PANORAMICCYBERSECURITYJapan

LEXOLOGY

Cybersecurity
Contributing Editors
Edward R McNicholas and Fran Faircloth
Ropes & Gray LLPGenerated on: July 19, 2024
The information contained in this report is indicative only. Law Business Research is not responsible
for any actions (or lack thereof) taken as a result of relying on or in any way using information containedin this report and in no event shall be liable for any damages resulting from reliance on or use of thisinformation. Copyright 2006 - 2024 Law Business Research

Explore on Lexology

Contents
Cybersecurity
LEGAL FRAMEWORKKey legislation
Most affected economic sectors
International standards
Personnel and director obligations
Key deunitions
Mandatory minimvm protectiCe measvres
hybertFreats to intellectval property
hybertFreats to critical infrastrvctvre
Restrictions on cybertFreat information sFaring
hriminal actiCities
hlovd compvting
Voreign organisations
BEST PRACTICE
Recommended additional protections
GoCernment incentiCes
Indvstry standards and codes of practice
Responding to breacFes-olvntary information sFaring
PvblicEpriCate cooperation
Insvrance
ENFORCEMENT
Regvlatory avtForities
x'tent of avtForitiesw pojers
Most common enforcement issves
Regvlatory and data svbkect notiucation
Penalties for nonEcompliance jitF cybersecvrity regvlations
Penalties for failvre to report tFreats and breacFes
PriCate enforcement
THREAT DETECTION AND REPORTING
Internal policies and procedvres
RecordEqeeping reTvirements
Regvlatory reporting reTvirements
Oime frames
NtFer reporting reTvirements
UPDATE AND TRENDS

Cybersecurity 2024

Explore on Lexology

Recent deCelopments and fvtvre cFanges

Cybersecurity 2024

Explore on Lexology

RETURN TO CONTENTS

Contributors
Japan_agasFima NFno & Osvnematsv
Yasushi Kudo
Tsubasa Watanabe
Hayato Maruta

Cybersecurity 2024

yasvsFi@qvdo.noandtScom
tsvbasa@jatanabe.noandtScom
Fayato@marvta.noandtScom

Explore on Lexology

RETURN TO CONTENTSLEGAL FRAMEWORKKey legislation
Dvmmarise tFe main statvtes and regvlations tFat regvlate or promote
cybersecvrityS ?oes yovr kvrisdiction FaCe dedicated cybersecvrity lajsW
The Japanese government has enacted the Basic Act on Cybersecurity (BAC), which
deznes cybersecurity and mandates that both national and local governments formulate
and implement cybersecurity policies. The BAC also establishes an obligation on private
businesses and citi’ens to make efforts to ensure cybersecurity.
The Act on the Protection of Personal Information (APPI) also imposes on business
operators handling personal information the obligation to take security measures to prevent
leakage, loss or damage of personal data. These security control measures encompass
technical, organisational, human and physical security control measures.
The Telecommunications Business Act (TBA) imposes on telecommunications carriers
the obligation to establish rules for information handling, including security control
measures to prevent incidents such as the leakage of users1 information due to breach ofcommunication conzdentiality. These carriers must notify the Minister of Internal Affairs andCommunications (MIC) of such rules.
These laws and other related laws and regulations ensure that businesses handlingsensitive information adhere to stringent security standards to safeguard data integrity andconzdentiality.
Law stated - 1 6 2024

Most affected economic sectors
HFicF sectors of tFe economy are most affected by cybersecvrity lajs
and regvlations in yovr kvrisdictionW
The most affected are the following 5S sectors, as designated in Annex 5 of
the Cybersecurity Policy for Critical Infrastructure Protection (CPCIP), developed by the
Cybersecurity •trategy Center based on article 52 of the BAC.
F Information and Communication
F Winancial •ervices
F Aviation
F Airports
F Railways
F Electric Power •upply
F Gas
F Government and Administrative •ervices
F Medical
F 3ater •upply

