or otherpersons prescribed by rules of the Personal
Information Protection Commission(vi) other cases prescribed by cabinet order

as equivalent to those cases set forth ineach preceding item
(Notification etc. of a Utilization Purpose
when Acquiring)
Article 18 A personal information handlingbusiness operator shall, in case of having
acquired personal information except incases where a utilization purpose has been
disclosed in advance to the public, promptly
inform a principal of, or disclose to the
public, the utilization purpose.
(2) A personal information handling business

operator shall, notwithstanding theprovisions under the preceding paragraph, incases where it acquires, accompanied byconcluding a contract with a principal, theprincipal's personal information stated in a
written contract or other document(including an electromagnetic record;hereinafter the same in this paragraph) orother similar cases where it acquires directlyfrom a principal his or her personal
information stated in a written document,
state a utilization purpose explicitly to thesaid principal. This, however, shall not apply
in cases where there is an urgent need toprotect a human life, body or fortune.
(3) A personal information handling business

operator shall, in case of altering a utilization
purpose, inform a principal of, or disclose to
the public, a post-altered utilization purpose.
(4) The provisions of the preceding threeparagraphs shall not apply in those cases set
forth in the following.

http://www.japaneselawtranslation.go.jp/law/detail_print

2018/05/14

13/53(i) cases in which there is a possibility that

informing a principal of, or disclosing to
the public, a utilization purpose would
harm a principal or third party's life, body,fortune or other rights and interests(ii) cases in which there is a possibility that

informing a principal of, or disclosing to
the public, a utilization purpose would
harm the rights or legitimate interests ofthe said personal information handlingbusiness operator(iii) cases in which there is a need tocooperate in regard to a central
government organization or a local
government performing affairs prescribedby laws and regulations, and when there isa possibility that informing a principal of,or disclosing to the public, a utilization
purpose would interfere with theperformance of the said affairs(iv) cases in which it can be recognized,

judging from the acquisitional
circumstances, that a utilization purpose isclear(Assurance etc. about the Accuracy of Data
Contents)
Article 19 A personal information handlingbusiness operator shall strive to keep
personal data accurate and up to date within
the scope necessary to achieve a utilization
purpose, and to delete the personal data
without delay when such utilization has
become unnecessary.
(Security Control Action)
Article 20 A personal information handlingbusiness operator shall take necessary andappropriate action for the security control of
personal data including preventing theleakage, loss or damage of its handled
personal data.

http://www.japaneselawtranslation.go.jp/law/detail_print

2018/05/14

14/53(Supervision over Employees)
Article 21 A personal information handlingbusiness operator shall, in having its
employees handle personal data, exercise
necessary and appropriate supervision overthe employees so as to seek the security
control of the personal data.
(Supervision over a Trustee)
Article 22 A personal information handlingbusiness operator shall, in case of entrustinga whole or part of the handling of personaldata, exercise necessary and appropriate
supervision over an entrusted person so as toseek the security control of the personal dataof which the handling has been entrusted.
(Restriction on Third Party Provision)
Article 23 A personal information handlingbusiness operator shall, except in those cases
set forth in the following, not provide
personal data to a third party withoutobtaining in advance a principal's consent.
(i) cases based on laws and regulations(ii) cases in which there is a need to protect

a human life, body or fortune, and when it
is difficult to obtain a principal's consent(iii) cases in which there is a special need toenhance public hygiene or promote
fostering healthy children, and when it isdifficult to obtain a principal's consent(iv) cases in which there is a need tocooperate in regard to a central
government organization or a local
government, or a person entrusted by them
performing affairs prescribed by laws andregulations, and when there is a possibility
that obtaining a principal's consent wouldinterfere with the performance of the saidaffairs

http://www.japaneselawtranslation.go.jp/law/detail_print

2018/05/14

15/53(2) A personal information handling business

operator, in regard to personal data provided
to a third party (excluding special carerequired personal information; hereinafter
the same in this paragraph), may, in cases
where it is set to cease in response to aprincipal's request a third-party provision of
personal data that can identify the principal
and when pursuant to rules of the Personal
Information Protection Commission it has inadvance informed a principal of thosematters set forth in the following or put theminto a state where a principal can easily
know, and notified them to the Personal
Information Protection Commission, provide
the said personal data to a third party
notwithstanding the provisions of thepreceding paragraph.
(i) to set a third-party provision as autilization purpose(ii) the categories of personal data provided

to a third party(iii) a method of a third-party provision(iv) to cease, in response to a principal's

request, a third-party provision of personal
data that can identify the principal(v) a method of receiving a principal's

request(3) A personal information handling business

operator shall, in case of altering thosematters set forth in item (ii), item (iii) or item(v) of the preceding paragraph, in advance
inform a principal of the contents to bealtered or put them into a state where aprincipal can easily know and notify them to
the Personal Information Protection
Commission pursuant to rules of the Personal
Information Protection Commission.
(4) The Personal Information Protection

Commission shall, when notified pursuant toparagraph (2), disclose to the public a matter

http://www.japaneselawtranslation.go.jp/law/detail_print

2018/05/14

16/53
relating to the notification pursuant to rulesof the Personal Information Protection
Commission. The same shall apply when
notified pursuant to the preceding paragraph.
(5) In those cases set forth in the following, aperson receiving the provision of the said
personal data shall not fall under a third party
in regard to applying the provisions of eachpreceding paragraph.
(i) cases in which personal data is provided

accompanied by a personal information
handling business operator entrusting awhole or part of the handling of thepersonal data within the necessary scopeto achieve a utilization purpose(ii) cases in which personal data is provided

accompanied with business succession
caused by a merger or other reason(iii) cases in which personal data to be

jointly utilized by a specified person isprovided to the specified person, and whena principal has in advance been informed
or a state has been in place where aprincipal can easily know to that effect aswell as of the categories of the jointly
utilized personal data, the scope of a
jointly utilizing person, the utilization
purpose for the utilizing person and thename or appellation of a person
responsible for controlling the said
personal data
(6) A personal information handling business

operator shall, in case of altering a utilization
purpose for a utilizing person or the name orappellation of a person responsible forcontrolling personal data prescribed in item(iii) of the preceding paragraph, in advance
inform a principal of the contents to bealtered or put them into a state where aprincipal can easily know.

