Comparative table of the current and amended provisions of the APPI
(Tentative translation)
After amendment
Current
Table of Contents
Table of Contents
Chapters 1 to 3 [Omission]
Chapters 1 to 3 [Omission]
Chapter 4 Obligations etc. of a Personal Information Chapter 4 Obligations etc. of a Personal Information
Handling Business Operator
Handling Business Operator
Section 1 Obligations of a Personal Information Section 1 Obligations of a Personal Information
Handling Business Operator etc. (Articles 15 to 35)
Handling Business Operator (Articles 15 to 35)
Section 2 Obligations of a Pseudonymously Processed
Information Handling Business Operator etc. (Article
35-2 and Article 35-3)(added)Section 3 Obligations of an Anonymously Processed
Information Handling Business Operator etc.
(Articles 36 to 39)

Section 2 Obligations of an Anonymously Processed
Information Handling Business Operator etc. (Articles
36 to 39)

Section 4 Supervision (Articles 40 to 46)

Section 3 Supervision (Articles 40 to 46)

Section 5 Private Sector Body’s Promotion for theProtection of Personal Information (Articles 47 to 58)

Section 4 Private Sector Body’s Promotion for theProtection of Personal Information (Articles 47 to 58)

Section 6 Service (Articleｓ 58-2 to 58-5)(added)Chapters 5 to 7 [Omission]
Supplementary provisions

Chapters 5 to 7 [Omission]
Supplementary provisions

Chapter 1 General Provisions

Chapter 1 General Provisions（Purpose）
Article 1 [Omission]（Purpose）
Article 1 [Omission]（Definition）
Article 2(1) “Personal information” in this Act means that
information relating to a living individual which falls
under any of each following item:（Definition）
Article 2(1) “Personal information” in this Act means that
information relating to a living individual which falls
under any of each following item:(i) those containing a name, date of birth, or otherdescriptions etc. (meaning any and all matters(excluding an individual identification code) stated,recorded or otherwise expressed using voice,movement or other methods in a document, drawing
or electromagnetic record (meaning a record kept inan electromagnetic form (meaning an electronic,
magnetic or other forms that cannot be recognizedthrough the human senses; the same shall apply in the
succeeding paragraph, item (ii)); the same shall apply(i) those containing a name, date of birth, or otherdescriptions etc. (meaning any and all matters(excluding an individual identification code) stated,recorded or otherwise expressed using voice,movement or other methods in a document, drawing
or electromagnetic record (meaning a record kept inan electromagnetic form (meaning an electronic,
magnetic or other forms that cannot be recognizedthrough the human senses; the same shall apply in the
succeeding paragraph, item (ii)); the same shall apply

1/28

in Article 18, paragraph (2) and Article 28, paragraph(1)); hereinafter the same) whereby a specificindividual can be identified (including those which canbe readily collated with other information and thereby
identify a specific individual)(ii)[Omission](2) to (6)(ii)[Omission][Omission](2) to (6)(7) “Retained personal data” in this Act means
personal data which a personal information handlingbusiness operator has the authority to disclose,
correct, add or delete the contents of, cease theutilization of, erase, and cease the third-party
provision of, and which shall not be those prescribedby cabinet order as likely to harm the public or otherinterests if their presence or absence is made known.

(8)

in Article 18, paragraph (2)); hereinafter the same)
whereby a specific individual can be identified(including those which can be readily collated withother information and thereby identify a specificindividual)(7) “Retained personal data” in this Act means
personal data which a personal information handlingbusiness operator has the authority to disclose,
correct, add or delete the contents of, cease theutilization of, erase, and cease the third-party
provision of, and which shall be neither thoseprescribed by cabinet order as likely to harm thepublic or other interests if their presence or absence
is made known nor those set to be deleted within aperiod of no longer than one year that is prescribedby cabinet order.
(8)[Omission][Omission](9) “Pseudonymously processed information” in thisAct means information relating to an individual thatcan be produced from processing personal information
so as not to be able to identify a specific individual
unless collated with other information by taking action
prescribed in each following item in accordance withthe divisions of personal information set forth in eachsaid item.

(added)(i) personal information falling under paragraph (1),item (i); Deleting a part of descriptions etc. containedin the said personal information (including replacing
the said part of descriptions etc. with otherdescriptions etc. using a method with no regularitythat can restore the said part of descriptions etc.)（added）(ii) personal information falling under paragraph (1), （added）
item (ii); Deleting all individual identification codes
contained in the said personal information (including
replacing the said individual identification codes withother descriptions etc. using a method with noregularity that can restore the said personal
identification codes)(10) A “pseudonymously processed information
handling business operator” in this Act means aperson who provides for use in business a collective
body of information comprising pseudonymously
processed information which has been systematically[Omission]（added）

2/28

organized so as to be able to search using a computerfor specific pseudonymously processed information orsimilar others prescribed by cabinet order assystematically organized so as to be able to searcheasily for specific pseudonymously processed
information (referred to as an “pseudonymously
processed information database etc.” in Article 35-2,
paragraph (1)). However, a person set forth in each
item of paragraph (5) is excluded.
(11)・(12)[Omission]

Articles 3 to 6

(９)・(10)[Omission][Omission]

Articles 3 to 6

[Omission]

Chapter 3 Measures etc. for the Protection of
Personal Information
Section 1 Basic Policy on the Protection of Personal
Information

Chapter 3 Measures etc. for the Protection of
Personal Information
Section 1 Basic Policy on the Protection of Personal
Information

Article 7(1) [Omission]

Article 7(1) [Omission](2) A basic policy shall prescribe those matters set
forth in the following.

(2) A basic policy shall prescribe those matters set
forth in the following.

(i) to (v)(i) to (v)[Omission][Omission](vi) a basic matter concerning action to be taken by apersonal information handling business operator, apseudonymously processed information handlingbusiness operator, and an anonymously processed
information handling business operator, and, anaccredited
personal
information
protection
organization prescribed in Article 50, paragraph (1)for the protection of personal information.

(vi) a basic matter concerning action to be taken by apersonal information handling business operator andan anonymously processed information handlingbusiness operator, and, an accredited personal
information protection organization prescribed in
Article 50, paragraph (1) for the protection of
personal information(vii)・(viii)[Omission](vii)・(viii)[Omission](3) to (5)[Omission](3) to (5)[Omission]

Section 2 Measures by the Central Government
Articles 8 to 14 [Omission]
Chapter 4 Obligations etc. of a Personal Information
Handling Business Operator
Section 1 Obligations of a Personal Information
Handling Business Operator etc.

Section 2 Measures by the Central Government
Articles 8 to 14 [Omission]
Chapter 4 Obligations etc. of a Personal Information
Handling Business Operator
Section 1 Obligations of a Personal Information
Handling Business Operator

Articles 15・16

Articles 15・16[Omission](Prohibition of Inappropriate Utilization)
Article 16-2 A Personal Information HandlingBusiness Operator shall not utilize personal
information using a method that has the possibility of（added）

3/28[Omission]fomenting or prompting unlawful or unfair act.
Articles 17 to 19[Omission]

Articles 17 to 19[Omission]（Security Control Action）
Article 20 A personal information handling business
operator shall take necessary and appropriate action
for the security control of personal data including
preventing the leakage, loss or damage of its handled
personal data.

（Security Control Action）
Article 20 A personal information handling business
operator shall take necessary and appropriate action
for the security control of personal data including
preventing the leakage, loss or damage of its handled
personal data.

Articles 21・22

Articles 21・22[Omission][Omission](Report etc. of Leakage etc.)（added）
Article 22-2
(1) A personal information handling business operator
shall, pursuant to rules of the Personal Information
Protection Commission, report to the Personal
Information Protection Commission when there is aleakage, loss or damage and other situation
concerning the insurance of security of its handled
personal data and it is prescribed by the rule of
Personal Information Protection Commission as thoseof which there is a large possibility of harming an
individual's rights and interests. This, however, shallnot apply in cases where the said personal information
handling business operator entrusted by otherpersonal information handling business operator awhole or part of the said handling of personal data
informed the occurrence of said situation to the said
other personal information handling business operator
as prescribed by rules of the Personal Information
Protection Commission.
(2) In those cases prescribed by the preceding
paragraph, a personal information handling business
operator (excluding those who informed pursuant to
the provisions of the proviso of the preceding
paragraph) shall, pursuant to rules of the Personal
Information Protection Commission, notify a principalof the occurrence of the said situation. This, however,shall not apply when it is difficult to inform a principal
and when necessary alternative action is taken toprotect a principal's rights and interests.