Cybersecurity 2024

Explore on Lexology

RETURN TO CONTENTS

F Logistics
F Chemical Industry
F Credit Cards
F Petroleum Industry
F Port Transport.
The critical social infrastructure providers (C•IPs), as dezned under article ‘(5) of the
BAC, doing business in these sectors are legally obliged to respond to a cybersecurity
incident and report it to the competent regulatory authorities under business-related
regulations established by the said authorities. The C•IPs are also obliged to make efforts
Qto cooperate in the implementation of the cybersecurity policy that the national or local
government implements1 and ensure that they respond to the matters stipulated in theaction plan established by the national government under article 6 of the BAC. •pecizcally,
this efforts-basis obligation encompasses strengthening systems for incident response,developing safety standards, strengthening information sharing systems and employing risk
management.
Law stated - 1 6 2024

International standards’as yovr kvrisdiction adopted any international standards related tocybersecvrityW
Based on the Industrial •tandardi’ation Act, the Japanese government has establishedthe Japanese Industrial •tandards (JI•) as domestic standards for industry. The JI• refers
to standards established by the International Organi’ation for •tandardi’ation (I•O) as
the international ideal. Therefore, the JI• related to information security also re7ect theinternational standards related to information security established by the I•O. JI• that referto the information security management system (I•M•) standardised by I•O include JI• :290008205q, JI• : 290058202‘, JI• : 2900282024, JI• : 290068205H, JI• : 2905482020 asa standard for governance of information security, and JI• : 2905982056 as a standard for
security measures in response to cloud services.
Law stated - 1 6 2024

Personnel and director obligations
HFat are tFe obligations of responsible personnel and directors toqeep informed abovt tFe adeTvacy of tFe organisation,s protection of
netjorqs and data( and Foj may tFey be Feld responsible for inadeTvate
cybersecvrityW
The general interpretation in respect of directors1 duty of care under the Companies
Act is that it encompasses responsibility for managing cybersecurity risks through theestablishment and operation of an internal control system. Therefore, directors, including
representative directors and chief information security o;cers, are obligated to establish

Cybersecurity 2024

Explore on Lexology

RETURN TO CONTENTS

and operate an appropriate cybersecurity system. Wulzlling this obligation entails managing
and ensuring the adejuacy of the organisation1s cybersecurity defences.
In addition, in companies mandated to implement safety control measures and ensure thecybersecurity of their information based on the individual laws and guidelines, the person
in charge of taking such measures and ensuring cybersecurity must evaluate and maintainthe I•M• and overall cybersecurity system. This ensures ongoing compliance and theeffectiveness of security measures.
Law stated - 1 6 2024

Key devnitions’oj does yovr kvrisdiction deune wcybersecvrityw and wcybercrimewW
Article 2 of the BAC deznes cybersecurity as the state whereby measures are taken for
appropriate security management, including the prevention of leakage, loss or damageof information recorded or communicated electronically, and for ensuring the safety andreliability of information systems and networks, and which state is properly maintained andmanaged. In Japan, data privacy and cybersecurity are treated as distinct concepts, and
the APPI covers data privacy. Dowever, the above deznition encompasses measures forappropriate security control of information and the proper maintenance of these measuresand overlaps with the obligation under the APPI to adopt security control measures for
personal data. In addition, the National Police Agency, in Chapter ‘ of its 3hite Paper issued
in 2024, deznes cybercrime as Qviolations of the Act on the Prohibition of Unauthori’ed
Computer Access, crimes involving computer and electromagnetic records, and othercrimes that use advanced information and communications networks as an essential means
for their commission1.
Law stated - 1 6 2024

Mandatory minimum protectiVe measures
HFat are tFe minimvm protectiCe measvres tFat organisations mvst
implement to protect data and information tecFnology systems fromcybertFreatsW
In Japan, while certain businesses are obligated to adopt safety control measures forcybersecurity pursuant to the relevant laws and regulations, there is no rigid deznitionof specizc methods as minimum rejuirements rather, these methods are presented as
reference information in the applicable guidelines. Each business entity is evaluated basedon its implementation of measures deemed ejuivalent to or higher than a certain level,
ensuring security in consideration of the associated risks. Wor instance, the APPI outlines
specizc methods for implementing security control measures against cyber-attacks, andthese methods are designed for business operators handling personal information. Dowever,
the methods are set forth as examples and their adoption is not compulsory.
In addition, entities designated as C•IPs under the BAC are mandated to implement certain
safety control measures for cybersecurity. These measures are aligned with the laws
governing their respective industries and are overseen by the relevant competent authorities.

