Basic Policy on Personal Information Protection (Privacy Policy) at
National University Corporation Tohoku University
November 29, 2023
Approved by the President
National University Corporation Tohoku University (hereinafter referred to as the “University”)
declares, with the acknowledgment that management of personal information entrusted by applicants
for admission, students and their guarantors, graduates, completers, patients of the hospital and othermedical institutions and their family members, donors, applicants for employment at the University,
faculty and staff members and other persons engaged in operations of the University and their family
members, website users and other persons related to the University (hereinafter collectively referred
to as “students, faculty and staff members, etc.”) is its important duty, that it has hereby developed abasic policy on personal information protection at the University (hereinafter referred to as the“Personal Information Protection Policy”); that it complies with the Act on the Protection of PersonalInformation (hereinafter referred to as the “Act”) and other relevant laws, regulations, and guidelines;
and that it has established voluntary rules and systems in conducting its business. The terms used inthis Personal Information Protection Policy have the same meanings as those in the Act.
1. Proper Management
The University has established a system for protection and management of personal information,and has developed and complies with the Regulations on Protection of Personal Information at
National University Corporation Tohoku University (hereinafter referred to as the “PersonalInformation Protection Regulations”) for appropriate collection, use, and provision of personalinformation.
2. Notification of Purposes of Use
Other than in the exceptional cases provided in the Act, the University acquires the personal
information of students, faculty and staff members, etc. and uses the acquired information to the extent
necessary for the following purposes. If the University intends to acquire personal information for apurpose other than the following, it will specify the purpose of use separately.
If the University intends to use the acquired personal information beyond the scope of the following
purposes, it will obtain the consent of the identifiable person in advance and in an appropriate manner.
(1) The following matters pertaining to applicants for admission
a. Screening of applicantsb. Enrollment proceduresc. Education prior to enrollment
d. Follow-up surveys and other relevant surveys
e. Matters related to student support prior to enrollment
f. Learning guidance and other orientation education
g. Collection and return of examination fees
h. Surveys and analyses for improving entrance examinations and understanding application
trends and other relevant trends
i. Occupancy procedures for student dormitories
j. Contact in cases of emergency and other similar circumstancesk. Dissemination of appropriate educational and support content provided by the University
based on the wishes and intentions of identifiable personsl. Other procedures and contact that are necessary for implementation and operation of entrance
examinations(2) The following matters pertaining to guarantors of applicants for admission
a. Payment and exemption of tuitionb. Occupancy procedures for student dormitories
c. Contact in cases of emergency and other similar circumstances1d. Other procedures and contact that are necessary for implementation and operation of entrance
examinations(3) The following matters pertaining to students
a. Education and learning affairsb. Student support
c. Career support
d. International exchanges
e. Health management
f. Payment of compensation, travel expenses and other expenses
g.Management and collection of entrance fees and tuition claims, tuition fee
exemption/deferment of collection, etc.
h. Scholarship application and payment procedures
i. Tax procedures and other relevant procedures
j. Occupancy procedures for student dormitories, and collection of dormitory fees and otherrelevant expenses
k. Contact in cases of emergency and other similar circumstancesl. Operations for improvement, promotion and other enhancement of education and research(including issuance of various questionnaires)
m. Various checks, investigations, and analyses; accreditation; and investigations by thenational government, administrative agencies, and other similar organizations
n. Sending of University PR materials, event information, donation information, etc.
o. Management of intra-university information networks, authentication for the use of systems,
and responses to security incidents
p. Other procedures and contact that are necessary for operations pertaining to student education(4) The following matters pertaining to guarantors of students
a. Payment, exemption, etc. of student admission fees and tuition feesb. Scholarship payment proceduresc. Occupancy procedures for student dormitories, and payment of dormitory fees and otherrelevant expenses
d. Sending of University PR materials, event information, donation information, etc.
e. Contact in cases of emergency and other similar circumstances
f. Other procedures and contact that are necessary for operations pertaining to student education(5) The following matters pertaining to attendees of Certificate Programs, open courses,
Massive Open Online Courses (MOOC) and other various lectures and lessons
a. Operations related to management of attendance (acceptance, attendance, and completion) inCertificate Programs, open courses, Massive Open Online Courses (MOOC) and other various
lectures and lessonsb. Other procedures and contact that are necessary for operations pertaining to various programs
and courses
c. Announcement and provision of information on various similar programs and courses basedon the wishes and intentions of identifiable persons
d. Sending of University PR materials, event information, donation information, etc.
