Can I request cessation of data use?

What the Law Says

Japan’s Act on the Protection of Personal Information (APPI) gives individuals the right to request that a business stop using their personal data in certain circumstances.

Under Article 29 of the APPI, if a personal information handler is using your data in violation of the law — for example, without proper consent or beyond the stated purpose — you may request cessation of use.

The handler must respond to your request without unjustifiable delay and, in principle, must cease use within 30 days. They must also notify you of the results of their investigation and action taken.

This right applies only to personal information handlers who hold data in a database system (i.e., electronically stored and searchable). It does not apply to paper-based records unless they are part of an integrated electronic system.

You may make the request in writing (including email, if accepted by the handler), and no fee may be charged for processing it.

Statutory Text

A person whose personal data is held by a personal information handler may request the cessation of use of such data if the handler has used the data in violation of Article 16.

— Act on the Protection of Personal Information, s. 29 — Request for Cessation of Use

Statutory Text

The personal information handler shall, without unjustifiable delay, investigate the facts and take necessary measures, and notify the person who made the request of the results of the investigation and the measures taken.

— Act on the Protection of Personal Information, s. 29 — Request for Cessation of Use

What to Do

Sources