http://www.japaneselawtranslation.go.jp/law/detail_print

2018/05/14

17/53(Restriction on Provision to a Third Party ina Foreign Country)
Article 24 A personal information handlingbusiness operator, except in those cases set
forth in each item of the preceding Article,
paragraph (1), shall, in case of providing
personal data to a third party (excluding aperson establishing a system conforming tostandards prescribed by rules of the Personal
Information Protection Commission asnecessary for continuously taking action
equivalent to the one that a personal
information handling business operator shalltake concerning the handling of personal data
pursuant to the provisions of this Section;
hereinafter the same in this Article) in aforeign country (meaning a country or region
located outside the territory of Japan;
hereinafter the same) (excluding thoseprescribed by rules of the Personal
Information Protection Commission as aforeign country establishing a personal
information protection system recognized tohave equivalent standards to that in Japan inregard to the protection of an individual's
rights and interests; hereinafter the same inthis Article), in advance obtain a principal's
consent to the effect that he or she approves
the provision to a third party in a foreigncountry. In this case, the provisions of thepreceding Article shall not apply.
(Keeping etc. of a Record on a Third-Party
Provision)
Article 25 A personal information handlingbusiness operator shall, when having
provided personal data to a third party(excluding a person set forth in each item of
Article 2, paragraph (5); hereinafter the samein this Article and the succeeding Article),
keep a record pursuant to rules of the
Personal Information Protection Commission
on the date of the personal data provision,
the name or appellation of the third party,

http://www.japaneselawtranslation.go.jp/law/detail_print

2018/05/14

18/53and other matters prescribed by rules of the
Personal Information Protection
Commission. This, however, shall not apply
in cases where the personal data provision
falls under any of each item of Article 23,
paragraph (1) or paragraph (5) (this means,in case of a personal data provision pursuant
to the provisions of the preceding Article,
any of each item of Article 23, paragraph(1)).
(2) A personal information handling business

operator shall maintain a record under thepreceding paragraph for a period of timeprescribed by rules of the Personal
Information Protection Commission from thedate when it kept the record.
(Confirmation etc. when Receiving a Third
Party Provision)
Article 26 A personal information handlingbusiness operator shall, when receiving theprovision of personal data from a third party,
confirm those matters set forth in thefollowing pursuant to rules of the Personal
Information Protection Commission. This,
however, shall not apply in cases where thesaid personal data provision falls under anyof each item of Article 23, paragraph (1) orparagraph (5).
(i) the name or appellation and address ofthe third party and, for a corporate body,the name of its representative (for a noncorporate body having appointed a
representative or administrator, the said
representative or administrator)(ii) circumstances under which the said

personal data was acquired by the said
third party(2) A third party under the preceding

paragraph shall, in cases where a personal
information handling business operator
confirms pursuant to the provisions of the

http://www.japaneselawtranslation.go.jp/law/detail_print

2018/05/14

19/53preceding paragraph, not deceive thepersonal information handling business
operator on a matter relating to theconfirmation.
(3) A personal information handling business

operator shall, when having confirmed
pursuant to the provisions of paragraph (1),keep a record pursuant to rules of the
Personal Information Protection Commission
on the date when it received the provision of
personal data, a matter concerning the said
confirmation, and other matters prescribedby rules of the Personal Information
Protection Commission.
(4) A personal information handling business

operator shall maintain a record under thepreceding paragraph for a period of timeprescribed by rules of the Personal
Information Protection Commission from thedate when it kept the record.
(Public Disclosure etc. on Matters relating toRetained Personal Data)
Article 27 A personal information handlingbusiness operator shall, concerning its
retained personal information, put thosematters set forth in the following into a state
where a principal can know (including thosecases in which it, at the request of aprincipal, responds without delay).
(i) the name or appellation of the said

personal information handling business
operator(ii) the utilization purpose of all retained

personal data (excluding those cases
falling under item (i) through item (iii) of
Article 18, paragraph (4))(iii) the procedures for responding to arequest pursuant to the provisions of thesucceeding paragraph or a demand
pursuant to the provisions of thesucceeding Article, paragraph (i); Article

http://www.japaneselawtranslation.go.jp/law/detail_print

2018/05/14

20/5329, paragraph (1); or Article 30, paragraph(1) or paragraph (3) (including, when theamount of a fee has been decided pursuant
to the provisions of Article 33, paragraph(2), the amount of the fee)(iv) besides those set forth under thepreceding three items, those prescribed bycabinet order as a necessary matter toensure the proper handling of retained
personal data
(2) A personal information handling business

operator shall, when requested by a principal
to get informed of a utilization purpose ofretained personal data that can identify theprincipal, inform the said principal thereof
without delay. This, however, shall not apply
in those cases falling under any of eachfollowing item.
(i) cases in which the utilization purpose ofretained personal data that can identify thesaid principal is clear pursuant to theprovisions of the preceding paragraph(ii) cases falling under item (i) through item(iii) of Article 18, paragraph (4)(3) A personal information handling business

operator shall, when having been requested
based on the provisions of the preceding
paragraph but decided not to inform a
principal of the utilization purpose ofretained personal data, inform the principal
to that effect without delay.
(Disclosure)
Article 28 A principal may demand of apersonal information handling business
operator disclosing retained personal datathat can identify him or herself.
(2) A personal information handling business

operator shall, when having received ademand pursuant to the provisions of thepreceding paragraph, disclose retained

http://www.japaneselawtranslation.go.jp/law/detail_print

2018/05/14

21/53
personal data to a principal without delay
pursuant to a method prescribed by cabinet
order. However, in cases where disclosing
such data falls under any of each following
item, a whole or part thereof may not be
disclosed.
(i) cases in which there is a possibility ofharming a principal or third party's life,
body, fortune or other rights and interests(ii) cases in which there is a possibility ofinterfering seriously with the said personal
information handling business operator
implementing its business properly(iii) cases of violating other laws or

regulations(3) A personal information handling business

operator shall, when having decided not todisclose a whole or part of retained personal
data in connection with a demand pursuant to
the provisions of paragraph (1) or when theretained personal data does not exist, informa principal thereof without delay.
(4) In cases where a whole or part of retained

personal data that can identify a principal is
to be disclosed to the principal pursuant to
the provisions of other laws or regulations
using a method equivalent to that prescribedin the main clause of paragraph (2), theprovisions of paragraph (1) and paragraph(2) shall not apply in regard to the said wholeor part of retained personal data.
(Correction etc.)
Article 29 A principal may, when the contentsof retained personal data that can identify theprincipal are not factual, demand of apersonal information handling business
operator making a correction, addition ordeletion (hereinafter referred to as a"correction etc." in this Article) in regard to
the contents of the retained personal data.