（added）（Restriction on Third Party Provision）
Article 23(1) [Omission]（Restriction on Third Party Provision）
Article 23(1) [Omission](2) A personal information handling business operator,
in regard to personal data provided to a third party
may, in cases where it is set to cease in response toa principal’s request a third-party provision of(2) A personal information handling business operator,
in regard to personal data provided to a third party(excluding special care-required personal information;
hereinafter the same in this paragraph), may, in cases

4/28

personal data that can identify the principal and whenpursuant to rules of the Personal Information
Protection Commission it has in advance informed aprincipal of those matters set forth in the following or
put them into a state where a principal can easily
know, and notified them to the Personal Information
Protection Commission, provide the said personal
data to a third party notwithstanding the provisionsof the preceding paragraph. This, however, shall not
apply in cases where personal data provided to a third
party is a special care-required personal information,or, has been acquired in violation of the provisions ofArticle 17 or has been provided by another personal
information handling business operator pursuant to
the provisions in the main clause of this paragraph(including their wholly or partially duplicated orprocessed ones).

where it is set to cease in response to a principal’s
request a third-party provision of personal data that
can identify the principal and when pursuant to rulesof the Personal Information Protection Commission it
has in advance informed a principal of those mattersset forth in the following or put them into a state
where a principal can easily know, and notified themto the Personal Information Protection Commission,
provide the said personal data to a third party
notwithstanding the provisions of the preceding
paragraph.

(i) The name or appellation and address and, for a
corporate body, the name of its representative (for a
non-corporatebodyhavingappointed
arepresentativeoradministrator,
thesaidrepresentative or administrator；hereinafter the samein this Article, Article 26, paragraph (1), item (i), andArticle 27, paragraph (1), item (i)) of a personal
information handling business operator that provides
to a third party.

（added）(ii)・(iii)[Omission](i)・(ii)(iv) a method of acquiring personal data provided to athird party（added）(v) to (vii)(iii) to (v)[Omission][Omission][Omission](viii) other matters prescribed by rules of the Personal
Information Protection Commission as thosenecessary to protect an individual's rights andinterests（added）(3) A personal information handling business operator
shall, in case of those matters set forth in item (i) of
the preceding paragraph are altered or when the
personal data provision is stopped pursuant to theprovisions of the preceding paragraph, without delay,
and when intending to alter those matters set forth initem (iii) to item (v), item (vii) or item (viii) of thepreceding paragraph, in advance inform a principal tothat effect or put them into a state where a principal
can easily know and notify them to the Personal
Information Protection Commission pursuant to rulesof the Personal Information Protection Commission.

(3) A personal information handling business operator
shall, in case of altering those matters set forth initem (ii), item (iii) or item (v) of the preceding
paragraph, in advance inform a principal of thecontents to be altered or put them into a state wherea principal can easily know and notify them to the
Personal Information Protection Commission pursuant
to rules of the Personal Information Protection
Commission.

5/28

(4)

(4)

[Omission][Omission](5) In those cases set forth in the following, a person
receiving the provision of the said personal data shallnot fall under a third party in regard to applying theprovisions of each preceding paragraph.

(5) In those cases set forth in the following, a person
receiving the provision of the said personal data shallnot fall under a third party in regard to applying theprovisions of each preceding paragraph.

(i)・(ii)(i)・(ii)[Omission][Omission](iii) cases in which personal data to be jointly utilized
by a specified person is provided to the specified
person, and when a principal has in advance been
informed or a state has been in place where a principal
can easily know to that effect as well as of thecategories of the jointly utilized personal data, thescope of a jointly utilizing person, the utilization
purpose for the utilizing person and the name orappellation and address, and, for a corporate body,the name of its representative of a person responsible
for controlling the said personal data(iii) cases in which personal data to be jointly utilized
by a specified person is provided to the specified
person, and when a principal has in advance been
informed or a state has been in place where a principal
can easily know to that effect as well as of thecategories of the jointly utilized personal data, thescope of a jointly utilizing person, the utilization
purpose for the utilizing person and the name orappellation of a person responsible for controlling thesaid personal data.

(6) A personal information handling business operator
shall, in case of altering the name, appellation or
address, or, for a corporate body, the name of its
representative of a person responsible for controllingpersonal data prescribed in item (iii) of the preceding
paragraph, without delay, and in case of altering autilization purpose for a utilizing person or the person
responsible prescribed in item (iii) of the preceding
paragraph, in advance inform a principal of thecontents to be altered or put them into a state wherea principal can easily know.

(6) A personal information handling business operator
shall, in case of altering a utilization purpose for autilizing person, or, the name or appellation of aperson responsible for controlling personal data
prescribed in item (iii) of the preceding paragraph, inadvance inform a principal of the contents to bealtered or put them into a state where a principal caneasily know.

(Restriction on Provision to a Third Party in a Foreign
Country)
Article 24(1) A personal information handling business operator,
except in those cases set forth in each item of thepreceding Article, paragraph (1), shall, in case ofproviding personal data to a third party (excluding aperson establishing a system conforming to standards
prescribed by rules of the Personal Information
Protection Commission as necessary for continuously
taking action equivalent to the one that a personal
information handling business operator shall takeconcerning the handling of personal data pursuant to
the provisions of this Section (referred to as“equivalent action” in paragraph (3)); hereinafter thesame in this paragraph, the succeeding paragraph andArticle 26-2, paragraph (1), item(ii)) in a foreigncountry (meaning a country or region located outside
the territory of Japan; hereinafter the same)(excluding those prescribed by rules of the Personal(Restriction on Provision to a Third Party in a Foreign
Country)
Article 24
A personal information handling business operator,
except in those cases set forth in each item of thepreceding Article, paragraph (1), shall, in case ofproviding personal data to a third party (excluding aperson establishing a system conforming to standards
prescribed by rules of the Personal Information
Protection Commission as necessary for continuously
taking action equivalent to the one that a personal
information handling business operator shall takeconcerning the handling of personal data pursuant to
the provisions of this Section; hereinafter the same inthis Article) in a foreign country (meaning a country
or region located outside the territory of Japan;
hereinafter the same) (excluding those prescribed byrules of the Personal Information Protection
Commission as a foreign country establishing apersonal information protection system recognized to

6/28

Information Protection Commission as a foreigncountry establishing a personal information protection
system recognized to have equivalent standards tothat in Japan in regard to the protection of anindividual’s rights and interests; hereinafter the samein this Article and the succeeding paragraph, and,
Article 26-2, paragraph (1), item (ii)), in advanceobtain a principal’s consent to the effect that he or
she approves the provision to a third party in a foreigncountry. In this case, the provisions of the preceding
Article shall not apply.

have equivalent standards to that in Japan in regard
to the protection of an individual’s rights andinterests; hereinafter the same in this Article), in
advance obtain a principal’s consent to the effect thathe or she approves the provision to a third party in aforeign country. In this case, the provisions of thepreceding Article shall not apply.

(2) A personal information handling business operator
shall, in case of intending to obtain a principal’s
consent pursuant to the provisions of the preceding
paragraph, in advance provide the principal withinformation on the personal information protection
system of the foreign country, on the action the third
party takes for the protection of personal information,and other information that is to serve as a reference
to the principal, pursuant to rules of the Personal
Information Protection Commission.

（added）(3) A personal information handling business operator （added）
shall, when having provided personal data to a third
party (limited to person establishing a systemprescribed in paragraph (1)) in a foreign country,
pursuant to rules of the Personal Information
Protection Commission, take necessary action toensure continuous implementation of the equivalentaction by the third party, and, in response to aprincipal's request, provide information on thenecessary action, to the principal.
（ Keeping etc. of a Record on a Third-Party
Provision）
Article 25(1) A personal information handling business operator
shall, when having provided personal data to a third
party (excluding a person set forth in each item of
Article 2, paragraph (5); hereinafter the same in this
Article and the succeeding Article (including cases
where it is applied mutatis mutandis pursuant to
Article 26-2, paragraph (3) following the deemed
replacement of terms)), keep a record pursuant torules of the Personal Information Protection
Commission on the date of the personal data
provision, the name or appellation of the third party,
and other matters prescribed by rules of the Personal
Information Protection Commission. This, however,shall not apply in cases where the personal data
provision falls under any of each item of Article 23,
paragraph (1) or paragraph (5) (this means, in case of（ Keeping etc. of a Record on a Third-Party
Provision）
Article 25(1) A personal information handling business operator
shall, when having provided personal data to a third
party (excluding a person set forth in each item of
Article 2, paragraph (5); hereinafter the same in this
Article and the succeeding Article), keep a record
pursuant to rules of the Personal Information
Protection Commission on the date of the personal
data provision, the name or appellation of the third
party, and other matters prescribed by rules of the
Personal Information Protection Commission. This,
however, shall not apply in cases where the personal
data provision falls under any of each item of Article
23, paragraph (1) or paragraph (5) (this means, in caseof a personal data provision pursuant to the provisionsof the preceding Article, any of each item of Article
23, paragraph (1)).