(6) The following matters pertaining to graduates or completers
a. Issuance of various certificatesb. Contact with graduates or completersc. Sending of University PR materials, event information, donation information, etc.
d. Operations for improvement, promotion and other enhancement of education and research(including issuance of various questionnaires)
e. Various checks, investigations, and analyses; accreditation; and investigations by the nationalgovernment, administrative agencies and other similar organizations
f. Other procedures and contact that are necessary for collaboration between
graduates/completers and the University
g. Provision of information on recurrent education and other reskilling based on the wishes andintentions of identifiable persons
2

h. Utilization of information on finding employment and career support for current students ifthey wish(7) The following matters pertaining to applicants for employment at the University (includingpersons for whom hiring decisions have been made; hereinafter referred to as “job applicants”)
a. Screening for hiringb. Procedures for hiringc. Emergency contact
d. Other procedures, communications, etc. necessary for employment procedures at theUniversity(8) The following matters pertaining to family members of job applicantsa. Contact in cases of emergency and other similar circumstancesb. Other procedures and contact that are necessary for business related to the recruitment ofprospective employees(9) The following matters pertaining to faculty and staff members
a. Personnel affairs
b. Payment of salaries, travel expenses and other expensesc. Procedures for the Ministry of Education, Culture, Sports, Science and Technology Mutual
Aid Association or the Japan Health Insurance Associationd. Labor management
e. Health managementf. Contact with host or home organizations in secondment
g. Confirmation of conflicts of interesth. Procedures for resignationi. Tax procedures and other relevant procedures
j. Emergency contact
k. Disclosure of information pursuant to provisions of the School Education Act and other lawsand regulations
l. Management of intra-university information networks; authentication for use of systems; andresponses to security incidents
m. Other procedures and communications necessary for personnel and labor management offaculty and staff and the publication of information pursuant to laws and regulations(10) The following matters pertaining to family members of faculty and staff members
a. Procedures for the Ministry of Education, Culture, Sports, Science and Technology Mutual
Aid Association or the Japan Health Insurance Associationb. Tax procedures and other relevant proceduresc. Emergency contact(11) The following matters pertaining to donors
a. Procedures regarding receipt of donations
b. Sending of return gifts, PR materials and other University information materialsc. Other procedures and communications necessary for operations pertaining to donations(12) The following matters pertaining to patients and their family members
a. Medical examinationb. Other matters specified in the Tohoku University Hospital Personal Information Protection
Policy (Privacy Policy)(13) The following matters pertaining to dispatched workers
a. Contract procedures and employment management related to dispatched labor to Tohoku
Universityb. Emergency contact(14) Researchers, employees of companies and other persons who conduct joint research with theUniversity
a. Procedures and management pertaining to contracts for joint research and other collaboration,and invitation of researchers
b. Emergency contact(15) Users of the library and other open facilities
3

a. Procedures and management pertaining to use of the library and other facilities
b. Emergency contact(16) Participants in events hosted by the University (meaning open campus days, various
explanatory sessions, lecture meetings, symposiums, etc.)
a. Procedures and management pertaining to participation in or invitation to events hosted bythe University
b. Provision of services and information relevant to events hosted by the University
c. Payment of fees, travel expenses and other expenses, and collection of various charges
d. Tax procedures and other relevant procedures
e. Operations for improvement, promotion and other enhancement of education and research(including issuance of various questionnaires)f. Emergency contact
g. Other necessary procedures and communications for relevant operations
h. Dissemination of information about the University that is requested by identifiable persons
in relation to events(17) Applicants for exchange programs and summer programsa. Implementation of the programsb. Creation of statistical data and analysis of exchange status with overseas partner institutions
c. Provision of information on exchange experiences to other students, if desired(18) Foreign nationals who are planning to enroll or be hireda. Procedures necessary for application for certificates for eligibility and other immigration
procedures(19) Research participants in academic research conducted by faculty and staff members of theUniversity
a. Academic researchb. Publication or teaching of academic research results
3. Use of Pseudonymized Personal Information
The University prepares and uses pseudonymized personal information.