http://www.japaneselawtranslation.go.jp/law/detail_print

2018/05/14

22/53(2) A personal information handling business

operator shall, in case of having received ademand pursuant to the provisions of thepreceding paragraph except in cases where
special procedure concerning a correction
etc. of the contents is prescribed by theprovisions of other laws or regulations,conduct a necessary investigation without
delay to the extent necessary to achieve autilization purpose and, based on the result
thereof, make a correction etc. of thecontents of the retained personal data.
(3) A personal information handling business

operator shall, when having made acorrection etc. on a whole or part of thecontents of the retained personal data inconnection with a demand pursuant to theprovisions under paragraph (1) or when
having made a decision not to make acorrection etc., inform a principal without
delay to that effect (including, when having
made a correction etc., the contents thereof).
(Utilization Cease etc.)
Article 30 A principal may, when retained

personal data that can identify the principal
is being handled in violation of theprovisions of Article 16 or has been acquiredin violation of the provisions of Article 17,
demand of a personal information handlingbusiness operator a utilization cease ordeletion (hereinafter referred to as a"utilization cease etc." in this Article) of theretained personal data.
(2) A personal information handling business

operator shall, in case of having received ademand pursuant to the provisions of thepreceding paragraph and when it has become
clear that there is a reason in the demand,
fulfill a utilization cease etc. of the said
retained personal data to the extent necessary
to redress a violation without delay. This,
however, shall not apply in cases where autilization cease etc. of the said retained

http://www.japaneselawtranslation.go.jp/law/detail_print

2018/05/14

23/53
personal data requires a large amount ofexpenses or other cases where it is difficult
to fulfil a utilization cease etc. and whennecessary alternative action is taken toprotect a principal's rights and interests.
(3) A principal may, when retained personal

data that can identify the principal is being
provided to a third party in violation of theprovisions of Article 23, paragraph (1) or
Article 24, demand of a personal information
handling business operator ceasing a thirdparty provision of the retained personal data.
(4) A personal information handling business

operator shall, in case of having received ademand pursuant to the provisions of thepreceding paragraph and when it has become
clear that there is a reason in the demand,cease a third-party provision of the retained
personal data without delay. This, however,shall not apply in cases where ceasing athird-party provision of the said retained
personal data requires a large amount ofexpenses or other cases where it is difficult
to cease a third-party provision and whennecessary alternative action is taken toprotect a principal's rights and interests.
(5) A personal information handling business

operator shall, when having fulfilled autilization cease etc. or decided not to fulfill
a utilization cease etc. of a whole or part ofretained personal data in connection with ademand pursuant to the provisions ofparagraph (1), or when having ceased a thirdparty provision or decided not to cease athird-party provision of a whole or part ofretained personal data in connection with ademand pursuant to the provisions ofparagraph (3), inform a principal to that
effect without delay.
(Explanation of Reason)
Article 31 A personal information handlingbusiness operator shall, in case of informing

http://www.japaneselawtranslation.go.jp/law/detail_print

2018/05/14

24/53a principal to the effect that, as regards awhole or part of action requested or
demanded by the principal pursuant to theprovisions of Article 27, paragraph (3);Article 28, paragraph (3); Article 29,
paragraph (3); or the preceding Article,
paragraph (5), the action will not be taken, orto the effect that different action from thesaid action will be taken, strive to explain areason therefor to the said principal.
(Procedure for Responding to a Demand etc.
for Disclosure etc.)
Article 32 A personal information handlingbusiness operator may, as regards a request
pursuant to the provisions of Article 27,
paragraph (2) or a demand pursuant to theprovisions of Article 28, paragraph (1);Article 29, paragraph (1); Article 30,
paragraph (1) or paragraph (3) (hereinafterreferred to as a "demand etc. for disclosureetc." in this Article and Article 53, paragraph(1)), decide on a method of receiving arequest or demand pursuant to thoseprescribed by cabinet order. In this case, aprincipal shall make a demand etc. fordisclosure etc. in accordance with themethod.
(2) A personal information handling business

operator may, as regards a demand etc. fordisclosure etc., request a principal to present
a matter sufficient to specify retained
personal data subject to the demand etc. In
this case, a personal information handlingbusiness operator shall take appropriate
action in consideration of a principal's
convenience such as providing information
conducive to specify the retained personal
data so that the principal would be able toeasily and precisely make a demand etc. fordisclosure etc.
(3) A demand etc. for disclosure etc. may bemade through an agent pursuant to thoseprescribed by cabinet order.

http://www.japaneselawtranslation.go.jp/law/detail_print

2018/05/14

25/53(4) A personal information handling business

operator shall, in establishing a procedure forresponding to a demand etc. for disclosure
etc. based on the provisions of the preceding
three paragraphs, give consideration so as
not to impose excessive burden on aprincipal.
(Fee)
Article 33 A personal information handlingbusiness operator may, when having beenrequested to inform of a utilization purpose
pursuant to the provisions of Article 27,
paragraph (2) or when having received ademand for disclosure pursuant to theprovisions of Article 28, paragraph (1),collect a fee in relation to taking such action.
(2) A personal information handling business

operator shall, in case of collecting a fee
pursuant to the provisions of the preceding
paragraph, decide on the amount of the fee
within a range recognized as reasonableconsidering actual expenses.
(Advance Demand)
Article 34 A principal may, when intending tofile a lawsuit in connection with a demand
pursuant to the provisions of Article 28,
paragraph (1); Article 29, paragraph (1); or
Article 30, paragraph (1) or paragraph (3),not file the lawsuit unless the principal had
previously issued the demand against aperson who should become a defendant in
the lawsuit and two weeks have passed fromthe delivery day of the issued demand. This,
however, shall not apply when the person
who should become a defendant in thelawsuit has rejected the demand.
(2) A demand under the preceding paragraphis deemed as having been delivered at thetime when such a demand should havenormally been delivered.

http://www.japaneselawtranslation.go.jp/law/detail_print

2018/05/14

26/53(3) The provisions of the preceding two

paragraphs shall apply mutatis mutandis to apetition for a provisional disposition order inconnection with a demand pursuant to theprovisions of Article 28, paragraph (1);Article 29, paragraph (1); or Article 30,
paragraph (1) or paragraph (3).
(Personal Information Handling Business
Operator's Dealing with a Complaint)
Article 35 A personal information handlingbusiness operator shall strive to deal
appropriately and promptly with a complaint
about the handling of personal information.
(2) A personal information handling business

operator shall strive to establish a system
necessary to achieve a purpose under thepreceding paragraph.
Section 2 Duties of an Anonymously
Processed Information HandlingBusiness Operator etc.
(Production etc. of Anonymously Processed
Information)
Article 36 A personal information handlingbusiness operator shall, when producing
anonymously processed information (limited
to those constituting anonymously processed
information database etc.; hereinafter thesame), process personal information inaccordance with standards prescribed byrules of the Personal Information Protection
Commission as those necessary to make it
impossible to identify a specific individual
and restore the personal information used forthe production.
(2) A personal information handling business

operator, when having produced
anonymously processed information, shall, in
accordance with standards prescribed byrules of the Personal Information Protection
Commission as those necessary to preventthe leakage of information relating to those

http://www.japaneselawtranslation.go.jp/law/detail_print

2018/05/14

27/53
descriptions etc. and individual identification
codes deleted from personal information
used to produce the anonymously processed
information, and information relating to aprocessing method carried out pursuant to
the provisions of the preceding paragraph,take action for the security control of suchinformation.
(3) A personal information handling business

operator, when having produced
anonymously processed information, shall,pursuant to rules of the Personal Information
Protection Commission, disclose to the
public the categories of information relating
to an individual contained in the
anonymously processed information.
(4) A personal information handling business

