Act on the Protection of Personal Information

Article 1 This Act aims to protect an individual’s rights and interests while

The Act aims to protect individual rights and interests while recognizing personal information's utility for industry creation and economic development. It establishes a governmental vision and basic policy for proper personal information handling, clarifies responsibilities of central and local governments, and sets obligations for business operators in an increasingly information-intensive society.

Article 2 Definitions of personal information

Personal information means information on a living individual containing identifiable descriptions such as name or date of birth, or individual identification codes (characters, numbers or symbols identifying a person, including biometric conversions or service-related user codes). Special care-required personal information covers ethnic or racial origin, religious belief, social position, medical information, criminal conviction and crime victim status. A personal information database is a collective body of personal information searchable by computer or systematically organized for easy searching, operated in business by a person excluding government entities and designated administrative agencies.

Article 3 Overall vision for personal information

Personal information must be handled properly with respect for individual personality as the guiding principle.

Article 4 Central government responsibilities

The central government is responsible for creating and executing all necessary steps to guarantee that personal information is handled correctly according to this Act's principles.

Article 5 Local government responsibilities

Local governments are responsible for developing and implementing measures to ensure proper personal information handling according to the characteristics of their local area.

Article 6 The government shall, considering the nature and utilization method of

The government must take necessary legislative and other action to enable discreet protection of personal information requiring strict handling implementation, and must collaborate with other governments and international organizations to construct an internationally compatible system.

Article 7 Basic Policy on the Protection

The government must create a basic policy to systematically advance personal information protection measures. This policy must cover the government's own role, local governments' roles, administrative agencies' roles, business operators' roles, complaint handling, and other key matters for promoting protection measures. The Prime Minister seeks cabinet approval and then publicly releases the policy without delay.

Article 8 Support to Local Government

The central government must provide information and develop guidelines to support local governments and Japanese citizens or business operators in implementing proper personal information handling, and take other necessary action to support these efforts.

Article 9 Action for Dealing with Complaint

The central government must take necessary action to ensure appropriate and prompt resolution of complaints arising between business operators and principals about personal information handling.

Article 10 The central government shall, through the appropriate division of roles

The central government must take necessary action, in appropriate coordination with local governments, to ensure that personal information handling business operators comply with requirements set out in the following chapter.

Article 11 Protection of Information Retained Locally

Local governments must strive to take necessary action to ensure proper handling of personal information they retain, considering the nature of the information and purpose of retention. Local governments must also strive to ensure proper handling of personal information retained by local incorporated administrative agencies they have established.

Article 12 A local government shall, in order to ensure the proper handling of

Local governments must strive to take necessary action to support business operators and residents in their local area to ensure proper personal information handling.

Article 13 A local government shall, in order for a complaint caused between a

Local governments must strive to mediate complaints arising between business operators and principals about personal information handling and take other necessary action to ensure appropriate and prompt resolution.

Article 14 Cooperation between Governments

The central and local governments must cooperate with one another in implementing personal information protection measures.

Article 15 Specification of utilization purpose

Operators handling personal information must define their intended use of that information as precisely as possible. When changing the intended use, operators cannot alter it beyond what would be reasonably considered related to the original purpose.

Article 16 Restriction on scope of use

Operators cannot handle personal information beyond what is necessary to achieve their stated purpose without first obtaining the data subject's agreement. This includes information acquired through business succession, unless in limited circumstances: cases based on law, protecting a life or property when consent is not feasible, public health needs when consent is not feasible, or cooperation with government authorities where consent would interfere with their functions. Additionally, operators cannot use personal information in ways that might encourage unlawful or unfair conduct.

Article 17 Proper acquisition of personal information

Operators cannot obtain personal information through deception or other improper methods. They cannot acquire sensitive personal information without advance consent, except in these cases: as required by law, to protect life or property when consent is not feasible, for public health when consent is not feasible, to cooperate with government when consent would interfere with their functions, when the data subject has already made it public or when authorized by cabinet order.

Article 18 Notification of utilization purpose

When operators acquire personal information, they must promptly inform the data subject or disclose publicly the intended purpose, unless that purpose was already publicly disclosed. When acquiring information directly from a data subject in a contract or similar written document, operators must explicitly state the purpose, though this does not apply in urgent situations protecting life or property. Operators must notify of purpose changes.

Article 19 Accuracy of personal data

Operators must make reasonable efforts to keep personal information accurate and current as needed to achieve their stated purpose, and must delete it promptly once it is no longer needed for that purpose.

Article 20 Security control measures

Operators must take necessary and appropriate measures to secure personal data, including preventing its leakage, loss or damage.