Pseudonymized personal information means information about individuals obtained by processing
personal information in such a way that they cannot be identified unless collated with otherinformation.
In cases where there is no need to identify an individual (e.g., if analyzing education data), theUniversity prepares and uses pseudonymized personal information.
Pseudonymized personal information is prepared and managed in accordance with Article 36 of thePersonal Information Protection Regulations. Pseudonymized information is only used internally andwill not be provided to any third party.
4. Preparation of Anonymized Personal Information Held by Administrative Agencies
If a third party requests provision of anonymized personal information held by the administrativeagencies that was prepared based on personal information retained by the University, and suchinformation may be provided based on the Regulations on Handling of Provision, etc. of Anonymized
Personal Information Held by the Administrative Agencies at National University Corporation
Tohoku University, the University may provide the anonymized personal information held by theadministrative agencies. Anonymized personal information held by the administrative agencies means
information obtained by processing personal information so that individuals cannot be identified even
if collated with other information.
5. Outsourcing of Personal Information Handling
The University may outsource all or part of personal information handling to the extent necessary
for achieving the purpose of use. In outsourcing, the University selects an institution that satisfies
safety measure standards set by the University for the management of personal information, andconducts appropriate management and supervision.
46. Provision to a Third Party
The University manages the personal information of students, faculty and staff members, etc.
appropriately and does not provide it to any third party without obtaining the consent of the relevant
students, faculty and staff members, etc. unless otherwise provided in the Act.
7. Shared Use of Personal Information
The University may share the personal information of students, faculty and staff members, etc.
within the following scopes and for the following purposes with the following organizations.
Joint use organization: Gakuyu-kai Tohoku University(Students’ friendship association)
Purpose of sharing: Provision of information pertaining to student support, including support for
student extracurricular activities
Scope of shared personal information: Title or any other post, academic type, faculty/graduate school,grade, student ID number, name, telephone number, and e-mail address of students who belong to
extracurricular activity organizations
Person responsible for the management of personal data: Hideo Ohno, President of National
University Corporation Tohoku University
Address: 2-1-1 Katahira, Aoba-ku, Sendai, Miyagi
Joint use organization: Tohoku University alumni "Shuyukai"
Purpose of sharing: Communication of information and provision of member services to Shuyukai
members
Scope of shared personal information: name, contact information (address, etc.), and information
while enrolled in university
Person responsible for the management of personal data: Hideo Ohno, President of National
University Corporation Tohoku University
Address: 2-1-1 Katahira, Aoba-ku, Sendai, Miyagi
8. Use of Information Related to Personal Information
The University may optimize the display of its website according to the user by utilizing technologythat uses attribute information (sex, age, occupation, etc.), browsing history, location information andother identifiers that cannot identify an individual by themselves (meaning information that does not
fall under any of personal information, pseudonymized personal information, and anonymized
personal information, and that is referred to as information related to personal information) and thatare collected through the website.
The use of personal information can be permanently refused by appropriately setting the browser
used by each user.
If the University intends to provide information related to personal information to a third party orfor analyzing website access, it will post a statement to that effect on its website.
9. Disclosure, Correction or Suspension of the Use of Personal Information
If a person requests disclosure, correction, or suspension of use (hereinafter referred to as“disclosure, etc.'') of personal information held by the University, the University will respond in areasonable period and scope after confirming that the person making the request is in fact anidentifiable person pursuant to the provisions of the National University Corporation Tohoku
University Guidelines for Handling of Personal Information Disclosure, etc.