operator, when having produced
anonymously processed information andproviding the anonymously processed
information to a third party, shall, pursuant
to rules of the Personal Information
Protection Commission, in advance disclose
to the public the categories of information
concerning an individual contained inanonymously processed information to beprovided to a third party and its providing
method, and state to the third party explicitly
to the effect that the information being
provided is anonymously processed
information.
(5) A personal information handling business

operator shall, when having produced
anonymously processed information andmaking itself handle the anonymously
processed information, not collate the said
anonymously processed information withother information in order to identify aprincipal concerned with personal
information used to produce the said
anonymously processed information.
(6) A personal information handling business

operator shall, when having produced

http://www.japaneselawtranslation.go.jp/law/detail_print

2018/05/14

28/53
anonymously processed information, strive
to take itself necessary and appropriate
action for the security control of theanonymously processed information andnecessary action for ensuring the proper
handling of the anonymously processed
information such as dealing with a complaint
about the handling, including producing, ofthe said anonymously processed information,and strive to disclose to the public thecontents of such action taken.
(Provision of Anonymously Processed
Information)
Article 37 An anonymously processed

information handling business operator,
when providing anonymously processed
information (excluding those which it
produced itself by processing personal
information; hereinafter the same in thisSection) to a third party, shall, pursuant torules of the Personal Information Protection
Commission, in advance disclose to the
public the categories of personal information
contained in anonymously processed
information to be provided to a third party
and state to the third party explicitly to theeffect that the provided information isanonymously processed information.
(Prohibition against the Act of Identifying)
Article 38 An anonymously processed

information handling business operator,
shall, in handling anonymously processed
information, neither acquire information
relating to those descriptions etc. or
individual identification codes deleted fromthe personal information and information
relating to a processing method carried out
pursuant to the provisions of Article 36,
paragraph (1), nor collate the said
anonymously processed information withother information in order to identify aprincipal concerned with personal

http://www.japaneselawtranslation.go.jp/law/detail_print

2018/05/14

29/53
information used to produce theanonymously processed information.
(Security Control Action etc.)
Article 39 An anonymously processed

information handling business operator shallstrive to take itself necessary and appropriate
action for the security control ofanonymously processed information andnecessary action to ensure the proper
handling of anonymously processed
information such as dealing with a complaint
about the handling of anonymously
processed information, and shall strive todisclose to the public the contents of suchaction taken.
Section 3 Supervision(Report and Onsite Inspection)
Article 40 The Personal Information

Protection Commission may, to the extent
necessary to implement the provisions under
the preceding two Sections and this Section,require a personal information handlingbusiness operator or anonymously processed
information handling business operator(hereinafter referred to collectively as a"personal information handling business
operator etc.") to submit necessary
information or material relating to thehandling of personal information oranonymously processed information(hereinafter referred to collectively as"personal information etc."), or have its
officials enter a business office or othernecessary place of a personal information
handling business operator etc., inquire about
the handling of personal information etc., or
inspect a book, document and other property.
(2) An official who conducts an onsite

inspection pursuant to the provisions of thepreceding paragraph shall carry a certificate

http://www.japaneselawtranslation.go.jp/law/detail_print

2018/05/14

30/53for identification, and present it whenrequested by a person concerned.
(3) An onsite inspection authority pursuant to

the provisions of paragraph (1) shall not be
construed as granted for a criminal
investigation.
(Guidance and Advice)
Article 41 The Personal Information

Protection Commission may, to the extent
necessary to implement the provisions under
the preceding two Sections, provide a
personal information handling business
operator etc. with necessary guidance oradvice on the handling of personal
information etc.
(Recommendation and Order)
Article 42 The Personal Information

Protection Commission may, whenrecognizing there is a need for protecting an
individual's rights and interests in cases
where a personal information handlingbusiness operator has violated the provisions
under Article 16 through Article 18, Article
20 through Article 22, Article 23 (excluding
paragraph (4)), Article 24, Article 25, Article
26 (excluding paragraph (2)), Article 27,
Article 28 (excluding paragraph (1)), Article
29, paragraph (2) or (3), Article 30 (2),paragraph (4) or (5), Article 33, paragraph(2) or Article 36 (excluding paragraph (6)) orin cases where an anonymously processed
information handling business operator has
violated the provisions under Articles 37 or
38, recommend the personal information
handling business operator etc. to suspend
the act of violating or take other necessary
action to rectify the violation.
(2) The Personal Information Protection

Commission may, when recognizing that a
serious infringement of an individual's rights
and interests is imminent in cases where a

http://www.japaneselawtranslation.go.jp/law/detail_print

2018/05/14

31/53
personal information handling business
operator etc. having received arecommendation pursuant to the provisions
under the preceding paragraph did not takeaction in line with the recommendation
without legitimate ground, order the personal
information handling business operator etc.
to take action in line with the said
recommendation.
(3) The Personal Information Protection

Commission may, notwithstanding theprovisions under the preceding two
paragraphs when recognizing there is a needto take urgent action because there is a factthat seriously harms an individual's rights
and interests in cases where a personal
information handling business operator has
violated the provisions of Article 16, Article
17, Article 20 through Article 22, Article 23,
paragraph (1), Article 24 or Article 36,
paragraph (1), paragraph (2) or paragraph (5)or in cases where an anonymously processed
information handling business operator has
violated the provisions under Article 38,
order the personal information handlingbusiness operator etc. to take necessary
action to rectify the violation such assuspending the act of violation.
(Restriction on the Personal Information
Protection Commission's Exercising the
Authority)
Article 43 The Personal Information

Protection Commission shall, in the courseof requiring the submission of a report ormaterial from, conducting an onsite
inspection of, or giving a guidance, advice,recommendation or order to, a personal
information handling business operator etc.,
not hinder the freedom of expression,
freedom of academia, freedom of religion,and freedom of political activity.
(2) In light of the purport of the provisions of

the preceding paragraph, the Personal

http://www.japaneselawtranslation.go.jp/law/detail_print

2018/05/14

32/53
Information Protection Commission shall not
exercise the authorities in regard to apersonal information handling business
operator's act of providing personal
information etc. to a person set forth in each
item of Article 76, paragraph (1) (limited tothose cases where each person handles
personal information etc. for a respective
purpose stipulated in each said item).
(Delegation of Authority)
Article 44 The Personal Information

Protection Commission may, whenrecognizing that there is a need for
effectively giving a personal information
handling business operator arecommendation or order pursuant to theprovisions of Article 42 because there is aneed to urgently and intensively seek
ensuring the proper handling of personal
information etc. or similar othercircumstances prescribed by cabinet order,delegate an authority under the provisions ofArticle 40, paragraph (1) to a businessjurisdictional minister as prescribed bycabinet order.
(2) A business jurisdictional minister shall,when having exercised an authority
delegated pursuant to the provisions of thepreceding paragraph, report the results
thereof to the Personal Information
Protection Commission as prescribed bycabinet order.
(3) A business jurisdictional minister may, asprescribed by cabinet order, delegate a wholeor part of an authority delegated pursuant to
the provisions of paragraph (1) or a whole orpart of an authority pursuant to theprovisions of the preceding paragraph to ahead of a local branch bureau under Article
43 of the Act for Establishment of the
Cabinet Office (Act No.89 of 1999) or otherbureau or organ prescribed by cabinet order.