Cybersecurity 2024

Explore on Lexology

RETURN TO CONTENTS

Law stated - 1 6 2024

Cyberthreats to intellectual property?oes yovr kvrisdiction FaCe any lajs or regvlations tFat speciucallyaddress cybertFreats to intellectval propertyW
In Japan, the Unfair Competition Act (UCA) serves as the legislation governing cyberthreats
to intellectual property, imposing criminal penalties for various acts, including the acjuisitionof trade secrets through unauthorised access with the intent to gain an advantage for oneself
or to infringe upon the advantage of a third party.
According to the UCA, a trade secret is dezned as information meeting the following criteria8
F It must be kept conzdential.
F It must consist of technical or business information that is benezcial for conducting
business activities.
F It must not be publicly known.
Law stated - 1 6 2024

Cyberthreats to critical infrastructure?oes yovr kvrisdiction FaCe any lajs or regvlations tFat speciucallyaddress cybertFreats to critical infrastrvctvre or speciuc sectorsW
The BAC has identized 5S sectors encompassing critical infrastructure pro ects such as
gas and electricity. Operators within these sectors are designated as C•IPs under the BAC.
C•IPs are sub ect to, among other rejuirements, the CPCIP and its associated guidelines forestablishing safety standards, as outlined in the BAC. Additionally, each C•IP is obligated toadhere to the cybersecurity regulations stipulated by the corresponding competent authority
overseeing its sector. They are also rejuired to collaborate with such agencies to bolster
cybersecurity efforts.
Law stated - 1 6 2024

Restrictions on cyberthreat information sharing?oes yovr kvrisdiction FaCe any cybersecvrity lajs or regvlations tFat
speciucally restrict sFaring of cybertFreat informationW
Under the TBA in Japan, criminal penalties are prescribed for actions that violate the secrecyof communications. Consejuently, there was debate regarding whether the sharing ofcyberthreat information could potentially infringe upon this secrecy of communications.
In response to this issue, MIC, which supervises the telecommunications industry
under the TBA, initiated a study group to address the matter. This study group hascompiled a report that concludes that, to enable internet service providers to effectively

Cybersecurity 2024

Explore on Lexology

RETURN TO CONTENTS

respond to cyberattacks, the sharing of specizc information deemed necessary forcybersecurity measures by these providers does not constitute a violation of the secrecyof communications.
Law stated - 1 6 2024

Criminal actiVities
HFat are tFe principal cyberactiCities )svcF as FacqingA tFat are
criminalised by tFe laj of yovr kvrisdictionW
The principal criminal cyber activities that are relevant to organisations are as follows8
F Unauthorised access to a computer system with restricted access via a network
without legitimate authority, as provided in the Act on the Prohibition of Unauthori’ed
Computer Access.
F 3rongfully creating electronic data used in processing a person1s affairs, or using
such data for illegitimate purposes, as provided in article 565-2 of the Penal Code.
F Creating or distributing malware without ustizable reason, as provided in article 56H-2
and article 56H-‘ of the Penal Code.
F Interfering with a person1s business by disrupting the operation of a computer usedin the course of business, as provided in article 2‘4-2 of the Penal Code. In addition,
un ust economic gain by providing false information to a computer or by other meansin relation to such a computer is punishable under article 246-2 of the Penal Code.
Law stated - 1 6 2024

Cloud computing’oj Fas yovr kvrisdiction addressed information secvrity cFallenges
associated jitF clovd compvtingW
To mitigate cybersecurity risks associated with the utilisation of cloud services, theJapanese government has implemented several measures. One of these measures is theestablishment of JI• : 2905982056, which serves as the Japanese domestic standard for
information security control measures specizcally tailored for cloud services. This standard
is based on the I•O framework. In addition, in response to these risks, the government
has introduced the Information •ecurity Management Assurance Program (I•MAP). I•MAP
functions as a system to pre-evaluate and register cloud service providers that satisfy
the security criteria set forth by the Japanese government. This initiative aims to provide
assurance to users regarding the security posture of cloud service providers operating within
Japan.
Law stated - 1 6 2024

