--- title: "Japan — Data Subject Rights | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/japan/data-subject-rights/ source_html: /jurisdictions/japan/data-subject-rights/index.html description: "Japan — Data Subject Rights: data_subject_rights Data Subject Rights 5 sub-modules 6 claims Green ▾ # Core access/rectification/erasure/objection rights are codified and were substantially strengthened by the 2020" generated_at: 2026-10-25T04:46:50Z content_sha256: 6eea676ca618fa75842346b4248e1f08ae8fa2d220783f0aa6ec4efc242207a6 generator: "fe-fleet/md-twin@1.0" --- # Japan — Data Subject Rights | Data Protection Monitor ### D3Data Subject Rights5 sub-modules6 claimsGreen▾# Core access/rectification/erasure/objection rights are codified and were substantially strengthened by the 2020/2022 amendments; residual amber factor is the absence of a fixed response-time statute and of an explicit portability right. Primary framework Act on the Protection of Personal Information (APPI) Supervisory authority [Personal Information Protection Commission (PPC)](https://www.ppc.go.jp/en/) Traffic-light rationale — Green Core access/rectification/erasure/objection rights are codified and were substantially strengthened by the 2020/2022 amendments; residual amber factor is the absence of a fixed response-time statute and of an explicit portability right. #### Sub-modules (5) #### Access RightGreen Data subjects may demand disclosure of retained personal data; businesses must respond without delay, subject to limited harm-based exceptions. Claims (2): - Data subjects have the right to demand disclosure of retained personal data held by a business operator. - A business operator must disclose retained personal data to a data subject without delay, subject to statutory exceptions such as risk of harm to life or improper interference with business operations. #### Rectification And ErasureGreen Rights to correction, addition or deletion of retained personal data exist; erasure/cessation-of-use rights were expanded by the 2020/2022 amendment beyond the original narrow trigger conditions. Claims (2): - Data subjects may demand correction, addition or deletion of the content of retained personal data. - The 2020/2022 amendment expanded data subjects' rights to demand cessation of use, deletion, or cessation of third-party provision of retained personal data to cases where a data subject's rights or legitimate interests are likely to be infringed, beyond the prior narrow grounds of purpose-violation, improper collection, or unlawful third-party provision. #### Restriction And ObjectionGreen Cessation of use/third-party provision functions as the APPI's restriction/objection mechanism, now exercisable wherever rights or legitimate interests are likely to be infringed. Claims (1): - The 2020/2022 amendment expanded data subjects' rights to demand cessation of use, deletion, or cessation of third-party provision of retained personal data to cases where a data subject's rights or legitimate interests are likely to be infringed, beyond the prior narrow grounds of purpose-violation, improper collection, or unlawful third-party provision. #### Data PortabilityAmber No explicit portability right analogous to GDPR Art 20 exists; the amendment's electronic-disclosure entitlement is the closest functional equivalent. Claims (2): - The 2020/2022 amendment allows data subjects to require that their retained personal data be disclosed to them electronically, whereas the prior law did not expressly permit electronic-format disclosure demands. - The APPI does not contain a distinct data-portability right equivalent to GDPR Article 20; electronic disclosure of retained personal data is the closest functional analogue. #### Deadlines And Response WindowsAmber The APPI imposes a 'without delay' response standard for disclosure requests rather than a fixed statutory number of days. Claims (1): - A business operator must disclose retained personal data to a data subject without delay, subject to statutory exceptions such as risk of harm to life or improper interference with business operations. Category narrative 83 words Data subjects hold rights to demand disclosure, correction/addition/deletion, and cessation of use or third-party provision of 'retained personal data.' The 2020/2022 amendments broadened these rights (removing the prior six-month retention carve-out, allowing exercise wherever rights/interests are 'likely to be infringed,' and permitting electronic-format disclosure demands). There is no dedicated GDPR Art 20-style portability right, though electronic disclosure functions similarly. Response timing is governed by a 'without delay' standard rather than a fixed statutory clock (contrast with the fixed breach-reporting deadlines under controller duties). Periodic update · new data 2026-09-21 #### Data Subject Rights The amendment package produces a mixed picture for data-subject rights. It grants children enhanced deletion and suspension rights alongside a new parental-consent requirement for processing the data of individuals under 16. It also relaxes breach-notification obligations owed to affected individuals: where risk is assessed as low, notification to the individual can be replaced with alternative measures, moving away from the current threshold-based mandatory-notification model. #### Outlook Neither change is yet operative. Once commenced, the relaxed breach-notification default will need to be read alongside the PPC's separate, currently in-force Article 26 reporting-to-PPC obligations, which are unaffected by this particular provision and continue under existing thresholds and online-submission procedures. Evidence 6 Sources and claims (6) - Confirmed[PPC](https://www.ppc.go.jp/files/pdf/APPI_english.pdf) — Data subjects have the right to demand disclosure of retained personal data held by a business operator.observed 2026-07-29 - Confirmed[PPC](https://www.ppc.go.jp/files/pdf/APPI_english.pdf) — A business operator must disclose retained personal data to a data subject without delay, subject to statutory exceptions such as risk of harm to life or improper interference with business operations.observed 2026-07-29 - Confirmed[IAPP](https://iapp.org/news/a/japan-enacts-the-act-on-the-protection-of-personal-information) — Data subjects may demand correction, addition or deletion of the content of retained personal data.observed 2026-07-29 - Confirmed[IAPP](https://iapp.org/news/a/analysis-of-japans-approved-bill-to-amend-the-appi) — The 2020/2022 amendment expanded data subjects' rights to demand cessation of use, deletion, or cessation of third-party provision of retained personal data to cases where a data subject's rights or legitimate interests are likely to be infringed, beyond the prior narrow grounds of purpose-violation, improper collection, or unlawful third-party provision.observed 2026-07-29 - Confirmed[IAPP](https://iapp.org/news/a/analysis-of-japans-approved-bill-to-amend-the-appi) — The 2020/2022 amendment allows data subjects to require that their retained personal data be disclosed to them electronically, whereas the prior law did not expressly permit electronic-format disclosure demands.observed 2026-07-29 - Probable[IAPP](https://iapp.org/news/a/analysis-of-japans-approved-bill-to-amend-the-appi) — The APPI does not contain a distinct data-portability right equivalent to GDPR Article 20; electronic disclosure of retained personal data is the closest functional analogue.observed 2026-07-29