http://www.japaneselawtranslation.go.jp/law/detail_print

2018/05/14

33/53(4) The Prime Minister delegates an authority

delegated pursuant to the provisions ofparagraph (1) and an authority under theprovisions of paragraph (2) (limited to thoserelating to the Financial Services Agency's
jurisdiction and excluding those prescribedby cabinet order) to a Commissioner of the
Financial Services Agency.
(5) A Commissioner of the Financial Services

Agency may, as prescribed by cabinet order,delegate part of an authority delegatedpursuant to the provisions of the preceding
paragraph to the Securities and Exchange
Surveillance Commission.
(6) A Commissioner of the Financial Services

Agency may, as prescribed by cabinet order,delegate part of an authority delegatedpursuant to the provisions of paragraph (4)(excluding those delegated to the Securities
and Exchange Surveillance Commission
pursuant to the provisions of the preceding
paragraph) to a Director-General of a local
finance bureau or local finance branchbureau.
(7) The Securities and Exchange SurveillanceCommission may, as prescribed by cabinet
order, delegate part of an authority delegatedpursuant to the provisions of paragraph (5) toa Director-General of a local finance bureau
or local finance branch bureau.
(8) As for administrative affairs relating to an

authority delegated to a Director-General ofa local finance bureau or local financebranch bureau pursuant to the provisions of
the preceding paragraph, the Securities andExchange Surveillance Commission directsand supervises a Director-General of a local
finance bureau or local finance branchbureau.
(9) In case of paragraph (5), a request foradministrative review concerning the
Securities and Exchange Surveillance

http://www.japaneselawtranslation.go.jp/law/detail_print

2018/05/14

34/53
Commission's requiring the submission of areport or material (including those cases inwhich a Director-General of a local financebureau or local finance branch bureau do so
pursuant to the provisions of paragraph (7))
may only be filed against the Securities andExchange Surveillance Commission.
(Request by Business Jurisdictional Minister)
Article 45 A business jurisdictional minister

may, when recognizing that there is a needfor ensuring the proper handling of personal
information etc. by a personal information
handling business operator etc. including that
there is an act of a personal information
handling business operator etc. violating theprovisions under the preceding two Sections,request the Personal Information Protection
Commission to take appropriate action inaccordance with the provisions of this Act.
(Business Jurisdictional Minister)
Article 46 A business jurisdictional minister inthe provisions of this Section shall be as
follows.
(i) as for those relating to employment

management involved in the handling of
personal information etc. by a personal
information handling business operator
etc.; a Minister of Health, Labor andWelfare (as for those relating to amariner's employment management; a
Minister of Land, Infrastructure, Transport
and Tourism), and a minister having
jurisdiction over a business conducted by asaid personal information handlingbusiness operator or the National Public
Safety Commission (referred tocollectively as a "Minister etc." in the
succeeding item)(ii) as for those other than the ones set forthin the preceding item involved in thehandling of personal information etc. by a

http://www.japaneselawtranslation.go.jp/law/detail_print

2018/05/14

35/53
personal information handling business
operator etc.; a Minister etc. having
jurisdiction over a business conducted by asaid personal information handlingbusiness operator
Section 4 Private-Sector Body's
Promotion for the Protection of
Personal Information(Accreditation)
Article 47 A corporation (including a non-corporate body which has appointed a
representative or administrator; the same
shall apply in the succeeding Article, item(iii), (b)) which intends to render thefollowing services in order to ensure theproper handling of personal information etc.
by a personal information handling business
operator etc. may receive an accreditationfrom the Personal Information Protection
Commission.
(i) dealing with a complaint under theprovisions of Article 52 about the handlingof personal information etc. by a personal
information handling business operator
covered by the services (hereinafterreferred to as a "covered business
operator")(ii) providing a covered business operator

with information concerning a matter
contributory to ensuring the proper
handling of personal information etc.
(iii) besides those set forth in the preceding

two items, rendering necessary services
related to ensuring the proper handling of
personal information etc. by a coveredbusiness operator(2) A person who intends to receive an

accreditation under the preceding paragraphshall, as prescribed by cabinet order, apply to
the Personal Information Protection
Commission.

http://www.japaneselawtranslation.go.jp/law/detail_print

2018/05/14

36/53(3) The Personal Information Protection

Commission shall, when having granted anaccreditation under the paragraph (1),announce to the public to that effect.
(Disqualification)
Article 48 A person falling under any of eachfollowing item shall not receive an
accreditation under the paragraph (1) of thepreceding Article.
(i) a person who has been sentenced to

imprisonment pursuant to the provisionsof this Act and for whom two years havenot elapsed since the date of either thecompletion of, or the conclusion of being
subject to, the execution of the sentence(ii) a person whose accreditation was

rescinded pursuant to the provisions ofArticle 58, paragraph (1) and for whom
two years have not elapsed since the dateof the rescission(iii) those of which the directors rendering

the said services (including a
representative or administrator of a noncorporate body which has appointed a
representative or administrator; hereinafter
the same in this Article) encompass a
person who falls under any of thefollowing(a) a person who has been sentenced to

imprisonment or a severer punishment
or who has been sentenced pursuant to
the provisions of this Act and for whom
two years have not elapsed since thedate of either the completion of, or theconclusion of being subject to, theexecution of the sentence(b) a person who was a director of acorporation whose accreditation was
rescinded pursuant to the provisions ofArticle 58, paragraph (1) within thirtydays prior to the date of the rescission

http://www.japaneselawtranslation.go.jp/law/detail_print

2018/05/14

37/53and for whom two years have notelapsed since the date of the rescission(Accreditation Standards)
Article 49 The Personal Information

Protection Commission shall not grant an
accreditation unless it recognizes that an
accreditation application under Article 47,
paragraph (1) conforms to all of eachfollowing item.
(i) a service-rendering method has beendevised necessary to perform properly andassuredly those services set forth in each
item of Article 47, paragraph (1)(ii) knowledge, capability and financial basehave been demonstrated as sufficient toperform properly and assuredly thoseservices set forth in each item of Article
47, paragraph (1)(iii) in cases where services other than thoseservices set forth in each item of Article
47, paragraph (1) are being rendered, there
is no possibility that rendering such otherservices disturb the fairness of thoseservices set forth in each item of the said
paragraph(Notification of Termination)
Article 50 A person who has received anaccreditation under Article 47, paragraph (1)(hereinafter referred to as an "accredited
personal information protection
organization") shall, when intending toterminate services concerning theaccreditation (hereinafter referred to as"accredited services"), in advance notify the
Personal Information Protection Commission
to that effect as prescribed by cabinet order.
(2) The Personal Information Protection