7/28

a personal data provision pursuant to the provisionsof the preceding Article, paragraph (1), any of each
item of Article 23, paragraph (1)).
(2)[Omission](2)[Omission]（ Confirmation etc. when Receiving a Third Party
Provision)
Article 26(1) A personal information handling business operator
shall, when receiving the provision of personal datafrom a third party, confirm those matters set forth in
the following pursuant to rules of the Personal
Information Protection Commission. This, however,shall not apply in cases where the said personal data
provision falls under any of each item of Article 23,
paragraph (1) or paragraph (5).

（ Confirmation etc. when Receiving a Third Party
Provision)
Article 26(1) A personal information handling business operator
shall, when receiving the provision of personal datafrom a third party, confirm those matters set forth in
the following pursuant to rules of the Personal
Information Protection Commission. This, however,shall not apply in cases where the said personal data
provision falls under any of each item of Article 23,
paragraph (1) or paragraph (5).

(i) the name or appellation and address and, for a
corporate body, the name of its representative of thethird party(i) the name or appellation and address of the third
party and, for a corporate body, the name of its
representative (for a non-corporate body having
appointed a representative or administrator, the said
representative or administrator)

(ii)

(ii)

[Omission](2) to (4)[Omission][Omission](2) to (4)(Restriction on Third Party Provision of Personally （added）
Referable Information)
Article 26-2
(1) A personally referable information handlingbusiness operator (meaning a person providing apersonally referable information database etc.
(Meaning a collective body of information comprising
personally referable information (Meaning information
relating to a living individual which does not fall under
personal information, pseudonymously processed
information or anonymously processed information;
the same applies hereinafter) which has beensystematically organized so as to be able to searchusing a computer for specific personally referable
information or similar others prescribed by cabinet
order as systematically organized so as to be able tosearch easily for specific personally referable
information; the same applies hereinafter) for use inbusiness, however, excluding a person set forth ineach item of Article 2, paragraph (5); the same applies
hereinafter) shall, if it is assumed that a third party
will acquire personally referable information (limited
to those constituting personally referable information
database etc.; the same applies hereinafter) as
personal data, except in those cases set forth in each
8/28

[Omission]

item of Article 23, paragraph (1), not provide thepersonally referable information to a third party
without confirming those matters set forth in thefollowing pursuant to rules of the Personal Information
Protection Commission.
(i) The principal’s consent to the effect that he or she
approves that the third party acquires personallyreferable information as personal data that canidentify the principal receives the provision of
personally referable information from handlingbusiness operator, has been obtained.

（added）(ii) For a provision to a third party in a foreigncountry, in case of intending to obtain the principal’s
consent referred to in the preceding item, pursuant
to rules of the Personal Information Protection
Commission, information on the personal information
protection system of the foreign country, on theaction the third party takes for the protection of
personal information, and other information that is toserve as a reference to the principal, have been
provided in advance to the principal.

（added）(2) The provisions of Article 24, paragraph (3) shall （added）
apply mutatis mutandis to the case that a personallyreferable information handling business operator
provides personally referable information pursuant to
the provisions of the preceding paragraph. In thiscase, the term “take necessary action to ensure
continuous implementation of the equivalent action by
the third party, and, in response to a principal's
request, provide information on the necessary action,
to the principal.” in Article 24, paragraph (3) isdeemed to be replaced with “take necessary action toensure continuous implementation of the equivalentaction by the third party.”(3) The provisions of preceding Article, paragraph (2)through paragraph (4) shall apply mutatis mutandis tothe case that a personally referable information
handling business operator confirms pursuant to theprovisions of paragraph (1). In this case, the term“received the provision of” in the preceding Article,
paragraph (3) is deemed to be replaced with“provided.”（added）（ Public Disclosure etc. on Matters relating toRetained Personal Data）
Article 27(1) A personal information handling business operator
shall, concerning its retained personal information,
put those matters set forth in the following into a（ Public Disclosure etc. on Matters relating toRetained Personal Data）
Article 27(1) A personal information handling business operator
shall, concerning its retained personal information,
put those matters set forth in the following into a state

9/28

state where a principal can know (including thosecases in which it, at the request of a principal,
responds without delay).

where a principal can know (including those cases inwhich it, at the request of a principal, responds
without delay).

(i) the name or appellation and address and, for a
corporate body, the name of its representative of thesaid personal information handling business operator(i) the name or appellation of the said personal
information handling business operator

(ii)

(ii)

[Omission][Omission](iii) the procedures for responding to a request
pursuant to the provisions of the succeeding
paragraph, or, a demand pursuant to the provisions of
the succeeding Article, paragraph (1) (including as
applied mutatis mutandis pursuant to the succeeding
Article, paragraph (5)); Article 29, paragraph (1); or
Article 30, paragraph (1), paragraph (3) or paragraph(5) (including, when the amount of a fee has been
decided pursuant to the provisions of Article 33,
paragraph (2), the amount of the fee)(iii) the procedures for responding to a request
pursuant to the provisions of the succeeding
paragraph, or, a demand pursuant to the provisions of
the succeeding Article, paragraph (i); Article 29,
paragraph (1); or Article 30, paragraph (1) orparagraph (3) (including, when the amount of a fee has
been decided pursuant to the provisions of Article 33,
paragraph (2), the amount of the fee)

(iv)

(iv)

[Omission](2)・(3)[Omission][Omission](2)・(3)[Omission]（Disclosure）
Article 28(1) A principal may demand of a personal information
handling business operator disclosure of retained
personal data that can identify him or herself by amethod of providing electromagnetic record oｒ othermethods prescribed by rules of the Personal
Information Protection Commission.

（Disclosure）
Article 28(1) A principal may demand of a personal information
handling business operator disclosing retained
personal data that can identify him or herself.

(2) A personal information handling business operator
shall, when having received a demand pursuant to theprovisions of the preceding paragraph, discloseretained personal data to a principal without delay
pursuant to a method the principal demands pursuant
to the provisions of the preceding paragraph (in cases
where disclosure by the method requires a large
amount of expenses or when disclosure by other said
method is difficult, by a method of delivering a written
document). However, in cases where disclosing suchdata falls under any of each following item, a whole orpart thereof may not be disclosed.

(2) A personal information handling business operator
shall, when having received a demand pursuant to theprovisions of the preceding paragraph, discloseretained personal data to a principal without delay
pursuant to a method prescribed by cabinet order.
However, in cases where disclosing such data falls
under any of each following item, a whole or part
thereof may not be disclosed.

(i) to (iii)(i) to (iii)[Omission](3) A personal information handling business operator
shall, when having decided not to disclose a whole orpart of retained personal data in connection with ademand pursuant to the provisions of paragraph (1),[Omission](3) A personal information handling business operator
shall, when having decided not to disclose a whole orpart of retained personal data in connection with ademand pursuant to the provisions of paragraph (1) or

10/28

when the retained personal data does not exist, or,when disclosure by a method a principal demanded
pursuant to the provisions of the said paragraph isdifficult, inform a principal thereof without delay.
(4)[Omission]

when the retained personal data does not exist, informa principal thereof without delay.

(4)[Omission](5) The provisions of paragraph (1) through paragraph(3) shall apply mutatis mutandis to records (excluding
those prescribed by cabinet order as likely to harm
the public or other interests if their presence orabsence is made known; referred to as a “Third party
provision record” in Article 32, paragraph (2)) in
Article 25, paragraph (1) and Article 26, paragraph(3) related to personal data that can identify theprincipal.

（added）（Correction etc.）
Article 29 [Omission]（Correction etc.）
Article 29 [Omission]（Utilization Cease etc.）
Article 30(1) A principal may, when retained personal data that
can identify the principal is being handled in violationof the provisions of Article 16 or Article 16-2, or, hasbeen acquired in violation of the provisions of Article
17, demand of a personal information handlingbusiness operator a utilization cease or deletion(hereinafter referred to as a “utilization cease etc.”
in this Article) of the retained personal data.

（Utilization Cease etc.）
Article 30(1) A principal may, when retained personal data that
can identify the principal is being handled in violationof the provisions of Article 16 or has been acquired inviolation of the provisions of Article 17, demand of apersonal information handling business operator autilization cease or deletion (hereinafter referred toas a “utilization cease etc.” in this Article) of theretained personal data.