Article 21 A personal information handling business operator shall, in having its employees handle personal data, exercise necessary and appropriate

When employees handle personal data, operators must exercise necessary and appropriate supervision to ensure the data remains secure.

Article 22 A personal information handling business operator shall, in case of

Business operators handling personal data must tell the Commission of incidents involving leakage, loss, damage or other security events that the Commission's rules classify as likely to harm individuals' rights or interests, unless an entrusted operator already notified the contracting operator. Business operators must also notify the individual affected, unless notification is impracticable and alternative protective steps are taken.

Article 23 Restriction on third party provision

Operators must not provide personal data to third parties without advance consent, except when required by law, necessary to protect life or property when consent is not feasible, necessary for public health when consent is not feasible, or to cooperate with government when consent would interfere with its functions. Operators may provide data without consent if they have informed the data subject in advance of the provider's identity and address, that third-party provision is intended, the types of data, how data was obtained, the sharing method, that the data subject can request cessation and how, and other matters the Commission deems necessary; this exception does not apply to sensitive information, unlawfully obtained information, or information shared by another operator under the same exception. Operators must promptly inform the data subject or make easily knowable and notify the Commission when a provider's identity or address changes or data sharing stops, and when changing types of data, sharing method, cessation request procedures, or other specified matters, operators must give advance notice or make changes easily knowable and notify the Commission.

Article 24 Third-party provision to foreign countries

Before transferring personal data abroad to a third party, except where exempted, a business operator must obtain advance consent from the individual, unless the recipient uses a system meeting specified standards or the country has equivalent data protection laws. The operator must provide the individual with information about the foreign country's protection system, the third party's safeguards, and other relevant details in advance. When providing data to a qualifying third party, the operator must take necessary steps to ensure continued compliance with protection standards and provide information about these steps upon request.

Article 25 Records of third-party provision

A business operator must keep records of personal data transfers to third parties, including the transfer date, the third party's name or designation, and other prescribed details, unless the transfer falls under specified exemptions. These records must be retained for a period set by the Personal Information Protection Commission.

Article 26 Verification when receiving personal data

When a business operator receives personal data from a third party, it must confirm the third party's name, address, representative, and circumstances of acquisition according to regulatory procedures unless exempted, and the providing third party must not mislead about these confirmations; the operator must record and maintain the receipt date, confirmation details, and other prescribed information for a set period. A handler of personally referable information databases must obtain advance consent from the individual before providing information to a third party unless exempted, and must confirm consent; for foreign transfers, must provide information about the country's protection system, recipient's safeguards, and other relevant details beforehand, take ongoing steps to ensure continued compliance by foreign recipients, and apply the same verification procedures required for personal data transfers.

Article 27 Public disclosure of retention and use

A business operator must make publicly accessible information about its retained personal data, including its name, address, representative, the purposes for which it uses all retained personal data, procedures for responding to access and correction requests, and other prescribed matters. When an individual requests information about the purpose for their specific retained data, the operator must provide it without delay unless the purpose is already public or falls under exemptions, and must notify the individual if it refuses to disclose.

Article 28 Disclosure of retained personal data

An individual may demand that a business operator disclose their retained personal data using electronic records or other prescribed methods. The operator must disclose within reasonable promptness using the individual's requested method, or by written document if the requested method is expensive or impractical, but may withhold disclosure if it would harm the individual or others' rights, interfere with the operator's business, or violate other laws. The operator must notify the individual if it refuses disclosure, lacks the data, or cannot provide it via the requested method.

Article 29 Correction of personal data

Allows data subjects to demand that businesses correct, add to, or delete their retained personal data if it is inaccurate. Businesses must investigate promptly and take corrective action unless other legal procedures apply, then must notify the data subject of the outcome.

Article 30 Cessation of use or deletion

Data subjects may demand cessation or deletion of retained personal data processed in violation of specified articles or provided to third parties in violation of those articles, or may demand cessation of use, deletion, or halting of third-party provision if data is no longer necessary, a data breach has occurred, or handling poses risk to their rights or interests. Businesses must comply without delay when the demand is justified, except where compliance would require large expenses or be difficult and alternative protective measures are taken. Businesses must inform the data subject of their decision without delay.

Article 31 A personal information handling business operator shall, in case of

When a business informs a data subject that it will not take, or will take different, action on a request or demand for disclosure, correction, cessation, or deletion, the business must strive to explain its reasons to the data subject.

Article 32 Procedures for handling requests

Businesses may specify methods for receiving requests and demands for disclosure, correction, or cessation, prescribed by cabinet order, and may request the data subject to provide information to identify the relevant data. Businesses must take appropriate action to assist the data subject in making clear requests, and must establish procedures that do not impose excessive burden on data subjects; agents may make requests as prescribed by cabinet order.