Commission shall, when notified pursuant to
the provisions of the preceding paragraph,announce to the public to that effect.

http://www.japaneselawtranslation.go.jp/law/detail_print

2018/05/14

38/53(Covered Business Operator)
Article 51 An accredited personal information

protection organization shall make its
covered business operators composed of apersonal information handling business
operator etc. who is a constituent of the said
accredited personal information protection
organization or who has consented to
becoming covered by the accredited services.
(2) An accredited personal information

protection organization shall announce to the
public the name or appellation of its coveredbusiness operators.
(Dealing with a Complaint)
Article 52 An accredited personal information

protection organization shall, when
petitioned by a principal or other concerned
person to resolve a complaint about its
covered business operator's handling of
personal information etc., hold consultation,
give necessary advice to the petitioner andinvestigate circumstances surrounding thecomplaint, as well as inform the coveredbusiness operator of the complaint contents
and request its expeditious resolution.
(2) An accredited personal information

protection organization may, whenrecognizing that there is a need in regard to
the resolution of a complaint in connection
with a petition under the preceding
paragraph, request the covered business
operator to provide a written or oral
explanation or submit a referential material.
(3) A covered business operator shall, whenrequested by an accredited personal
information protection organization pursuant
to the provisions of the preceding paragraph,
not refuse the request without a justifiablereason.
(Personal Information Protection Guideline)

http://www.japaneselawtranslation.go.jp/law/detail_print

2018/05/14

39/53
Article 53 An accredited personal information

protection organization shall, for the purposeof ensuring a covered business operator's
proper handling of personal information etc.,
strive to develop a guideline conformable tothe purport of the provisions of this Act(hereinafter referred to as a "personal
information protection guideline") by askinga person representing consumers or otherconcerned person for their opinion in regard
to a matter related to personal information
including utilization purpose specification,
security control action and procedures forresponding to a demand etc. for disclosure
etc. as well as a matter related toanonymously processed information
including its production method and security
control action for such information.
(2) An accredited personal information

protection organization shall, when having
developed a personal information protection
guideline pursuant to the provisions of thepreceding paragraph, notify without delay
the Personal information Protection
Commission of the personal information
protection guideline pursuant to rules of the
Personal Information Protection
Commission. When this has been modified,
the same shall apply.
(3) The Personal Information Protection

Commission shall, when having been
notified of a personal information protection
guideline under the provisions of thepreceding paragraph, announce to the public
the personal information protection guideline
pursuant to rules of the Personal Information
Protection Commission.
(4) An accredited personal information

protection organization shall, when apersonal information protection guideline has
been announced to the public pursuant to theprovisions of the preceding paragraph, takeaction against a covered business operator

http://www.japaneselawtranslation.go.jp/law/detail_print

2018/05/14

40/53such as providing guidance orrecommendation necessary to make thecovered business operator follow the said
personal information protection guideline.
(Prohibition of Utilization for Unintended
Purpose)
Article 54 An accredited personal information

protection organization shall not utilize
information obtained in the course of
rendering accredited services for the otherpurposes than for use in such accredited
services.
(Restriction on Use of Appellation)
Article 55 A person who is not an accredited

personal information protection organization
shall not use the appellation of the accredited
personal information protection organizationor any other confusing appellation therewith.
(Calling for a Report)
Article 56 The Personal Information

Protection Commission may, to the extent
necessary to implement the provisions under
this section, call for an accredited personal
information protection organization to reporton its accredited services.
(Order)
Article 57 The Personal Information

Protection Commission may, to the extent
necessary to implement the provisions of thissection, order an accredited personal
information protection organization to
improve a method of rendering accredited
services, amend a personal information
protection guideline, or take any othernecessary action.
(Rescinding the Accreditation)
Article 58 The Personal Information

Protection Commission may, when an
accredited personal information protection

http://www.japaneselawtranslation.go.jp/law/detail_print

2018/05/14

41/53organization falls under any of eachfollowing item, rescind the accreditation.
(i) when having led to falling under Article

48, item (i) or item (iii)(ii) when having become unconformable toany of each item of Article 49(iii) when having violated the provisions ofArticle 54(iv) when disobeying an order under thepreceding Article(v) when having received an accreditation

under Article 47, paragraph (1) byimproper means(2) The Personal Information Protection

Commission shall, when having rescinded anaccreditation pursuant to the provisions of
the preceding paragraph, announce to the
public to that effect.
Chapter V The Personal Information
Protection Commission(Establishment)
Article 59 The Personal Information

Protection Commission (hereinafter referred
to as the "Commission") is to be establishedbased on the provisions of Article 49,
paragraph (3) of the Act for Establishment of
the Cabinet Office.
(2) The Commission belongs to thejurisdiction of the Prime Minster.
(Duties)
Article 60 The Commission is to assume theduties of pursuing ensuring the proper
handling of personal information (including
taking action such as giving guidance andadvice to an individual number utilizing
business etc. related implementer (meaning
an individual number utilizing business etc.
related implementer prescribed in Article 12

http://www.japaneselawtranslation.go.jp/law/detail_print

2018/05/14

42/53of the Act on the Use of Numbers to Identify
a Specific Individual in the Administrative
Procedure (Act No.27 of 2013; hereinafterreferred to as the "Numbers Use Act"))) in
order to protect an individual's rights andinterests while considering the utility of
personal information including that theproper and effective application of personal
information contributes to the creation of
new industries and the realization of avibrant economic society and an enriched
quality of life for the people of Japan.
(Jurisdictional Affairs)
Article 61 The Commission is to administer

the following affairs in order to fulfil theduties under the preceding Article.
(i) affairs related to the formulation andpromotion of a basic policy(ii) affairs related to supervision over thehandling of personal information andanonymously processed information, andthose related to necessary mediation on alodged complaint and cooperation offered
to a business operator who deals with thecomplaint (excluding those set forth initem (iv))(iii) affairs related to an accredited personal

information protection organization(iv) affairs related to monitoring andsupervision over the handling of specificpersonal information (meaning specificpersonal information prescribed in Article
2, paragraph (8) of the Numbers Use Act;the same shall apply in Article 63,
paragraph (4)) and those related tonecessary mediation on a lodged
complaint and cooperation offered to abusiness operation who deals with thecomplaint(v) affairs related to specific personal

information protection assessment

http://www.japaneselawtranslation.go.jp/law/detail_print

2018/05/14

43/53(meaning specific personal information
protection assessment prescribed in Article
27, paragraph (1) of the Numbers Use Act)(vi) affairs related to public relations and an

enlightenment campaign on the protectionof, and the proper and effective
application of, personal information(vii) affairs related to an investigation or

research necessary to administer thoseaffairs set forth in each preceding item
(viii) affairs related to international