(2) to (4)(2) to (4)[Omission](5) A principal may demand that the personal
information handling business operator fulfill autilization cease etc. of the retained personal data, orcease a third-party provision, if it has become
unnecessary for a personal information handlingbusiness operator to utilize retained personal datathat can identify the principal, if a situation prescribedin the main clause of Article 22-2, paragraph (1) has
occurred in connection with the retained personal
data that can identify the principal, or there is apossibility that handling of the retained personal datathat can identify the principal would harm the rights
or legitimate interests of the principal.

（added）(6) A personal information handling business operator
shall, in case of having received a demand pursuant
to the provisions of the preceding paragraph and when
it has become clear that there is a reason in the
demand, fulfill a utilization cease etc. or cease athird-party provision of the said retained personal（added）

11/28[Omission]data to the extent necessary to prevent an
infringement of a principal's rights and interests
without delay. This, however, shall not apply in cases
where a utilization cease etc. or ceasing a third-party
provision of the said retained personal data requiresa large amount of expenses or other cases where it isdifficult to fulfil a utilization cease etc. or to cease athird-party provision and when necessary alternative
action is taken to protect a principal's rights andinterests.
(7) A personal information handling business operator
shall, when having fulfilled a utilization cease etc. or
decided not to fulfill a utilization cease etc. of a wholeor part of retained personal data in connection with ademand pursuant to the provisions of paragraph (1) orparagraph (5), or, when having ceased a third-party
provision or decided not to cease a third-party
provision of a whole or part of retained personal datain connection with a demand pursuant to theprovisions of paragraph (3) or paragraph (5), inform a
principal to that effect without delay.

(5) A personal information handling business operator
shall, when having fulfilled a utilization cease etc. or
decided not to fulfill a utilization cease etc. of a wholeor part of retained personal data in connection with ademand pursuant to the provisions of paragraph (1),or, when having ceased a third-party provision or
decided not to cease a third-party provision of awhole or part of retained personal data in connection
with a demand pursuant to the provisions of paragraph(3), inform a principal to that effect without delay.

（Explanation of Reason）
Article 31
A personal information handling business operator
shall, in case of informing a principal to the effect that,as regards a whole or part of action requested or
demanded by the principal pursuant to the provisionsof Article 27, paragraph (3); Article 28, paragraph (3)(including as applied mutatis mutandis pursuant to thesucceeding Article 28, paragraph (5)); Article 29,
paragraph (3); or the preceding Article, paragraph (7),the action will not be taken, or to the effect thatdifferent action from the said action will be taken,
strive to explain a reason therefor to the saidprincipal.

（Explanation of Reason）
Article 31
A personal information handling business operator
shall, in case of informing a principal to the effect that,as regards a whole or part of action requested or
demanded by the principal pursuant to the provisionsof Article 27, paragraph (3); Article 28, paragraph (3);Article 29, paragraph (3); or the preceding Article,
paragraph (5), the action will not be taken, or to theeffect that different action from the said action will betaken, strive to explain a reason therefor to the saidprincipal.

（ Procedure for Responding to a Demand etc. forDisclosure etc.）
Article 32(1) A personal information handling business operator
may, as regards a request pursuant to the provisionsof Article 27, paragraph (2), or, a demand pursuant to
the provisions of Article 28, paragraph (1) (including
as applied mutatis mutandis pursuant to thesucceeding Article 28, paragraph (5); the same apply
in the following Article, paragraph (1) and Article 34);
Article 29, paragraph (1); Article 30, paragraph (1),paragraph (3) or paragraph (5) (hereinafter referred toas a “demand etc. for disclosure etc.” in this Article
and Article 53, paragraph (1)), decide on a method ofreceiving a request or demand pursuant to those（ Procedure for Responding to a Demand etc. forDisclosure etc.）
Article 32(1) A personal information handling business operator
may, as regards a request pursuant to the provisionsof Article 27, paragraph (2), or, a demand pursuant to
the provisions of Article 28, paragraph (1); Article 29,
paragraph (1); Article 30, paragraph (1) or paragraph(3) (hereinafter referred to as a “demand etc. fordisclosure etc.” in this Article and Article 53,
paragraph (1)), decide on a method of receiving arequest or demand pursuant to those prescribed bycabinet order. In this case, a principal shall make ademand etc. for disclosure etc. in accordance with themethod.

12/28

prescribed by cabinet order. In this case, a principal
shall make a demand etc. for disclosure etc. inaccordance with the method.
(2) A personal information handling business operator
may, as regards a demand etc. for disclosure etc.,
request a principal to present a matter sufficient tospecify retained personal data or a third party
provision record subject to the demand etc. In thiscase, a personal information handling business
operator shall take appropriate action inconsideration of a principal’s convenience such asproviding information conducive to specify theretained personal data or the third party provision
record so that the principal would be able to easily
and precisely make a demand etc. for disclosure etc.
(3)・(4)（Fee）
Article 33[Omission](3)・(4)（Fee）
Article 33[Omission]（Advance Demand）
Article 34(1) A principal may, when intending to file a lawsuit inconnection with a demand pursuant to the provisionsof Article 28, paragraph (1); Article 29, paragraph (1);or Article 30, paragraph (1), paragraph (3) orparagraph (5), not file the lawsuit unless the principal
had previously issued the demand against a person
who should become a defendant in the lawsuit and two
weeks have passed from the delivery day of the issued
demand. This, however, shall not apply when the
person who should become a defendant in the lawsuit
has rejected the demand.
(2)(2) A personal information handling business operator
may, as regards a demand etc. for disclosure etc.,
request a principal to present a matter sufficient tospecify retained personal data subject to the demand
etc. In this case, a personal information handlingbusiness operator shall take appropriate action inconsideration of a principal’s convenience such asproviding information conducive to specify theretained personal data so that the principal would be
able to easily and precisely make a demand etc. fordisclosure etc.

[Omission][Omission][Omission]（Advance Demand）
Article 34(1) A principal may, when intending to file a lawsuit inconnection with a demand pursuant to the provisionsof Article 28, paragraph (1); Article 29, paragraph (1);or Article 30, paragraph (1) or paragraph (3), not filethe lawsuit unless the principal had previously issued
the demand against a person who should become adefendant in the lawsuit and two weeks have passed
from the delivery day of the issued demand. This,
however, shall not apply when the person who should
become a defendant in the lawsuit has rejected thedemand.
(2)[Omission](3) The provisions of the preceding two paragraphs
shall apply mutatis mutandis to a petition for aprovisional disposition order in connection with ademand pursuant to the provisions of Article 28,
paragraph (1); Article 29, paragraph (1); or Article 30,
paragraph (1), paragraph (3) or paragraph (5).

(3) The provisions of the preceding two paragraphs
shall apply mutatis mutandis to a petition for aprovisional disposition order in connection with ademand pursuant to the provisions of Article 28,
paragraph (1); Article 29, paragraph (1); or Article 30,
paragraph (1) or paragraph (3).

（Personal Information Handling Business Operator’s
Dealing with a Complaint）
Article 35 [Omission]（Personal Information Handling Business Operator’s
Dealing with a Complaint）
Article 35 [Omission]

Section 2 Obligations of a Pseudonymously Processed
Information Handling Business Operator etc.

（added）

13/28

(Production etc. of Pseudonymously Processed
Information)
Article 35-2
(1) A personal information handling business operator
shall, when producing pseudonymously processed
information(limited
tothoseconstituting
pseudonymously processed information database etc.;
hereinafter the same), process personal information inaccordance with standards prescribed by rules of the
Personal Information Protection Commission as thosenecessary to make it impossible to identify a specificindividual unless collated with other information.

（added）(2) A personal information handling business operator,
when having produced pseudonymously processed
information or having acquired pseudonymously
processed information and deleted information etc.
(meaning information related to descriptions etc. andindividual identification codes that were deleted frompersonal information that was used to produce thepseudonymously processed information, and, amethod of processing carried out pursuant to theprovisions of the preceding paragraph; hereinafter thesame applies in this Article, and in Article 35-2,
paragraph (7), as applied mutatis mutandis pursuant
to Article 35-3, paragraph (3) following the deemed
replacement of terms) related to the pseudonymously
processed information shall, in accordance withstandards prescribed by rules of the Personal
Information Protection Commission as thosenecessary to prevent the leakage of deleted
information etc., take action for the security control
of deleted information etc.

（added）(3) A pseudonymously processed information handlingbusiness operator (limited to those that are personal
information handling business operators; hereinafter
the same applies in this Article) shall, notwithstanding
the provisions of Article 16, except in cases based onlaws and regulations, not handle a pseudonymously
processed information (limited to those that are
personal information; hereinafter the same applies inthis Article) beyond the necessary scope to achieve
the utilization purpose specified pursuant to theprovisions of Article 15, paragraph (1).