Foreign organisations

Cybersecurity 2024

Explore on Lexology

RETURN TO CONTENTS’oj do yovr kvrisdiction,s cybersecvrity lajs affect foreign organisations
doing bvsiness in yovr kvrisdictionW re tFe regvlatory obligations tFe
same for foreign organisationsW
Japanese cybersecurity-related laws are applied consistently, regardless of whether thebusiness entity is domestic or foreign. Therefore, such laws apply ejually to foreignbusinesses operating in Japan.
Wor instance, provisions in the APPI concerning the transfer of personal data to third parties
and the international transfer of personal data are applicable to foreign businesses operatingin Japan, especially if they transfer personal data to their overseas parent companies.
Moreover, if a foreign parent company provides goods or services to individuals in Japan
from outside the country and handles personal information in the process, the APPI1s
extraterritorial clause directly applies to this parent company, thereby sub ecting it to theprovisions of the APPI.
Law stated - 1 6 2024

BEST PRACTICE

Recommended additional protections?o tFe avtForities recommend additional cybersecvrity protections
beyond jFat is mandated by lajW
The Ministry of Economy, Trade and Industry (METI) and the Information-technology
Promotion Agency, Japan (IPA) have published the Cyber •ecurity Management Guidelines(CMG). These guidelines summarise Q‘ principles1 that management needs to be aware of
and Q50 important items1 that should be directed to the chief information security o;cer(CI•O).
In addition, the competent authorities that supervise the operations of C•IPs have issued
guidelines to the critical social infrastructure providers (C•IPs) they supervise, outlining
safety control measures for cybersecurity initiatives.
Law stated - 1 6 2024

GoVernment incentiVes’oj does tFe goCernment incentiCise organisations to improCe tFeir
cybersecvrityW
The Japanese government has not implemented an incentive system to incentivise
cybersecurity enhancements.
Law stated - 1 6 2024

Industry standards and codes of practice

Cybersecurity 2024

Explore on Lexology

RETURN TO CONTENTS

Identify and ovtline tFe main indvstry standards and codes of practicepromoting cybersecvrityS HFere can tFese be accessedW
The JI• in reference to the I•O has been established as the domestic standard in Japan.
Wurther, METI and Information-technology Promotion Agency, Japan (IPA) have published
the CMG and a collection of practices for its implementation of the CMG for cybersecurity.
The three principles and 50 directives set forth by the CMG are outlined below, respectively.
Three principles that management should be aware of8
F Principle 58 Management will promote measures under its own behest.
F Principle 28 Attention must be paid to cybersecurity measures throughout the supply
chain.
F Principle ‘8 Proactive communication with stakeholders is necessary in both normal
times and emergencies.
F Ten key cybersecurity management issues8
F irective 58 Recognise risks and develop an organisation-wide response policy.
F

irective 28 Establish a risk management system.

F irective ‘8 •ecure resources (budget, human resources, etc) for cybersecurity
measures.
F irective 48 Identify risks and develop a plan in response to such risk.
F

irective S8 Establish a mechanism to effectively respond to risks.

F irective 68 Continually improve cybersecurity measures through P CA cycle.
F irective 98 Establish an emergency response system in the event of anincident.
F irective H8 Establish a business continuity and recovery system in preparation
for harm caused by incidents.
F

irective q8 Assess the status of the entire supply chain and takecountermeasures.

F irective 508 Promote the collection, sharing and disclosure of cybersecurity
information.
Law stated - 1 6 2024

Responding to breaches
re tFere generally recommended best practices and procedvres forresponding to breacFesW
The CMG developed and published by METI and IPA also contain reference materials forincident response.
Moreover, businesses handling personal data are rejuired to implement safety management
measures outlined in the Guidelines Regarding the Act on the Protection of Personal
Information, formulated under the Act on the Protection of Personal Information (APPI). In