cooperation on the jurisdictional affairs(ix) besides those set forth in eachpreceding item, those affairs which havebeen made by law (including an order
based thereon) to belong to theCommission(Independence on Exercising the Authority)
Article 62 A chairperson and commissionersof the Commission are to exercise theirofficial authority independently.
(Organization etc.)
Article 63 The Commission is to be composedof a chairperson and eight commissioners.
(2) Four of the commissioners are to serve ona part-time basis.
(3) A chairperson and a commissioner are tobe appointed by the Prime Minister withconsent of both Houses of the Diet fromamong those with high character and deep
insight.
(4) A chairperson and commissioners are toencompass a person who has academic
experience concerning the protection of, andthe proper and effective application of,
personal information, a person who has
sufficient knowledge and experience
concerning the protection of consumers, a

http://www.japaneselawtranslation.go.jp/law/detail_print

2018/05/14

44/53
person who has academic experience
concerning information processing
technologies, a person who has academic
experience concerning public administrative
fields utilizing specific personal information,a person who has sufficient knowledge andexperience concerning private-sectorbusiness practices, and a person
recommended by a federate organization(meaning a federate organization under
Article 263-3, paragraph (1) of the Local
Autonomy Act (Act No.67 of 1947) that hasgiven a notification pursuant to theprovisions of the said paragraph).
(Term of Office etc.)
Article 64 The term of office for a chairperson

and a commissioner is to be five years;
however, the term of office of a chairperson
or a commissioner appointed to fill avacancy shall be the remaining term of officeof his or her predecessor.
(2) A chairperson and a commissioner may bereappointed.
(3) When the term of office for a chairperson

or a commissioner has expired, thechairperson or commissioner are to continue
to fulfil their duties until their successor isappointed.
(4) In cases where the term of office of achairperson or a commissioner has expired orwhere a vacancy has occurred, when consent
by both Houses of the Diet cannot be
obtained due to the closing of the Diet or the
dissolution of the House of Representatives,
the Prime Minister may, notwithstanding theprovisions of the preceding Article,
paragraph (3), appoint a chairperson or acommissioner from among those persons
who have those qualifications prescribed in
the said paragraph.

http://www.japaneselawtranslation.go.jp/law/detail_print

2018/05/14

45/53(5) In those cases under the preceding

paragraph, an ex post facto approval by bothHouses of the Diet shall be obtained in thefirst Diet session after the appointment. In
this case, when the ex post facto approvalcannot be obtained by both Houses of theDiet, the Prime Minister shall immediately
dismiss the chairperson or the commissioner.
(Guarantee of Status)
Article 65 A chairperson and a commissioner

shall not be dismissed against their will
while in office except in those cases fallingunder any of each following item.
(i) when having received a decision on thecommencement of bankruptcy
proceedings(ii) when having been punished in violationof this Act or the Numbers Use Act(iii) when having been punished by

imprisonment without work or severer
sentence(iv) when, by the Commission, having beenrecognized to be incapable of fulfilling his
or her duties because of a mental or
physical disorder, or having beenrecognized to be committing a violation of
obligation in the course of duties or othermisconduct unbecoming to a chairperson
or a commissioner(Dismissal)
Article 66 The Prime Minister shall, when achairperson or a commissioner falls under
any of each item of the preceding Article,
dismiss the chairperson or the commissioner.
(Chairperson)
Article 67 A chairperson is to preside over therules and proceedings of the Commission
and represent the Commission.

http://www.japaneselawtranslation.go.jp/law/detail_print

2018/05/14

46/53(2) The Commission shall designate inadvance from among full-timecommissioners a person to be an acting
chairperson in cases where the chairperson isin an accident.
(Meeting)
Article 68 A meeting of the Commission is tobe called by a chairperson.
(2) The Commission may, unless achairperson and four or more commissioners
are present, neither hold a meeting nor makea decision.
(3) A decision of the Commission is to be

adopted by a majority of attendees, and whenin a tie, a chairperson is to make a decision.
(4) A recognition pursuant to the provisions ofArticle 65, item (iv), notwithstanding theprovisions of the preceding paragraph, shallbe allowed with the unanimous concurrenceof all commissioners except for thecommissioner concerned.
(5) With regard to applying the provisions of

this Article, paragraph (2) in cases where achairperson is in an accident, a person to be
an acting chairperson prescribed in thepreceding Article, paragraph (2) shall bedeemed as a chairperson.
(Specialist Commissioner)
Article 69 In the Commission may a specialist

commissioner be posited to have a
specialized matter investigated.
(2) A specialist commissioner is to beappointed by the Prime Minister based on a
proposal made by the Commission.
(3) A specialist commissioner shall be relievedof his or her post when an investigation into
the specialized matter has been finished.

http://www.japaneselawtranslation.go.jp/law/detail_print

2018/05/14

47/53(4) A specialist commissioner is to serve on apart-time basis.
(Secretariat)
Article 70 For the purpose of having

commissionary affairs administered, asecretariat is to be posited.
(2) In a secretariat are a secretary general andother staff to be posited.
(3) A secretary general is to administer

secretarial affairs under the order of achairperson.
(Prohibition of a Political Campaign etc.)
Article 71 A chairperson and commissioners

shall, while in office, neither become adirector of a political party or other politicalorganization nor actively conduct a political
campaign.
(2) A chairperson and a full-timecommissioner shall, while in office except in
those cases where there has been permission
from the Prime Minister, not engage in any
other duties paying remuneration, operate aprofit-making business, or perform otherservices for the purpose of gaining monetary
profit.
(Confidentiality Obligation)
Article 72 A chairperson, commissioner,

specialist commissioner and secretarial staff
shall not divulge or use by stealth any secretthat may have come to their knowledge inthe course of duties. The same shall also
apply after they have left their position.
(Remuneration)
Article 73 The remuneration of a chairperson

and a commissioner shall be prescribed
separately by law.
(Establishment of Rules)

http://www.japaneselawtranslation.go.jp/law/detail_print

2018/05/14

48/53
Article 74 The Commission may establish

rules of the Personal Information Protection
Commission regarding its jurisdictional
affairs in order to enforce a law or cabinet
order, or on the basis of a special delegation
under a law or cabinet order.
Chapter VI Miscellaneous Provisions(Scope of Application)
Article 75 The provisions of Article 15,