（added）(4) With regard to applying the provisions of Article
18 related to pseudonymously processed information,
the phrase “inform a principal of, or disclose to the
public” in Article 18, paragraph (1) and paragraph (3)is deemed to be replaced with “disclose to the
public”; the phrase “informing a principal of, ordisclosing to the public,” in the provisions of Article（added）

14/28

18, paragraph (4), item (i) through (iii), is deemed tobe replaced with “disclosing to the public”.
(5) A pseudonymously processed information handlingbusiness operator shall strive to delete personal datathat are pseudonymously processed information anddeleted information etc. without delay whenutilization of the personal data and the deleted
information etc. has become unnecessary. In thiscase, the provisions of Article 19 shall not apply.

（added）(6) A pseudonymously processed information handlingbusiness operator shall, notwithstanding theprovisions of Article 23, paragraph (1) and paragraph(2), and, Article 24, paragraph (1), except in cases
based on laws and regulations, not provide personal
data that is pseudonymously processed information toa third party. In this case, the phrase “each preceding
paragraph” in Article 23, paragraph (5) is deemed tobe replaced with “Article 35-2, paragraph (6)”; thephrase “a principal has in advance been informed or astate has been in place where a principal can easilyknow” in item (iii) of the said paragraph, is deemed tobe replaced with “it is disclosed to the public in
advance”; the phrase “inform a principal of thecontents to be altered or put them into a state wherea principal can easily know” in Article 23, paragraph(6), is deemed to be replaced with “disclose to the
public, the contents to be altered”; the phrase “anyof each item of Article 23, paragraph (1) or paragraph(5) (this means, in case of a personal data provision
pursuant to the provisions of the preceding Article,
any of each item of Article 23, paragraph (1))” in theproviso of Article 25, paragraph (1), and, the phrase“any of each item of Article 23, paragraph (1) orparagraph (5)” in the proviso of Article 26, paragraph(1), is deemed to be replaced with “cases based onlaws and regulations or any of each item of Article 23,
paragraph (5)”.

(added)(7) A pseudonymously processed information handlingbusiness operator, shall, in handling pseudonymously
processed information, not collate the said
pseudonymously processed information with otherinformation in order to identify a principal concernedwith personal information used to produce thepseudonymously processed information.

(added)(8) A pseudonymously processed information handling (added)
business operator, shall, in handling pseudonymously
processed information, not utilize a contact address
and
other
information
contained
inthepseudonymously
processed
information
for
15/28

telephoning, sending by post or by a correspondence
delivery prescribed in Article 2, paragraph (2) of the
Act on Correspondence Delivery by Private Business
Operators (Act No. 99 of 2002) conducted by ageneral correspondence delivery operator prescribedin Article 2, paragraph (6) or a specified letter
delivery operator prescribed in Article 2, paragraph(9), delivering a telegram, transmitting by using a
facsimile machine or electronic or magnetic means(meaning means that use electronic data processing
system or means that utilize other information
communication technology as prescribed by rules of
the Personal Information Protection Commission), or,visiting a residence.
(9) The provisions of Article 15, paragraph (2), Article
22-2 and Article 27 through Article 34 shall not apply
in regard to pseudonymously processed information,
personal data that is pseudonymously processed
information and retained personal data that is
pseudonymously processed information.

(added)（ Restriction etc. on Third Party Provision of
Pseudonymously Processed Information）
Article 35-3
(1) A pseudonymously processed information handlingbusiness operator shall, except in cases based on laws
and regulations, not provide pseudonymously
processed information (excluding those that are
personal information; the same shall apply in the
succeeding paragraph and paragraph (3)) to a third
party.

(added)(2) The provisions of Article 23, paragraph (5) andparagraph (6) shall apply mutatis mutandis to a person
receiving the provision of pseudonymously processed
information. In this case, the phrase “each preceding
paragraph” in Article 23, paragraph (5) is deemed tobe replaced with “Article 35-3, paragraph (1)”; theterm “personal information handling business
operator” in item (i) of the said paragraph, is deemed
to be replaced with “pseudonymously processed
information handling business operator”; the phrase“a principal has in advance been informed or a state
has been in place where a principal can easily know”
in item (iii) of the said paragraph, is deemed to be
replaced with “it is disclosed to the public”; the term
“personal information handling business operator” inArticle 23, paragraph (6), is deemed to be replacedwith “pseudonymously processed information
handling business operator” and the phrase “inform a
principal of the contents to be altered or put theminto a state where a principal can easily know” is(added)16/28

deemed to be replaced with “disclose to the public,
the contents to be altered” in Article 23, paragraph(6).
(3) The provisions of Article 20 through Article 22,
Article 35, and, paragraph (7) and paragraph (8) of
the preceding Article shall apply mutatis mutandis tothe handling of pseudonymously processed
information by a pseudonymously processed
information handling business operator. In this case,the phrase “leakage, loss or damage” in Article 20 isdeemed to be replaced with “leakage” and the phrase“not” in Article 35-2, paragraph (7) is deemed to be
replaced with “neither acquire deleted information
etc., nor”.

(added)Section 3 Obligations of an Anonymously Processed
Information Handling Business Operator etc.

Section 2 Obligations of an Anonymously Processed
Information Handling Business Operator etc.

Articles 36 to 39

Articles 36 to 39[Omission][Omission]

Section 4 Supervision

Section 3 Supervision(Report and Onsite Inspection)
Article 40(1) The Personal Information Protection Commission
may, to the extent necessary to implement theprovisions under the preceding three Sections andthis Section, require a personal information handlingbusiness operator, a personally referable information
handling
business operator,
pseudonymously
processed information business operator oranonymously processed information handling business
operator (hereinafter referred to collectively as a“personal information handling business operatoretc.”) and other concerned person to submit
necessary information or material relating to thehandling of personal information, personally referable
information, pseudonymously processed informationor anonymously processed information (hereinafterreferred to collectively as “personal informationetc.”), or have its officials enter a business office orother necessary place of a personal information
handling business operator etc. or other concerned
person, inquire about the handling of personal
information etc., or inspect a book, document andother property.

(Report and Onsite Inspection)
Article 40(1) The Personal Information Protection Commission
may, to the extent necessary to implement theprovisions under the preceding two Sections and thisSection, require a personal information handlingbusiness operator or anonymously processed
information handling business operator (hereinafterreferred to collectively as a “personal information
handling business operator etc.”) to submit necessary
information or material relating to the handling of
personal information or anonymously processed
information (hereinafter referred to collectively as“personal information etc.”), or have its officials entera business office or other necessary place of apersonal information handling business operator etc.,
inquire about the handling of personal information
etc., or inspect a book, document and other property.

(2)・(3)[Omission](2)・(3)

17/28[Omission](Guidance and Advice)
Article 41
The Personal Information Protection Commission
may, to the extent necessary to implement theprovisions under the preceding three Sections,provide a personal information handling business
operator etc. with necessary guidance or advice on
the handling of personal information etc.

(Guidance and Advice)
Article 41
The Personal Information Protection Commission
may, to the extent necessary to implement theprovisions under the preceding two Sections, provide
a personal information handling business operator etc.
with necessary guidance or advice on the handling of
personal information etc.