Article 33 Fees for disclosure

Businesses may charge a reasonable fee to inform data subjects of their utilization purposes or to disclose personal data to them, with the fee amount limited to actual expenses.

Article 34 Advance demand requirement

A data subject must issue a written demand to a business and wait two weeks from delivery before filing a lawsuit or seeking a provisional disposition order regarding disclosure, correction, or cessation, unless the business has rejected the demand.

Article 35 Handling complaints

Businesses must strive to handle complaints about personal information processing promptly and appropriately, and must work to establish systems necessary for this purpose.

Article 36 Production of anonymously processed information

Operators must process personal data using standards set by the Personal Information Protection Commission to make identification and restoration impossible. After production, operators must apply security controls to deleted identifiers and method information, publicly disclose categories of individual information in the anonymously processed data, and when providing it to third parties, must publicly disclose those categories in advance and explicitly state to recipients that the information is anonymously processed. Operators must not collate anonymously processed information with other data to identify the original subject, and must endeavour to maintain security controls and handle complaints properly with public disclosure of actions taken.

Article 37 An anonymously processed information handling business operator

Before sharing anonymously processed information with third parties, the operator must publicly list the categories of personal information the anonymized data contains, following the Commission's rules, and must explicitly tell the recipient that the information is anonymously processed.

Article 38 An anonymously processed information handling business operator

Operators must not obtain deleted identifiers, descriptions or processing method information from the original personal data, and must not collate anonymously processed information with other data in order to identify the original data subject.

Article 39 An anonymously processed information handling business operator

Operators must endeavour to implement necessary and appropriate security measures for anonymously processed information and take necessary steps to ensure proper handling such as complaint resolution, and must endeavour to publicly disclose the actions taken.

Article 40 Report and onsite inspection

The Personal Information Protection Commission may require operators and related persons to submit necessary information or materials, and may conduct onsite inspections including entry to business premises, inquiries, and inspection of records and property, to the extent necessary for implementing applicable rules. Officials conducting inspections must carry and present identification credentials when requested, and inspection authority is not granted for criminal investigation purposes.

Article 41 The Personal Information Protection Commission may, to the extent

The Personal Information Protection Commission may provide guidance and advice to operators on the handling of personal information and related data forms.

Article 42 Protection Commission enforcement: recommendations

The Commission may recommend personal information, personally referable information, pseudonymously processed information, or anonymously processed information operators to cease violations or take remedial action when violations cause harm to individuals' rights and interests; if the operator fails to comply without legitimate grounds and the Commission recognizes serious infringement is imminent, the Commission may issue a binding order. The Commission may order operators to immediately cease violations or take remedial action when facts seriously harm individuals' rights and interests and urgent action is required, including when previously issued orders are violated, and violation of such orders may result in public announcement by the Commission.

Article 43 Restriction on Commission authority

When requiring reports, conducting inspections, or issuing guidance or orders, the Commission shall not hinder freedom of expression, academia, religion, or political activity. The Commission shall not exercise authority over operators' provision of personal information to persons listed in Article 76, paragraph (1) when those persons handle information for purposes specified in that article.

Article 44 Delegation of authority by Commission

The Commission may delegate authority to give recommendations and orders to business jurisdictional ministers, along with authority to require submissions and conduct inspections as prescribed by cabinet order; business jurisdictional ministers must report results to the Commission and may further delegate to local branch bureaus or other prescribed organs, and the Prime Minister delegates the Commission's authority relating to the Financial Services Agency to its Commissioner, who may sub-delegate to the Securities and Exchange Surveillance Commission or finance bureau directors as prescribed by cabinet order. Administrative review of a Securities and Exchange Surveillance Commission decision requiring submission of reports or materials, including decisions by local finance officials, can only be brought against the Securities and Exchange Surveillance Commission itself.

Article 45 Request by business jurisdictional minister

Business jurisdictional ministers may request the Commission to take appropriate action when necessary to ensure proper information handling by operators, including to address violations of enforcement provisions.

Article 46 A business jurisdictional minister in the provisions of this Section

For matters relating to employment management in information handling, the business jurisdictional minister is the Minister of Health, Labor and Welfare (or Minister of Land, Infrastructure, Transport and Tourism for maritime employment) or the National Public Safety Commission. For other matters, the business jurisdictional minister is the minister having jurisdiction over the operator's business.