Article 16, Article 18 (excluding paragraph(2)), Article 19 through Article 25, Article 27
thorough Article 36, Article 41, Article 42,paragraph (1), Article 43 and the following
Article shall also apply in those cases wherea personal information handling business
operator who in relation to supplying a goodor service to a person in Japan has acquired
personal information relating to the person
being as a principal handles in a foreigncountry the personal information oranonymously processed information
produced by using the said personal
information.
(Exclusion from Application)
Article 76 To a person set forth in eachfollowing item who is a personal information
handling business operator shall theprovisions of Chapter IV not apply when awhole or part of the purpose of handlingpersonal information etc. is a purpose
prescribed in each said item respectively.
(i) a broadcasting institution, newspaper

publisher, communication agency andother press organization (including an
individual engaged in the press as his or
her business): a purpose of being
provided for use in the press(ii) a person who practices writing as aprofession: a purpose of being provided
for use in writing

http://www.japaneselawtranslation.go.jp/law/detail_print

2018/05/14

49/53(iii) a university and other organization orgroup aimed at academic studies, or aperson belonging thereto: a purpose ofbeing provided for use in academic studies(iv) a religious body: a purpose of being

provided for use in a religious activity(including those activities accessory
thereto)(v) a political body: a purpose of being

provided for use in a political activity(including those activities accessory
thereto)(2) The "press" prescribed in item (1) of thepreceding paragraph means informing a large
number of unspecified people of an objective
fact as such (including stating an opinion orview based thereon).
(3) A personal information handling business

operator etc. set forth in each item ofparagraph (1) shall strive to take itself
necessary and appropriate action for the
security control of personal data oranonymously processed information andnecessary action to ensure the proper
handling of personal information etc. such as
dealing with a complaint about the handlingof personal information etc., as well as
announce to the public the contents of suchaction taken.
(Affairs Administered by a Local
Government)
Article 77 Administrative affairs belonging to

the Commission's authority prescribed in thisAct and an authority delegated to a businessjurisdictional minister or a Commissioner of
the Financial Services Agency pursuant to
the provisions of Article 44, paragraph (1) orparagraph (4) may be managed by a head ofa local government or other executive agency
as prescribed by cabinet order.

http://www.japaneselawtranslation.go.jp/law/detail_print

2018/05/14

50/53(Information Provision to the Foreign
Enforcement Authorities)
Article 78 The Commission may provide theforeign authorities enforcing those foreignlaws and regulations equivalent to this Act(hereinafter referred to as the "foreign
enforcement authorities" in this Article) withinformation recognized as contributory to
fulfilling their duties (limited to thoseequivalent to the Commission's duties
prescribed in this Act; the same shall apply
in the succeeding paragraph).
(2) Concerning the provision of information

pursuant to the preceding paragraph,appropriate action shall be taken so that the
information is neither used for purposes
other than for the foreign enforcement
authorities fulfilling their duties nor used for
a foreign criminal case investigation (limited
to the one conducted after the criminal facts
subject to the investigation have been
specified) or adjudication (hereinaftercollectively referred to as an "investigationetc.") without consent pursuant to thesucceeding paragraph.
(3) The Commission may, when having

received a request from the foreign
enforcement authorities, consent that the
information it provided pursuant toparagraph (1) be used for a foreign criminalcase investigation etc. in connection with therequest except for those cases falling under
any of each following item.
(i) when a crime subject to the criminal caseinvestigation etc. in connection with thesaid request is a political crime, or when
the said request is recognized to have been
made for the purpose of conducting theinvestigation etc. into a political crime(ii) when an act relating to the crime subject

to a criminal case investigation etc. inconnection with the said request, if it were

http://www.japaneselawtranslation.go.jp/law/detail_print

2018/05/14

51/53
committed in Japan, shall not constitute a
criminal offense according to the laws andregulations in Japan(iii) when there is no assurance that therequesting country will accept the samekind of request from Japan(4) The Commission shall, in case ofconsenting under the preceding paragraph,obtain a Minister of Justice's confirmation of
the case not falling under item (i) and item(ii) of the preceding paragraph, and a
Minister of Foreign Affairs' confirmation of
the case not falling under item (iii) of thepreceding paragraph respectively.
(Report to the Diet)
Article 79 The Commission shall annuallyreport to the Diet through the Prime Minister
the current status of administering its
jurisdictional affairs, and announce to the
public a summary thereof.
(Communication and Cooperation)
Article 80 The Prime Minister and a head ofan administrative organization related to theimplementation of this Act (meaning anorganization established in the Cabinet basedon the provisions of laws (excluding the
Cabinet Office), an organization under thejurisdiction of the Cabinet, the Cabinet
Office, the Imperial Household Agency, anorganization prescribed in Article 49,
paragraph (1) and paragraph (2) of the Act
for Establishment of the Cabinet Office, andan organization prescribed in Article 3,
paragraph (2) of the National Government
Organization Act (Act No.120 of 1948))
shall closely communicate and cooperatewith one another.
(Delegation to Cabinet Order)

http://www.japaneselawtranslation.go.jp/law/detail_print

2018/05/14

52/53
Article 81 A matter necessary to implement

this Act other than those prescribed in thisAct is to be prescribed by cabinet order.
Chapter VII Penal Provisions
Article 82 A person who has divulged or usedby stealth a secret in violation of theprovisions of Article 72 shall be punished by
imprisonment with work for not more than
two years or a fine of not more than
1,000,000 yen.
Article 83 A personal information handlingbusiness operator (or its director,
representative or administrator if it is a
corporate body (including a non-corporatebody having appointed a representative or
administrator; the same shall apply in Article
87, paragraph (1)), its employee, or a person
who used to be such a business operator or
employee shall, when having provided orused by stealth personal information
database etc. (including their wholly or
partially duplicated or processed ones) thatthey handled in relation to their business forthe purpose of seeking their own or a third
party's illegal profits, be punished by
imprisonment with work for not more than
one year or a fine of not more than 500,000
yen.
Article 84 A person who has violated an orderpursuant to the provisions of Article 42,paragraph (2) or paragraph (3) shall bepunished by imprisonment with labor for not
more than six months or a fine of not morethan 300,000 yen.
Article 85 A person falling under any of eachfollowing item shall be punished by a fine of
not more than 300,000 yen.
(i) a person who has failed to submit areport or material under the provisions ofArticle 40, paragraph (1) or did falsely
submit a report or material, or who failed

http://www.japaneselawtranslation.go.jp/law/detail_print

2018/05/14

53/53to answer a question posed by the staff
concerned or did falsely answer aquestion, or refused, obstructed or evaded
an inspection(ii) a person who failed to submit a reportunder the provisions of Article 56, or did
falsely submit a report
Article 86 The provisions of Article 82 andArticle 83 shall apply to a person who hascommitted an offense under these Articles
outside of Japan.
Article 87 When a representative of acorporate body, or an agent, employee orother worker of a corporate body or natural
person has committed a violating act under
Article 83 through Article 85 in relation to
the corporate body or natural person's
business, the actor shall be punished, and afine set forth in the respective Articles shallbe imposed on the said corporate body or
natural person.
(2) In cases where the provisions of thepreceding paragraph apply to a noncorporate body, its representative or
administrator shall represent the noncorporate body in regard to an act of
litigation, and the provisions of a law on acriminal suit in the cases where a corporatebody is a defendant or suspect shall apply
mutatis mutandis.
Article 88 A person falling under any of eachfollowing item shall be punished by a noncriminal fine of not more than 100,000 yen.
(i) a person who has violated the provisionsof Article 26, paragraph (2), or Article 55(ii) a person who failed to submit a

notification or did falsely submit a
notification under the provisions of Article
50, paragraph (1)http://www.japaneselawtranslation.go.jp/law/detail_print

2018/05/14