scope:

This Standard specifies the requirements for establishing, implementing, maintaining and improving a personal information protection management system regarding the personal information which the organization uses for its own business. The requirements specified in this Standard are intended to be applicable to all organizations independent of type or size of their businesses. The organizations here mean the personal information handling business operators as specified by the Act on Protection of Personal Information (Act No. 57, 2003) (hereafter referred to as Personal Information Protection Act).

NOTE: The term "business" in "the organization uses for its business" means what is accepted as a business by socially accepted norms and does not necessarily refer to profit-making businesses only. Therefore, personal information of a worker is the information used for the business.