Cybersecurity 2024

Explore on Lexology

RETURN TO CONTENTS

the event of a personal data breach, they must follow the procedures described in theseguidelines.
Wurthermore, the Japan Computer Emergency Response Team Coordination Center has
issued an Incident Dandling Manual to guide responses to incidents such as information
leaks. Additionally, IPA has published a •ecurity Incident Dandling Manual specizcallytailored for small and medium-si’ed enterprises.
Wor additional resources, the Japan Network •ecurity Association, a non-prozt organisation
focusing on network security, maintains a list of security response providers and digitalforensics companies that can offer assistance in the event of a cyber incident. This list serves
as a valuable reference for businesses seeking support during such incidents.
Law stated - 1 6 2024

'oluntary information sharing?escribe practices and procedvres for Colvntary sFaring of information
abovt cybertFreats in yovr kvrisdictionS re tFere any legal or policy
incentiCesW
Currently in Japan, there is no legal framework that provides incentives for sharing
information on cybersecurity incidents. Dowever, the Basic Act on Cybersecurity (BAC) led
to the establishment of the Cyber •ecurity Council, aimed at facilitating the prompt sharing
of information to enhance cybersecurity.
In 202‘, the Cyber •ecurity Council issued the Guidance for •haring and Publici’ing
Information on Cyber Attacks, aiming to promote information sharing in the event ofcyber-attacks. Moreover, in 2055, IPA initiated the Initiative for Cyber •ecurity Information•haring Partnership of Japan (J-C•IP) as a platform for information exchange and early
response, primarily among manufacturers of critical infrastructure ejuipment.
Law stated - 1 6 2024

Public-priVate cooperation’oj do tFe goCernment and priCate sector cooperate to deCelop
cybersecvrity standards and procedvresW
cybersecurity, the Japanese government convenes a conference body comprising
government and private-sector experts. These bodies formulate, publish and enforce
regulations based on the outcomes of their deliberations.
Wor instance, the CMG and the collection of practices, which aid in implementing thedirectives outlined in the CMG, are crafted and published by METI and IPA. These documents
are developed with the input of private-sector experts who participate as members of thestudy committee, incorporating the results of their discussions.
Law stated - 1 6 2024

Cybersecurity 2024

Explore on Lexology

RETURN TO CONTENTS

Insurance
Is insvrance for cybersecvrity breacFes aCailable in yovr kvrisdiction andis svcF insvrance obtainable for most organisationsW ’oj common is itW
In Japan, numerous insurance companies provide cyber insurance policies.
Law stated - 1 6 2024

ENFORCEMENT

Regulatory authorities
HFicF regvlatory avtForities are primarily responsible for enforcing
cybersecvrity rvlesW
The National Center of Incident Readiness and •trategy for Cybersecurity (NI•C), which isformed as the secretariat of the Cybersecurity •trategy Deadjuarters under the Basic Act on
Cybersecurity (BAC), is also tasked with formulating and operating the Cybersecurity Policy
for Critical Infrastructure Protection (CPCIP).
The competent authorities that oversee the CPCIP1s operations, such as the Japan Winancial•ervices Agency, Minister of Internal Affairs and Communications (MIC), Ministry of Dealth,Labour, and 3elfare, METI and the Ministry of Land, Infrastructure, Transport, and Tourism,are tasked with developing and implementing cybersecurity guidelines for the businesses
under their supervision.
On the other hand, the National Police Agency and Public Prosecutor1s O;ce possess
criminal investigative authority over criminal acts, including cybercrimes. Dowever, only the
Public Prosecutor1s O;ce has the authority to indict cybercrimes.
Law stated - 1 6 2024

Extent of authoritiesj powers?escribe tFe avtForities, pojers to monitor compliance( condvct
inCestigations and prosecvte infringementsS
Under the BAC, NI•C has the authority to rejuest any person to provide materials,
explanations, or other cooperation as necessary to carry out its duties. These duties include
investigations to determine the causes of serious cybersecurity events and the evaluationof countermeasures. Dowever, such rejuests are voluntary, and a person who refuses tocooperate will not face any adverse consejuences.
In addition, under the Act on the Protection of Personal Information (APPI), the Personal
Information Protection Commission (PPC) is empowered to rejuest reports from business
operators handling personal information, rejuest submission of documents and conduct
on-site inspections. These actions are taken when there are concerns regarding safety
management measures, including cybersecurity, implemented by such business operators.