Personal information retained by the University means personal information created or acquired by
the University's officers or employees in the course of their duties, and that is recorded in corporate
documents held by the University's officers or employees for organizational use.
If you intend to make a request, please fill out the prescribed request form and submit or mail it tothe Information Disclosure Office reception desk.
Address: Tohoku University Information Disclosure Office, 2-1-1 Katahira, Aoba-ku, Sendai, Miyagi
5

980-8577
In order to make a request, you need to pay a disclosure request fee. The disclosure request fee is
300 yen per corporate document in which retained personal information is recorded.
For details of the disclosure procedures, please check the Tohoku University Information Disclosure
Office website.
10. Security Measures for Personal Information(1) Development of a basic policy
For the purpose of ensuring proper handling of personal information by the entire organization,
the University has developed this Personal Information Protection Policy.
(2) Establishment of rules pertaining to the handling of personal information
For the purpose of preventing leakage and other incidents involving personal information theUniversity handles, or otherwise managing the security of personal information, the University has
established the Personal Information Protection Regulations as rules pertaining to the specifichandling of personal information.
(3) Implementation of organizational security management measures
Based on the Personal Information Protection Regulations, the University takes the following
measures as organizational security management measures.
・ Establishment of a personal information protection management system
・ Creation of a personal information file register to check the handling status of
personal information
・ Establishment of a system for responding to leakage and other incidents involving
personal information, and preparation of response procedures・ Measures related to inspection and audit of the handling status of personalinformation(4) Implementation of personal security management measures
Based on the Personal Information Protection Regulations, the University exercises necessary
supervision over faculty and staff members who handle personal information and provides themwith training sessions for appropriate handling.
(5) Implementation of physical security management measures
Based on the Guidelines on Handling of Personal Information (decided by the Personal
Information General Protection Manager on March 1, 2017), the University takes the following
measures as physical security management measures.
- Measures to identify the storage location of files and electronic media containing personal
information to prevent loss or theft- Measures such as encryption when transmitting personal
information by e-mail etc.
・ Measures to encrypt USB flash drives, PCs or any other device when it is necessary
to carry electronic media- Measures such as using a shredder or dissolving documents on which personal
information is recorded, or measures such as erasing personal information recorded on
PCs, etc. using special tools, or physically destroying the recording medium(6) Implementation of technical security management measures
When handling personal information by using information systems, the University takes thefollowing measures based on the Regulations on Operation and Management of Information
Systems at National University Corporation Tohoku University (decided by the Executive Vice
President (in charge of educational international exchanges and information systems) on
December 1, 2009) as technical security management measures.
- Appropriate access restriction measures to provide services using information systems
containing personal information only to authorized persons- Measures to authenticate that faculty members, etc. who use information systems
containing personal information have legitimate access rights- Measures to prevent unauthorized access from outside by introducing security hole6

countermeasures, malware countermeasures, and denial of service attack
countermeasures for information systems containing personal information- Measures to consider risks posed by information systems containing personal
information (including risks of physical damage, leakage or falsification of information,etc.), and implementing countermeasures in terms of facility and environment insecured areas
11. Continuous Improvement of Efforts to Protect Personal Information
The University ensures that faculty and staff members and outsourcees handling personal
information are fully aware of the methods for handling personal data, etc. stipulated in Chapter 4 of
the Personal Information Protection Regulations, and will constantly strive to improve and enhance
its efforts.
12. Revision of this Personal Information Protection Policy
This Personal Information Protection Policy may be revised from time to time as necessary. Anyrevision will be notified by changing the content posted on this web page.
Contact:For matters related to overall clerical affairs pertaining to the protection of personal information
Person in charge of Document Review, Legal Affairs and Compliance Division, General Affairs andPlanning Department, Administration Bureau, Tohoku University
TEL：022-217-5122
FAX：022-217-6014※ For Privacy policy based on the EU General Data Protection Regulation (GDPR) at
National University Corporation Tohoku University, please see here.

7