Article 47 Accreditation for private-sector compliance bodies

Corporations and non-corporate bodies may receive Commission accreditation to handle complaints about information handling, provide information on proper handling practices, or render related services to covered operators. Accreditation may be limited by service type or scope, and the Commission shall publicly announce approved accreditors and their scope of services.

Article 48 Accreditation disqualification

Persons cannot receive accreditation if they have been imprisoned under this Act within two years, or if their prior accreditation was rescinded within two years. Organizations whose directors include someone in either of these categories are also disqualified.

Article 49 Accreditation standards

The Commission only grants accreditation when the applicant has devised appropriate service methods, demonstrated sufficient knowledge and financial capacity, and ensuring other services do not compromise fairness of accredited services. Applicants seeking to expand service scope must obtain accreditation separately, except for minor changes defined by Commission rules.

Article 50 Notification of termination

Accredited organizations must notify the Commission in advance when ending accredited services, and the Commission shall publicly announce such termination.

Article 51 Covered business operators

Accredited organizations comprise consenting personal information handlers, and may exclude non-compliant ones from coverage. The organization must publicly announce the names of covered operators.

Article 52 Dealing with complaints

Accredited organizations must consult, advise, investigate, and facilitate resolution when receiving complaints about operators' information handling, and may request explanations or materials from operators who cannot refuse without justification.

Article 53 Personal information protection guideline

Accredited organizations must develop guidelines aligned with this Act covering topics like use purposes and security, consulting consumer representatives, then notify the Commission who shall publish them. Organizations must then guide operators to follow the published guidelines.

Article 54 Prohibition of misuse of information

Accredited organizations may not use information obtained through accredited services for any other purpose.

Article 55 Restriction on using accreditation name

Non-accredited persons must not use the accreditation appellation or any confusingly similar designation.

Article 56 The Personal Information Protection Commission may, to the extent

The Commission may require accredited organizations to report on their accredited services as necessary for implementation.

Article 57 The Personal Information Protection Commission may, to the extent

The Commission may rescind accreditation if the organization becomes disqualified, fails accreditation standards, misuses information, disobeys orders, or obtained accreditation by improper means, and shall publicly announce the rescission.

Article 58 3 The provisions of Articles 99, 101, 103, 105, 106, 108, and 109 of the

Specified provisions of the Code of Civil Procedure regarding service apply mutatis mutandis, with Commission officials replacing court execution officers and the Commission replacing presiding judges or courts. The Commission may effect service by publication when domicile is unknown, service in a foreign country is impossible, or six months have passed without confirmation of foreign service. Service by publication becomes effective two weeks after posting on the Commission's notice board, or six weeks for foreign service.

Article 59 Establishment

The Personal Information Protection Commission is established under the provisions of the Cabinet Office establishment law and operates under the jurisdiction of the Prime Minister.

Article 60 Duties

The Commission pursues ensuring proper handling of personal information, including guidance and advice to individual number utilizing business implementers, to protect individual rights and interests while recognizing personal information's utility for creating new industries and economic growth.

Article 61 Jurisdictional Affairs

The Commission manages nine categories of work including developing and promoting basic policy, supervising how business operators and government agencies handle personal information, pseudonymized and anonymized data, overseeing accredited protection organizations, monitoring specific personal information, conducting protection assessments, public education on proper information handling, research to support these functions, and international cooperation.

Article 62 Independence in Exercising Authority

The chairperson and commissioners exercise their official authority independently.

Article 63 Organization

The Commission has a chairperson and eight commissioners, with four serving part-time. The Prime Minister appoints them with Diet approval from candidates of high character and expertise. Members must collectively possess academic knowledge in information protection, consumer protection expertise, information technology expertise, experience in public administration using specific personal information, private-sector business knowledge, and include a representative nominated by a federate local government organization.

Article 64 Term of Office

The chairperson and commissioners serve five-year terms, with those appointed to fill vacancies serving the remaining term of their predecessor. They may be reappointed and continue duties until successors are appointed. The Prime Minister may appoint interim appointees when Diet approval cannot be obtained, subject to ex post facto approval in the first subsequent Diet session or immediate dismissal.

Article 65 Guarantee of Status

The chairperson and commissioners cannot be involuntarily removed except when bankrupt, penalized under this Act or the Numbers Use Act, imprisoned, or found by the Commission to be unable to perform duties due to mental or physical disability or misconduct.

Article 66 The Prime Minister shall, when a chairperson or a commissioner falls

The Prime Minister must remove a chairperson or commissioner who meets any condition specified in the preceding article.

Article 67 Role of chairperson

The chairperson oversees the Commission's rules and proceedings and represents it. The Commission must designate a full-time commissioner in advance to serve as acting chairperson when the chairperson is unavailable.