Cybersecurity 2024

Explore on Lexology

RETURN TO CONTENTS

Wurthermore, each government agency possesses extensive administrative supervisory
authority over businesses within its urisdiction. Wor instance, MIC oversees
telecommunications carriers, while the Ministry of Dealth, Labour, and 3elfare regulates
pharmaceutical companies. Consejuently, these administrative supervisory authorities may
conduct investigations as needed, which may involve rejuesting reports and materials frombusinesses under their supervision, including matters related to cybersecurity.
Law stated - 1 6 2024

Most common enforcement issues
HFat are tFe most common enforcement issves and Foj FaCe regvlatorsand tFe priCate sector addressed tFemW
In recent years, unauthorised access and ransomware attacks have frejuently resulted
in the leakage of personal data and breaches of the secrecy of telecommunications. In
response, PPC and MIC have taken administrative actions, such as rejuesting reports andmaterials and recommending business improvements, against businesses responsible forthese breaches.
Wor example, in autumn 202‘, there was unauthorised access to the internal systems of awell-known telecommunications carrier by way of a malware attack on an employee of acontractor to which the carrier had outsourced certain operations. This incident resulted in
the leakage of a large amount of personal data. Consejuently, PPC and MIC commenced
administrative actions against the telecommunications carrier.
Law stated - 1 6 2024

Regulatory and data subkect notivcation
HFat regvlatory notiucation obligations do bvsinesses FaCe follojing acybersecvrity breacFW Mvst data svbkects be notiuedW HFen is notice
reTviredW
Under the APPI, if there is a breach of personal data (including leakage, loss or damage
to personal data hereinafter the same) or a threat thereof and there is a risk of harm toindividuals1 rights and interests associated with such data, the business operator handlingthe personal information is rejuired to report the incident to PPC within approximately three
to zve days from identifying the incident and also to promptly notify the affected individuals.
Dowever, the PPC has delegated authority to the relevant authorities under the APPI, andsuch business operator must report to different parties depending on the type of business.
Wor example, banks and internet service providers are rejuired to report personal data
breaches to the Japan Winancial •ervices Agency and MIC, respectively. Wurther, suchbusiness operators are generally rejuired to report further details of the breach tothe competent authorities within ‘0 days of learning about the personal data breach.
In addition, under the Telecommunications Business Act (TBA), a telecommunications
business carrier is rejuired to Qpromptly1 report any incident of infringement of the secrecyof communications to the General Telecommunications Administration or the relevant

Cybersecurity 2024

Explore on Lexology

RETURN TO CONTENTS

authority having urisdiction over the location of its headjuarters. The carrier must also
report additional details within ‘0 days of learning about the incident.
Law stated - 1 6 2024

Penalties for non-compliance with cybersecurity regulations
HFat penalties may be imposed for failvre to comply jitF regvlations
aimed at preCenting cybersecvrity breacFesW
In addition to the criminal penalties for the cyber activities, violations of the safety control
measures rejuired under the APPI and other relevant laws and regulations such as the TBA
may result in administrative penalties. These penalties can include business improvement
orders against the violating business operator or the publication of the business operator1s
name by the relevant regulatory authorities.
Law stated - 1 6 2024

Penalties for failure to report threats and breaches
HFat penalties may be imposed for failvre to comply jitF tFe rvles onreporting tFreats and breacFesW
If there is a breach of personal data or a threat thereof, and there is a risk of harm toindividuals1 rights and interests associated with such data, a prompt report to the PPC andother relevant authorities is rejuired, followed by a detailed report within a specized period.
Additionally, notizcation to the affected individuals is also mandated. If the business operator
handling personal information fails to meet these obligations, the PPC may rejuest a reportor conduct an on-site inspection of the business operator.
As a result of this investigation, the PPC may issue administrative guidance,
recommendations, or orders to the said business operator for improvement. If the saidbusiness operator makes a false report, refuses to report or fails to comply with the PPC1s
order, the business operator will be sub ect to criminal penalties.
If a telecommunications carrier fails to report a case or makes a false report in violationof the reporting obligation imposed on the said carrier when a case of infringement of thesecrecy of communications occurs under the TBA, the telecommunications carrier will also
be sub ect to criminal penalties.
Law stated - 1 6 2024

PriVate enforcement’oj can parties seeq priCate redress for vnavtForised cyberactiCity or
failvre to adeTvately protect systems and dataW
A lawsuit for damages may be possible based on tort law or for breach of contractual
conzdentiality obligations.

