IIJ BCR-C Annex 4 - Rules Regarding the Data Subject’s Personal Data Rights
Version No. 1.0, 28th July 2021 Handle With Care

IIJ BCR-C Annex 4Rules Regarding the Data Subject’s Personal Data Rights

Version 1.0

28th July 2021
Internet Initiative Japan Inc.

1/4

IIJ BCR-C Annex 4 - Rules Regarding the Data Subject’s Personal Data Rights
Version No. 1.0, 28th July 2021 Handle With Care

Version No.

Revision Date Revision Reason & Details Approval

Creation/Revision

Ver. 1.0

28th July 2021 Initial Version

IIJ Chief Privacy OfficeMiyoshi

2/4

IIJ BCR-C Annex 4 - Rules Regarding the Data Subject’s Personal Data Rights
Version No. 1.0, 28th July 2021 Handle With Care

1. Positioning of this document
This document sets for the procedures for when there are requests from a Personal Data Subject for
notification and disclosure of the purpose of the use of his/her Personal Data, and/or for revision,
addition or deletion of the content, termination of use and deletion and termination of provision to athird party (referred to below as “Disclosure, etc.”).
2. Scope
The items set forth in these procedures apply to Personal Data that an IIJ Business Entity handles as
Data Controllers. Personal Data that is handled by Data Processers is handled according to thedocumented instructions of the Data Controller.
3. Responsibility and Authority
When there are requests from Personal Data Subjects for disclosure, etc. of Personal Data, the IIJ
Business Entity’s CPO shall be responsible for handling such requests that its IIJ Business Entity
may receive from Data Subjects, and cooperate with the IIJ CPO and the DPO to provide a responseto the Data Subject where necessary.
4. Procedures for Requests for Disclosure, etc.
If there are requests from a Personal Data Subject for disclosure, etc. of Personal Data, they are tobe handled according to the following procedure.
(a) Contact information for requesting disclosure, etc. shall be provided on a webpage of an
IIJ Business Entity with procedures for requesting disclosure, etc. of Personal Data.
(b) Requesting disclosure, etc. of Personal Data could be made by any means such as postal
mail, electronic / oral means.
(c) In the requests for disclosure, etc., the IIJ Business Entity shall verify the identity of theperson submitting the request or of an agent of that person, by requesting the submissionof documents sufficient to verify the claimed Identity. Furthermore, if an agent issubmitting the request for disclosure, etc., we shall request the submission of a letter ofpower of attorney.
(d) The IIJ Business Entity shall acknowledge receipt to the Data Subject promptly. The IIJ
Business Entity’s CPO, where necessary in cooperation with the IIJ CPO and the DPO,
shall provide a substantive response,without undue delay and at the latest within onemonth, with the reasons for not taking action (where applicable), the possibility of lodging
a complaint with a DPA, and seeking a judicial remedy. The time for response may be
extended by two additional months taking into account the complexity and number of therequests. In such case, the Data Subject shall be informed accordingly.
5. Safeguard Measures
When implementing measures stipulated in these provisions, we shall implement safeguard
measures so that we do not disclose or leak the Personal Data of the Data Subject.

End.
3/4

IIJ BCR-C Annex 4 - Rules Regarding the Data Subject’s Personal Data RightsVersion No. 1.0, 28th July 2021 Handle With Care

Supplementary Provisions
These rules shall take effect from 28th July 2021.

4/4