(Recommendation and Order)
Article 42(1) The Personal Information Protection Commission
may, when recognizing there is a need for protecting
an individual’s rights and interests in cases where apersonal information handling business operator has
violated the provisions under Article 16 throughArticle 17, Article 18 (including the cases where theprovisions under paragraph (1), (3) and (4) are appliedwith replacement of terms pursuant to the Article 352, paragraph (4)), Article 20 through Article 22-2,
Article 23 (excluding paragraph (4); including thecases where the provisions under paragraph (5) and(6) are applied with replacement of terms pursuant to
Article 35-2, paragraph (6)), Article 24, Article 25(including the cases where the provisions of proviso
of paragraph (1) is applied with replacement of terms
pursuant to Article 35-2, paragraph (6)), Article 26(excluding paragraph (2); including the cases where
the provisions of proviso of paragraph (1) is appliedwith replacement of terms pursuant to Article 35-2,
paragraph (6)), Article 27, Article 28 (excluding
paragraph (1) (including as applied mutatis mutandis
pursuant to paragraph (5)), Article 29, paragraph (2)or (3), Article 30 (excluding paragraph (1), (3) and(5)), Article 33, paragraph (2), Article 35-2 (excluding
paragraph (4) and (5)) or Article 36 (excluding
paragraph (6)), in cases where a personally referable
information handling business operator has violated
the provisions under Article 26-2, paragraph (1), or,
the provisions of Article 24, paragraph (3), as appliedmutatis mutandis pursuant to Article 26-2, paragraph(2) following the deemed replacement of terms, or, theprovisions of Article 26, paragraph (3) or (4), as
applied mutatis mutandis pursuant to Article 26-2,
paragraph (3) following the deemed replacement ofterms, in cases where a pseudonymously processed
information handling business operator has violated
the provisions under Article 35-3, paragraph (1), or,
Article 23, paragraph (5) or (6), as applied mutatis
mutandis pursuant to Article 35-3, paragraph (2)following the deemed replacement of terms, or, theprovisions under Article 20 through Article 22 or
Article 35-2, paragraph (7) or (8) as applied mutatis(Recommendation and Order)
Article 42(1) The Personal Information Protection Commission
may, when recognizing there is a need for protecting
an individual’s rights and interests in cases where apersonal information handling business operator has
violated the provisions under Article 16 throughArticle 18, Article 20 through Article 22, Article 23(excluding paragraph (4)), Article 24, Article 25,
Article 26 (excluding paragraph (2)), Article 27,
Article 28 (excluding paragraph (1)), Article 29,
paragraph (2) or (3), Article 30 (2), paragraph (4) or(5), Article 33, paragraph (2) or Article 36 (excluding
paragraph (6)) or in cases where an anonymously
processed information handling business operator has
violated the provisions under Articles 37 or 38,
recommend the personal information handlingbusiness operator etc. to suspend the act of violatingor take other necessary action to rectify the violation.

18/28

mutandis pursuant to Article 35-3, paragraph (3)following the deemed replacement of terms, or, incases where an anonymously processed information
handling business operator has violated the provisions
under Articles 37 or 38, recommend the personal
information handling business operator etc. tosuspend the act of violating or take other necessary
action to rectify the violation.
(2)[Omission](2)[Omission](3) The Personal Information Protection Commission
may, notwithstanding the provisions under thepreceding two paragraphs when recognizing there is aneed to take urgent action because there is a fact that
seriously harms an individual’s rights and interests incases where a personal information handling business
operator has violated the provisions under Article 16
through Article 17, Article 20 through Article 22-2,
Article 23, paragraph (1), Article 24, paragraph (1) or(3), Article 35-2, paragraph (1) through (3), or
paragraph (6) through (8), or Article 36, paragraph(1), paragraph (2) or paragraph (5), in cases where apersonally referable information handling business
operator has violated the provisions under Article 262, paragraph (1), or, Article 24, paragraph (3), as
applied mutatis mutandis pursuant to Article 26-2,
paragraph (2) following the deemed replacement ofterms, in cases where a pseudonymously processed
information handling business operator has violated
the provisions under Article 35-3, paragraph (1), or,
Article 20 through Article 22 or Article 35-2,
paragraph (7) or (8), as applied mutatis mutandis
pursuant to Article 35-3, paragraph (3) following thedeemed replacement of terms, or, in cases where an
anonymously processed information handling business
operator has violated the provisions under Article 38,
order the personal information handling business
operator etc. to take necessary action to rectify theviolation such as suspending the act of violation.

(3) The Personal Information Protection Commission
may, notwithstanding the provisions under thepreceding two paragraphs when recognizing there is aneed to take urgent action because there is a fact that
seriously harms an individual’s rights and interests incases where a personal information handling business
operator has violated the provisions of Article 16,
Article 17, Article 20 through Article 22, Article 23,
paragraph (1), Article 24 or Article 36, paragraph (1),paragraph (2) or paragraph (5) or in cases where an
anonymously processed information handling business
operator has violated the provisions under Article 38,
order the personal information handling business
operator etc. to take necessary action to rectify theviolation such as suspending the act of violation.

(4) The Personal Information Protection Commission
may, in case of issuing an order pursuant to theprovisions under the preceding two paragraphs, when
the personal information handling business operator
etc. that has received the order has violated theorder, make public announcement to that effect.

(added)(Restriction on the Personal Information Protection
Commission’s Exercising the Authority)
Article 43 [Omission](Restriction on the Personal Information Protection
Commission’s Exercising the Authority)
Article 43 [Omission]

19/28

(Delegation of Authority)
Article 44(1) The Personal Information Protection Commission
may, when recognizing that there is a need for
effectively giving a personal information handlingbusiness operator a recommendation pursuant to theprovisions of Article 42, paragraph (1) or orderpursuant to the provisions of Article 42, paragraph (2)or (3) because there is a need to urgently andintensively seek ensuring the proper handling of
personal information etc. or similar othercircumstances prescribed by cabinet order, delegate
an authority under the provisions of Article 22-2,
paragraph (1), Article 40, paragraph (1), the Code ofCivil Procedure (Act No. 109 of 1996) Article 99,
Article 101, Article 103, Article 105, Article 106,
Article 108 and Article 109, as applied mutatis
mutandis pursuant to Article 58-3 following thedeemed replacement of terms, Article 58-4 andArticle 58-5 to a business jurisdictional minister asprescribed by cabinet order.

(Delegation of Authority)
Article 44(1) The Personal Information Protection Commission
may, when recognizing that there is a need for
effectively giving a personal information handlingbusiness operator a recommendation or orderpursuant to the provisions of Article 42 because there
is a need to urgently and intensively seek ensuring
the proper handling of personal information etc. orsimilar other circumstances prescribed by cabinet
order, delegate an authority under the provisions ofArticle 40, paragraph (1) to a business jurisdictional
minister as prescribed by cabinet order.

(2) to (9)(2) to (9)[Omission][Omission](Request by Business Jurisdictional Minister)
Article 45
A business jurisdictional minister may, whenrecognizing that there is a need for ensuring theproper handling of personal information etc. by apersonal information handling business operator etc.
including that there is an act of a personal information
handling business operator etc. violating theprovisions under the preceding three Sections,request the Personal Information Protection
Commission to take appropriate action in accordancewith the provisions of this Act.

(Request by Business Jurisdictional Minister)
Article 45
A business jurisdictional minister may, whenrecognizing that there is a need for ensuring theproper handling of personal information etc. by apersonal information handling business operator etc.
including that there is an act of a personal information
handling business operator etc. violating theprovisions under the preceding two Sections, request
the Personal Information Protection Commission totake appropriate action in accordance with theprovisions of this Act.

(Business Jurisdictional Minister)
Article 46 [Omission](Business Jurisdictional Minister)
Article 46 [Omission]

Section 5 Private-Sector Body’s Promotion for theProtection of Personal Information

Section 4 Private-Sector Body’s Promotion for theProtection of Personal Information(Accreditation)
Article 47(1) A corporation (including a non-corporate bodywhich has appointed a representative or
administrator; the same shall apply in the succeeding
Article, item (iii), (b)) which intends to render thefollowing services in order to ensure the proper
handling of personal information etc. (excluding
personally referable information; hereinafter the same
applies in this Section) by a personal information(Accreditation)
Article 47(1) A corporation (including a non-corporate bodywhich has appointed a representative or
administrator; the same shall apply in the succeeding
Article, item (iii), (b)) which intends to render thefollowing services in order to ensure the proper
handling of personal information etc. by a personal
information handling business operator etc. mayreceive an accreditation from the Personal

20/28

handling business operator etc. (excluding personallyreferable information handling business operator;
hereinafter the same applies in this Section) may
receive an accreditation from the Personal
Information Protection Commission.

Information Protection Commission.

(i) to (iii)(i) to (iii)[Omission][Omission](2) The accreditation set forth in the preceding
paragraph may be limited in respect of the type orscope of services of personal information handlingbusiness operator etc.

（added）(3) A person who intends to receive an accreditation
under paragraph (1) shall, as prescribed by cabinet
order, apply to the Personal Information Protection
Commission.

(2) A person who intends to receive an accreditation
under the preceding paragraph shall, as prescribed bycabinet order, apply to the Personal Information
Protection Commission.

(4) The Personal Information Protection Commission
shall, when having granted an accreditation under theparagraph (1), announce to the public to that effect(including the scope of services concerning theaccreditation, in cases of the accreditation limiting
the scope of services pursuant to the provisions ofparagraph (2)).

(3) The Personal Information Protection Commission
shall, when having granted an accreditation under theparagraph (1), announce to the public to that effect.

Articles 48・49

Articles 48・49[Omission][Omission](Accreditation of alteration etc.)（added）

Article 49-2
(1) A person who has received an accreditation under
Article 47, paragraph (1) (including the accreditation
limiting the scope of services pursuant to theprovisions of Article 47, paragraph (2); the same
applies to Article 48, paragraph (1) and Article 58,
paragraph (1), item (v)) must, when intending to alter
the scope of services concerning the accreditation,
receive an accreditation from the Personal
Information Protection Commission. This, however,shall not apply to a minor alteration as specified by
the rules of the Personal Information Protection
Commission.