Cybersecurity 2024

Explore on Lexology

RETURN TO CONTENTS

Law stated - 1 6 2024

THREAT DETECTION AND REPORTING

Internal policies and procedures
HFat policies or procedvres mvst organisations FaCe in place to protect
data or information tecFnology systems from cybertFreatsW
The Personal Information Protection Commission (PPC) publishes security control
measures that outline specizc methods for business operators handling personal
information, in accordance with the Act on the Protection of Personal Information (APPI)
guidelines. Dowever, these methods are provided as examples and are not mandatory. In
Japan, certain business operators are rejuired to implement safety control measures forcybersecurity pursuant to relevant laws and regulations. Nonetheless, there are no specizc
policies or procedures that organisations must put in place to comply with these safetycontrol measures.
Law stated - 1 6 2024

Record-qeeping re uirements?escribe any rvles reTviring organisations to qeep records of cybertFreats
or attacqsS
In Japan, there is no explicit legal rejuirement mandating the retention of records, including
logs, documenting cyber threats and attacks. Dowever, under the Basic Act on Cybersecurity(BAC), critical social infrastructure providers (C•IPs) are obligated to share information
concerning cyber threats and attacks with competent authorities, in accordance with
the Cybersecurity Policy for Critical Infrastructure Protection (CPCIP). Consejuently, it isunderstood that C•IPs should maintain comprehensive records for a specized duration
to facilitate the provision of such information and to address injuiries from competentauthorities when deemed necessary.
Moreover, beyond entities covered by C•IPs, if a cyber-attack leads to or is anticipated toresult in an imminent breach of personal data, reporting to the PPC becomes obligatory.
In such instances, the retention of information related to cyber threats and attacks may benecessary to fulzl this reporting rejuirement adejuately.
In addition, telecommunications service providers may be compelled by investigative
agencies such as the National Police Agency, pursuant to the Act on Criminal Procedure, tomaintain communication and other records pertaining to a specizc individual or organisation
for up to 60 days for criminal investigations. Consejuently, it is customary for logs spanning
this time frame not to be deleted.
Law stated - 1 6 2024

Regulatory reporting re uirements

Cybersecurity 2024

Explore on Lexology

RETURN TO CONTENTS?escribe any rvles reTviring organisations to report cybersecvrity
breacFes to regvlatory avtForitiesS
Both the APPI and the Telecommunications Business Act (TBA) mandate expeditious
reporting to the PPC or other competent authorities in the event that a breach or potential
breach of personal data or an occurrence of the infringement of the secrecy of thecommunication meet specizc criteria. It is important to note that this reporting rejuirement
is triggered solely by the occurrence of a breach or the presence of a threat of breach or
such occurrence, without necessitating an actual breach. Additionally, there exists no legal
obligation for a company to report to authorities when it has experienced an attack that has
not yet resulted in a breach or threat of breach or such occurrence, nor is there a rejuirement
to report vulnerabilities to authorities.
Wurthermore, the mandated report must encompass various details, including a summary of
the incident, the nature of the leaked or potentially leaked information, pertinent information
regarding affected individuals and the root cause of the incident, among other relevant
information.
Law stated - 1 6 2024

Time frames
HFat is tFe timeline for reporting to tFe avtForitiesW
Under the regulations stipulated by the APPI, if a breach or a threat of breach of personal data
occurs and there is a risk of harm to the rights and interests of individuals, business operators
are obligated to expeditiously report the incident to PPC or other relevant supervisory bodies
within approximately three to zve days from the date of identifying the breach or potential
threat. Wurther, they are generally rejuired to provide an additional detailed follow-up report
within ‘0 days of the initial identizcation date.
Under the TBA, a telecommunications carrier is rejuired to Qpromptly1 report any incident
of infringement of the secrecy of communications to the competent authority having
urisdiction over the location of its headjuarters. The carrier must also report additional
details within ‘0 days of learning about the incident.
Law stated - 1 6 2024