Article 68 Commission meetings

The chairperson convenes meetings. A quorum requires the chairperson and at least four commissioners; without this, the Commission cannot meet or decide. Decisions require a majority of those present, with the chairperson breaking ties.

Article 69 Specialist commissioner

The Commission may appoint specialist commissioners to investigate particular matters. The Prime Minister appoints them based on the Commission's recommendation, they work part-time, and their position ends when the investigation concludes.

Article 70 Secretariat structure

A secretariat supports the Commission's work and consists of a secretary general and other staff. The secretary general manages secretarial operations under the chairperson's direction.

Article 71 Restrictions on office holders

While in office, the chairperson and commissioners cannot lead political parties or organizations or actively campaign. Full-time chairpersons and commissioners cannot hold other paid positions, run profit-making ventures, or perform services for payment unless the Prime Minister permits.

Article 72 A chairperson, commissioner, specialist commissioner and secretarial

The chairperson, commissioners, specialist commissioners, and secretarial staff must not disclose or secretly use confidential information gained during their duties, and this obligation continues after they leave office.

Article 73 Compensation

A separate law prescribes the remuneration for the chairperson and commissioners.

Article 74 Rule-making authority

The Commission may create rules governing its jurisdictional work to implement laws or cabinet orders, or when specifically authorized by law or cabinet order.

Article 75 Extraterritorial application

The Act applies when a personal information handler supplies goods or services to a person in Japan and processes personal information with that person as the subject, whether handled in a foreign country.

Article 76 Exemptions for certain organizations

Chapter IV requirements do not apply to press organizations, writers, academic institutions, religious bodies, and political bodies when handling information for their respective activities such as journalism, writing, academic research, religious functions, or political activity. These entities must still implement appropriate security measures and publicly communicate their actions.

Article 77 Administrative affairs belonging to the Commission’s authority

Administrative functions that the Commission oversees, or those delegated to sectoral ministers or the Financial Services Agency, may be managed by local government heads or other executive agencies as set by cabinet order.

Article 78 Information sharing with foreign authorities

The Commission may provide information to foreign authorities enforcing equivalent personal data laws, but only if proper safeguards are taken that such information is not used for other purposes or foreign criminal investigations without consent. The Commission may grant consent for criminal investigations unless the crime is political, would not be criminal in Japan, or the requesting country would not reciprocate such requests, and must obtain confirmations from the Justice and Foreign Affairs ministers.

Article 79 Annual Diet reporting

The Commission annually reports to the Diet through the Prime Minister on its operational status and publicly releases a summary of this report.

Article 80 The Prime Minister and a head of an administrative organization related to the implementation of this Act (meaning an organization established in

The Prime Minister and heads of administrative organizations involved in enforcing the Act must maintain close communication and cooperation.

Article 81 A matter necessary to implement this Act other than those prescribed in

Article 82 Penalties for disclosure of secrets

A person who divulges or misappropriates a secret in violation of Article 72 shall be punished by up to two years imprisonment with labor or a fine of up to 1,000,000 yen.

Article 83 In cases where an order pursuant to the provisions of Article 42

Violation of a commission order under Article 42 paragraphs (2) or (3) is punishable by up to one year imprisonment with labor or a fine of up to 1,000,000 yen.

Article 84 A personal information handling business operator (or its director

A personal information handler, director, representative, administrator, employee, or former employee who discloses or misappropriates a personal information database in relation to their business for unlawful profit is punishable by up to one year imprisonment with labor or a fine of up to 500,000 yen.

Article 85 Administrative penalties - criminal fine

A person who fails to provide or falsely provides a report or material required under Article 40 paragraph (1), fails to answer or falsely answers questions from staff, or refuses, obstructs or evades an inspection, shall be punished by a penalty of up to 500,000 yen. The same penalty applies to a person who fails to or falsely submits a report under Article 56.

Article 86 Extraterritorial application

The provisions of Articles 82 and 84 apply to persons who commit offences described in those articles outside Japan.

Article 87 Corporate liability for violations

When an agent, employee or representative of a corporate body or natural person commits a violation relating to their employer's business, both the individual and the employer face penalties: the individual is punished, and the corporate body is fined up to 100 million yen for violations of Articles 83 and 84, or the amount specified in Article 85 for those violations; a natural person faces a fine as set in the relevant article. For non-corporate bodies, the representative or administrator acts on behalf of the entity in legal proceedings.

Article 88 Administrative penalties - non-criminal fine

A person who violates Article 26 paragraph (2) or fails to provide or falsely provides notification under Article 50 paragraph (1) shall be subject to a non-criminal fine of up to 100,000 yen.