According to one embodiment, a policy management system includes a user terminal, an ID provider system which manages an identity of a user, and a service provider system which provides service data. The ID provider system stores a pair of an old policy and a new policy with respect to each service provider ID. The ID provider system stores information with respect to each service provider ID, the difference-adaptive definition information defining a first condition which is referred to when a date of transmission of an access request message is within a transition period from the old policy to new policy, and a second condition which is referred to when the date of transmission of the access request message is out of the transition period.