Other reporting re uirements?escribe any rvles reTviring organisations to report tFreats or breacFes
to otFers in tFe indvstry( to cvstomers or to tFe general pvblicS
C•IPs dezned under the BAC necessitate the dissemination of cyber threat intelligence andinformation on cyber-attacks to competent authorities, aligning with the guidelines set forth
by the CPCIP.
Moreover, the APPI imposes distinct notizcation responsibilities on business operators
handling personal data. •hould there be a breach or a threat of breach of personal data
meeting specizc criteria, these operators are obligated to notify the individuals associatedwith said data.

Cybersecurity 2024

Explore on Lexology

RETURN TO CONTENTS

Listed companies, as mandated by the Winancial Instruments and Exchange Act, must
disclose annual znancial statements and related documents. These statements necessitate
the comprehensive delineation of business risks, encompassing cybersecurity threats
among them. Consejuently, there has been a discernible uptick in the disclosure ofcybersecurity risks by an expanding cohort of listed companies in recent years.
In cases of cybersecurity breaches such as information leaks, listed companies may znd
themselves obligated to promptly disclose the incident and their response measures, sub ect
to meeting specizc criteria outlined in the timely disclosure regulations established by eachsecurities exchange. Dowever, even if these criteria are not met, a listed company reserves
the option to voluntarily disclose the security breach in a timely fashion.
Law stated - 1 6 2024

UPDATE AND TRENDS

Recent deVelopments and future changes
HFat are tFe principal cFallenges to deCeloping cybersecvrity
regvlationsW ’oj can companies Felp sFape a faCovrable regvlatory
enCironmentW ’oj do yov anticipate cybersecvrity lajs and policies jill
cFange oCer tFe ne't year in yovr kvrisdictionWThe Information-technology Promotion Agency, Japan publicly reported Q50 Ma or •ecurity
Threats 20241, which concerns threats to enterprises, attacks exploiting vulnerabilities
embedded in the supply chain are ranked as the second-highest threat, while damage causedby ransomware attacks is ranked zrst.
Therefore, in Japan, in addition to ransomware attacks, dealing with supply chain risks has
become a challenging risk in cybersecurity.
In light of supply chain vulnerabilities, Japanese corporations are signizcantly emphasising
the necessity of addressing supply chain risks within their operational frameworks. They
are turning to a range of guidelines provided by organisations such as the Cybersecurity
Management Guideline and Cybersecurity Policy for Critical Infrastructure Protection(CPCIP) to inform their risk response strategies. Collaborative initiatives with businessassociates are deemed indispensable in effectively mitigating these risks.
Given this trend, the Japanese government has established a system (•ystem) operationalfrom May 2024, under the Economic •ecurity Promotion Act to ensure provision of essential
infrastructure services (EI•) and enhance the supply chain risk management, including
ensuring cybersecurity in the EI•. The •ystem is aimed at fortifying EI• resilience against
cyber threats and ensuring a comprehensive response to emerging challenges. Under the•ystem, (5) EI• encompasses services in electricity, gas, oil, water, railways, truck transport,international maritime cargo, aviation, airports, telecommunications, broadcasting, postal
services, znancial services, credit cards and port transport and (2) competent authorities of
the Japanese government conduct a prior screening process and issue recommendations ororders concerning the installation or entrustment of maintenance, etc, of the critical facilities
of EI•.

Cybersecurity 2024

Explore on Lexology

RETURN TO CONTENTS

In response to the screening process under the •ystem, it is likely that the suppliers andvendors of EI• operators would not be able to carry out transactions with EI• operators as
a result of the recommendation by the relevant authorities. Therefore, the •ystem is likely
to incentivise and promote collaborative work between EI• operators and the suppliers andvendors of EI• operators to enhance the cybersecurity resilience in the supply chain risk
management.
Law stated - 1 6 2024

Cybersecurity 2024

Explore on Lexology