The Japanese version is the authoritative version, and this English translation is intended forreference purposes only. Should any discrepancies or doubts arise between the two versions, theJapanese version will prevail.

Basic Policy on the Security Management of Personal Information and Specific Personal
Information at the University of Tsukuba
October 27, 2015
Decision by the President
Amendment: March 24, 2022
March 23, 2023

Basic Policy on the Security Management of Personal Information and Specific Personal
Information at the University of Tsukuba
1. Approach to the Protection of Personal Information and Specific Personal Information
The University of Tsukuba (the “University”) shall, in accordance with the Act on theProtection of Personal Information (Act No. 57 of 2003, the “Personal Information Act”) andthe Act on the Use of Numbers to Identify a Specific Individual in AdministrativeProcedures (Act No. 27 of 2013, the “Individual Number Act”), establish regulations, etc.
concerning personal information and specific personal information, develop a protection
and management system for such information, require its employees, etc. to comply withsuch regulations, etc. and take other measures to handle personal information and specificpersonal information appropriately.
2. Policy on the Protection of Personal Information and Specific Personal Information
The University shall handle personal information and specific personal information
appropriately in performing all services that involve the handling of personal informationand specific personal information as follows:(1) Compliance with Laws and Regulations
The University shall comply with the Personal Information Act, the Individual Number
Act and other laws and regulations concerning personal information and specific personalinformation.
(2) Security Management Measures
The University shall take the security management measures that are necessary toprevent personal information and specific personal information from being divulged, lostor damaged, and otherwise to manage such information appropriately.
(3) Appropriate Collection, etc. and No Use for Other Purposes
The University shall collect, retain, use and provide personal information and specificpersonal information only to the extent necessary to achieve the purpose of use and shallpromptly dispose of such information that is no longer necessary.
In particular, the University shall handle specific personal information only to the extent
necessary for the processes set forth in the Individual Number Act and take measures toprevent the use of such information for purposes other than those for which such specificpersonal information is collected.
(4) Contracting
If the University appoints a contractor to perform all or part of processes that involve thehandling of personal information and specified personal information, the University shallsupervise the contractor (including any subcontractor thereof) as appropriate andnecessary in order that the contractor may take an equivalent level of security
management measures as those taken by the University itself.
(5) Continuous Improvement
The University shall review and make efforts to improve the University’s regulations, etc.
as well as the protection and management system concerning personal information andspecified personal information on a continuing basis.
3. Support Contact (also serving as a contact for handling disclosure requests, complaints,etc.)
Office of Compliance and Harassment
Additional Entry
This decision shall be implemented from October 27, 2015, and apply from October 5 of thesame year.
Additional Entry (March 24, 2022)
This decision shall be implemented from April 1, 2022.
Additional Entry (March 23, 2023)
This decision shall be implemented from April 1, 2023.