Learn in the textbookFramework of the Personal Information Protection Act — Regulated Parties and the Definition of Protected Data
DefinitionA Personal Information Handling Business Operator (個人情報取扱事業者) is a party that uses a personal information database (個人情報データベース等), a collection of personal information organized for searching, in its business, and it bears the duties of the Act on the Protection of Personal Information directly.
ExplanationWhen acquiring data, the operator must specify the purpose of use and notify the person or publish it, and while storing it, take security control measures to prevent leaks, including supervising employees and contractors. When the person asks, it must disclose or correct the information it holds about them. As an exception, the duties do not apply when certain parties handle data for certain purposes, such as a news organization handling it for reporting.
AnalogyIt is like a building manager holding spare keys: they use them only for the purpose they were entrusted for, keep them safe, and as a rule never hand them to anyone without the owner's say.
Memory hookThe 2015 amendment, in force from 2017, brought businesses that handle only a small number of people's data into scope as well.