（added）(2) The provisions of Article 47, paragraph (3), (4) andthe preceding Article shall apply mutatis mutandis tothe accreditation of alteration in the preceding
paragraph.

(added)(Notification of Termination)
Article 50(1) A person who has received an accreditation(including the accreditation of alteration in the(Notification of Termination)
Article 50(1) A person who has received an accreditation under
Article 47, paragraph (1) (hereinafter referred to as

21/28

preceding Article, paragraph (1)) under Article 47,
paragraph (1) (hereinafter referred to as an“accredited
personal
information
protection
organization”) shall, when intending to terminate
services concerning the accreditation (hereinafterreferred to as “accredited services”), in advance
notify the Personal Information Protection
Commission to that effect as prescribed by cabinet
order.

an “accredited personal information protection
organization”) shall, when intending to terminate
services concerning the accreditation (hereinafterreferred to as “accredited services”), in advance
notify the Personal Information Protection
Commission to that effect as prescribed by cabinet
order.

(2)(2)[Omission](Covered Business Operator)
Article 51(1) An accredited personal information protection
organization shall make its covered business
operators composed of a personal information
handling business operator etc. who has consented to
becoming covered by the accredited services. In thiscase, if a covered business operator does not fulfill
the personal information protection guideline
prescribed by Article 53, paragraph (1) even thoughactions pursuant to Article 53, paragraph (4) was
taken, the covered business operator may be
excluded from being covered by the accredited
services.
(2)[Omission][Omission](Covered Business Operator)
Article 51(1) An accredited personal information protection
organization shall make its covered business
operators composed of a personal information
handling business operator etc. who is a constituentof the said accredited personal information protection
organization or who has consented to becoming
covered by the accredited services.

(2)[Omission](Dealing with a Complaint)
Article 52 [Omission](Dealing with a Complaint)
Article 52 [Omission](Personal Information Protection Guideline)
Article 53(1) An accredited personal information protection
organization shall, for the purpose of ensuring acovered business operator’s proper handling of
personal information etc., strive to develop a
guideline conformable to the purport of the provisionsof this Act (hereinafter referred to as a “personal
information protection guideline”) by asking a person
representing consumers or other concerned person
for their opinion in regard to a matter related topersonal information including utilization purpose
specification, security control action and procedures
for responding to a demand etc. for disclosure etc. aswell as a matter related to pseudonymously processed
information or anonymously processed information
including its production method and security control
action for such information.

(Personal Information Protection Guideline)
Article 53(1) An accredited personal information protection
organization shall, for the purpose of ensuring acovered business operator’s proper handling of
personal information etc., strive to develop a
guideline conformable to the purport of the provisionsof this Act (hereinafter referred to as a “personal
information protection guideline”) by asking a person
representing consumers or other concerned person
for their opinion in regard to a matter related topersonal information including utilization purpose
specification, security control action and procedures
for responding to a demand etc. for disclosure etc. aswell as a matter related to anonymously processed
information including its production method andsecurity control action for such information.

(2) to (4)(2) to (4)[Omission]

22/28[Omission]

Articles 54 to 57

Articles 54 to 57[Omission][Omission]（Rescinding the Accreditation）
Article 58(1) The Personal Information Protection Commission
may, when an accredited personal information
protection organization falls under any of eachfollowing item, rescind the accreditation.

（Rescinding the Accreditation）
Article 58(1) The Personal Information Protection Commission
may, when an accredited personal information
protection organization falls under any of eachfollowing item, rescind the accreditation.

(i) to (iv)(i) to (iv)

[Omission][Omission](v) when having received an accreditation under
Article 47, paragraph (1), or an accreditation ofalteration under Article 49-2, paragraph (1) byimproper means(v) when having received an accreditation under
Article 47, paragraph (1) by improper means

(2)

(2)

[Omission][Omission]

Section 6 Service（added）(Document to be served)
Article 58-2
(1) A requirement to submit a report or material
pursuant to the provisions of Article 40, paragraph(1), a recommendation pursuant to the provisions ofArticle 42, paragraph (1) or an order pursuant to
Article 42, paragraph (2) or (3), a call for a reportpursuant the provisions of to Article 56, an orderpursuant to the provisions of Article 57, or a
rescission pursuant to the provisions of the preceding
Article, paragraph (1), is given by serving a document
specified by rules of the Personal Information
Protection Commission.

（added）(2) A notice under Article 15, paragraph (1) or Article （added）
30 of the Administrative Procedure Act (Act No. 88
of 1993) relating to the order pursuant to theprovisions of Article 42, paragraph (2) or (3) or
Article 57, or, rescission pursuant to the preceding
Article, paragraph (1), is given by serving a documentof the Article 15, paragraph (1) and (2) or Article 30of the Act. In this case, the provisions of Article 15,
paragraph (3) of the Act (including cases where it isapplied mutatis mutandis pursuant to Article 31 of the
Act following the deemed replacement of terms) shallnot apply.
(Application Mutatis Mutandis of the Code of Civil
Procedure Concerning Service)
Article 58-3
The provisions of Articles 99, 101, 103, 105, 106,108, and 109 of the Code of Civil Procedure apply
mutatis mutandis to the service pursuant to the（added）

23/28

provisions of the preceding Article. In this case, theterm “court execution officer” in Article 99,
paragraph (1) of the Act is deemed to be replaced by“official of the Personal Information Protection
Commission”, and the terms “presiding judge” inArticle 108 of the Act and “court” in Article 109 of
the Act are deemed to be replaced by “Personal
Information Protection Commission”.
(Service by Publication)
Article 58-4
(1) The Personal Information Protection Commission
may effect service by publication in the following
cases:（added）(i) if the domicile or residence of the person to beserved or the place where service is to be effected is
unknown;（added）(ii) if, with regard to service that would be effected in （added）
a foreign country, it is impossible to effect service by
the means prescribed in Article 108 of the Code ofCivil Procedure as applied mutatis mutandis pursuant
to the preceding Article following the deemed
replacement of terms, or it is found to be impossible
to effect service by those means; or(iii) if, even after six months have passed since acommission was issued to the competent government
agency of a foreign country pursuant to the provisionsof Article 108 of the Code of Civil Procedure asapplied mutatis mutandis pursuant to the preceding
Article following the deemed replacement of terms, nodocument that certifies that the agency has effected
service has been sent.

（added）(2) Service by publication is effected by posting on
the notice board of the Personal Information
Protection Commission to the effect that the
documents to be served will be delivered at any timeto the person to be served.

（added）(3) Service by publication becomes effective once two
weeks have passed from the date on which the postingunder the provisions of the preceding paragraph wascommenced.

（added）(4) The period set forth in the preceding paragraph is （added）
six weeks for service by publication that is done forservice that would be effected in a foreign country.

24/28

(Use of Electronic Data Processing Systems)（added）
Article 58-5
When an official of the Personal Information
Protection Commission administers affairs related tothose that are to be given by serving a document
pursuant to the provisions of Article 58-2, and adisposition notice, etc. prescribed in Article 3, item(ix) of the Act on the Use of Information andCommunications Technology in Administrative
Procedures (Act No. 151 of 2002) using an electronic
data processing system prescribed in Article 6,paragraph (1) of the Act pursuant to Article 7,paragraph (1) of the Act, the official must use thatelectronic data processing system, to record theparticulars of the service under the provisions ofArticle 109 of the Code of Civil Procedure as appliedmutatis mutandis pursuant to Article 58-3, in a filethat is stored on a computer (including input or
output device) used by the Personal Information
Protection Commission instead of preparing andsubmitting a document that states those particulars.

Chapter 5 The Personal Information Protection
Commission

Chapter 5 The Personal Information Protection
Commission

Articles 59・60

Articles 59・60[Omission][Omission](Jurisdictional Affairs)
Article 61
The Commission is to administer the following affairs
in order to fulfil the duties under the preceding
Article.

(Jurisdictional Affairs)
Article 61
The Commission is to administer the following affairs
in order to fulfil the duties under the preceding
Article.

(i)(i)[Omission](ii) affairs (excluding those set forth in item (iv))
related to supervision related to the handling of
personal information by a personal information
handling business operator, the handling of personallyreferable information by a personally referable
information handling business operator, the handlingof pseudonymously processed information by apersonal information handling business operator and apseudonymously processed information handlingbusiness operator, and, the handling of anonymously
processed information by a personal information
handling business operator and anonymously
processed information handling business operator,
supervision related to the handling, by an
Administrative Organ prescribed in Article 2,paragraph (1) of the Act on the Protection of Personal
Information Held by Administrative Organs, of an[Omission](ii) affairs (excluding those set forth in item (iv))
related to supervision related to the handling of
personal information by a personal information
handling business operator, and, to the handling ofanonymously processed information by a personal
information handling business operator andanonymously processed information handling business
operator, supervision related to the handling, by an
Administrative Organ prescribed in Article 2,paragraph (1) of the Act on the Protection of Personal
Information Held by Administrative Organs, of an
Anonymized Personal Information Held byAdministrative Organ (limited to those constituting an
Anonymized Personal Information File Held byAdministrative Organs as prescribed in paragraph (10)of the same Article) prescribed in paragraph (9) of thesame Article, supervision related to the handling, by

25/28

Anonymized Personal Information Held byAdministrative Organ (limited to those constituting
an Anonymized Personal Information File Held byAdministrative Organs as prescribed in paragraph(10) of the same Article) prescribed in paragraph (9)of the same Article, supervision related to thehandling, by an incorporated administrative agency,
etc., of an anonymized personal information held byan incorporated administrative agency, etc.
prescribed in Article 2, paragraph (9) of the Act on
the Protection of Personal Information Held byIncorporated Administrative Agencies, etc. (limited
to those constituting an anonymized personal
Information file of an incorporated administrative
agency, etc. as prescribed in paragraph (10) of thesame Article), and, affairs related to necessary
mediation on a lodged complaint related to thehandling of personal information, pseudonymously
processed information and anonymously processed
information, and to cooperation offered to a business
operator who deals with that complaint.

an incorporated administrative agency, etc., of ananonymized personal information held by anincorporated administrative agency, etc. prescribed in
Article 2, paragraph (9) of the Act on the Protectionof Personal Information Held by Incorporated
Administrative Agencies, etc. (limited to those
constituting an anonymized personal Information fileof an incorporated administrative agency, etc. asprescribed in paragraph (10) of the same Article), and,affairs related to necessary mediation on a lodged
complaint related to the handling of personal
information and anonymously processed information,and to cooperation offered to a business operator who
deals with that complaint.

(iii) to (ix)(iii) to (ix)

[Omission]

Articles 62 to 74[Omission][Omission]

Articles 62 to 74[Omission]

Chapter 6 Miscellaneous Provisions

Chapter 6 Miscellaneous Provisions(Scope of Application)
Article 75
This Act shall also apply in those cases where apersonal information handling business operator etc.,
in relation to supplying a good or service to a person
in Japan, handles the personal information that has aperson in Japan as the principal, personally referable
information that is to be acquired as the said personal
information, pseudonymously processed informationor anonymously processed information produced byusing the said personal information, in a foreigncountry.

(Scope of Application)
Article 75
The provisions of Article 15, Article 16, Article 18(excluding paragraph (2)), Article 19 through Article
25, Article 27 thorough Article 36, Article 41, Article
42, paragraph (1), Article 43 and the following Article
shall also apply in those cases where a personal
information handling business operator who in relation
to supplying a good or service to a person in Japan
has acquired personal information relating to theperson being as a principal handles in a foreigncountry the personal information or anonymously
processed information produced by using the said
personal information.

（Exclusion from Application）
Article 76(1)・(2) [Omission]（Exclusion from Application）
Article 76(1)・(2) [Omission](3) A personal information handling business operator
etc. set forth in each item of paragraph (1) shall strive
to take itself necessary and appropriate action for the
security control of personal data, pseudonymously
processed information or anonymously processed
information and necessary action to ensure the proper(3) A personal information handling business operator
etc. set forth in each item of paragraph (1) shall strive
to take itself necessary and appropriate action for the
security control of personal data or anonymously
processed information and necessary action to ensure
the proper handling of personal information etc. such

26/28

handling of personal information etc. (excluding
personally referable information; hereinafter the same
applies in this paragraph) such as dealing with acomplaint about the handling of personal information
etc., as well as announce to the public the contentsof such action taken.

as dealing with a complaint about the handling of
personal information etc., as well as announce to the
public the contents of such action taken.

Articles 77・78

Articles 77・78[Omission](Sincere Implementation of International Agreements
etc.)
Article 78-2
In the enforcement of this Act, care must be taken
not to prevent the sincere implementation of treaties
and other international agreements which Japan has
concluded, and established international law must becomplied with.

（added）

Articles 79 to 81

Articles 79 to 81[Omission][Omission][Omission]

Chapter 7 Penal Provisions

Chapter 7 Penal Provisions

Article 82

Article 82[Omission][Omission]

Article 83（added）
In cases where an order pursuant to the provisions ofArticle 42, paragraph (2) or paragraph (3) is violated,
the person who has done the act of violating shall bepunished by imprisonment with labor for not morethan one year or a fine of not more than 1,000,000
yen.
Article 84
A personal information handling business operator (orits director, representative or administrator if it is a
corporate body (including a non-corporate bodyhaving appointed a representative or administrator;
the same shall apply in Article 87, paragraph (1)), its
employee, or a person who used to be such a business
operator or employee shall, when having provided orused by stealth personal information database etc.
(including their wholly or partially duplicated orprocessed ones) that they handled in relation to theirbusiness for the purpose of seeking their own or athird party’s illegal profits, be punished by
imprisonment with work for not more than one year
or a fine of not more than 500,000 yen.

Article 83
A personal information handling business operator (orits director, representative or administrator if it is a
corporate body (including a non-corporate bodyhaving appointed a representative or administrator;
the same shall apply in Article 87, paragraph (1)), its
employee, or a person who used to be such a business
operator or employee shall, when having provided orused by stealth personal information database etc.
(including their wholly or partially duplicated orprocessed ones) that they handled in relation to theirbusiness for the purpose of seeking their own or athird party’s illegal profits, be punished by
imprisonment with work for not more than one year ora fine of not more than 500,000 yen.

（deleted）

Article 84
A person who has violated an order pursuant to theprovisions of Article 42, paragraph (2) or paragraph(3) shall be punished by imprisonment with labor for
27/28

not more than six months or a fine of not more than
300,000 yen.
Article 85
In cases that fall under any of each following item, theperson who has done the act of violation shall bepunished by a fine of not more than 500,000 yen.

Article 85
A person falling under any of each following item shallbe punished by a fine of not more than 300,000 yen.

(i) if a person failed to submit a report or material
under the provisions of Article 40, paragraph (1) or
did falsely submit a report or material, or who failed
to answer a question posed by the staff concerned or
did falsely answer a question, or refused, obstructed
or evaded an inspection(i) a person who has failed to submit a report ormaterial under the provisions of Article 40, paragraph(1) or did falsely submit a report or material, or who
failed to answer a question posed by the staff
concerned or did falsely answer a question, or
refused, obstructed or evaded an inspection(ii) if a person failed to submit a report under theprovisions of Article 56, or did falsely submit a report(ii) a person who failed to submit a report under theprovisions of Article 56, or did falsely submit a report

Article 86
The provisions of Article 82 and Article 84 shall apply
to a person who has committed an offense under these
Articles outside of Japan.

Article 86
The provisions of Article 82 and Article 83 shall apply
to a person who has committed an offense under these
Articles outside of Japan.

Article 87(1) When a representative of a corporate body, or an
agent, employee or other worker of a corporate bodyor natural person has committed a violating act set
forth in each following item in relation to thecorporate body or natural person’s business, theactor shall be punished, and a fine set forth in eachfollowing item shall be imposed on the corporate body,and a fine set forth in the respective Articles shall be
imposed on the said natural person.

Article 87(1) When a representative of a corporate body, or an
agent, employee or other worker of a corporate bodyor natural person has committed a violating act under
Article 83 through Article 85 in relation to thecorporate body or natural person’s business, theactor shall be punished, and a fine set forth in therespective Articles shall be imposed on the said
corporate body or natural person.

(i) Article 83 and Article 84 a fine of not more than
100 million yen（added）(ii) Article 85 a fine set forth in the same Article（added）(2)[Omission](2)[Omission]

Article 88
A person falling under any of each following item shallbe punished by a non-criminal fine of not more than
100,000 yen.

Article 88
A person falling under any of each following item shallbe punished by a non-criminal fine of not more than
100,000 yen.

(i) a person who has violated the provisions of Article
26, paragraph (2) (including as applied mutatis
mutandis pursuant to Article 26-2, paragraph (3)), or
Article 55(i) a person who has violated the provisions of Article
26, paragraph (2), or Article 55[Omission]
(ii)
(end)

[Omission]
(ii)
(end)
28/28