サイバーセキュリティ: 日本 (2026)
Japan operates a comprehensive, multi-layered cybersecurity regime anchored by the Basic Act on Cybersecurity (2014, amended 2025) and recently strengthened by the Active Cyber Defense (ACD) Acts enacted on 16 May 2025, which impose incident-reporting and cooperation duties on operators across 15 critical-infrastructure sectors with phased implementation through 2026-2027 and most provisions commencing 1 October 2026. The National Cybersecurity Office (NCO), established July 2025 as the enhanced successor to NISC within the Cabinet Secretariat, is the central coordinating authority, while the APPI (overseen by the Personal Information Protection Commission) governs personal-data breach notification. Sectoral regulators (FSA, METI, MIC, MHLW, etc.) layer additional cybersecurity rules on finance, telecoms, energy, healthcare and other critical sectors.
主要なフレームワーク
Basic Act on Cybersecurity (Act No. 104 of 2014, amended 2025) supplemented by the Active Cyber Defense Acts (May 2025), the Economic Security Promotion Act (2022), and the Act on the Protection of Personal Information (APPI); coordinated by the National Cybersecurity Office (NCO, successor to NISC, July 2025)
要点
Framework law
The Basic Act on Cybersecurity (Act No. 104 of 2014) establishes the national cybersecurity strategy, allocates responsibilities to central/local government and critical infrastructure operators, and underpins the Common Cybersecurity Standards for Critical Infrastructure (updated under the 2025 amendments).
Active Cyber Defense Acts (2025)
The Cyber Response Capabilities Enhancement Act and related amendment Act were enacted on 16 May 2025; most provisions take effect on 1 October 2026 with full phased implementation by 2027. They authorise government monitoring of communications, pre-emptive neutralisation of attack infrastructure, and new mandatory reporting/cooperation duties on operators in 15 critical infrastructure sectors.
National Cybersecurity Office (NCO)
The NCO was established in July 2025 within the Cabinet Secretariat as the control-tower successor to NISC, led by the National Cyber Director, to coordinate public- and private-sector cybersecurity policy and operations.
Critical infrastructure (15 sectors)
Designated Specified Essential Infrastructure Service Providers across 15 sectors (information & communications, finance, aviation, airports, railways, electric power, gas, government services, medical, water, logistics, chemicals, credit cards, petroleum, ports) are subject to prior screening of critical equipment under the Economic Security Promotion Act (2022) and to incident-reporting duties to competent ministries and the NCO.
Personal-data breach notification (APPI)
Under the Act on the Protection of Personal Information, controllers must report qualifying breaches (including leaks of Special Care-Required Information, leaks suspected to be malicious, or incidents affecting 1,000+ individuals) to the Personal Information Protection Commission - a preliminary report within 3-5 days and a detailed report within 30 days (60 days where malicious intent is suspected) - and notify affected individuals. A 2026 amendment (promulgated July 2026) introduces a more risk-based individual-notification regime.
Sectoral cybersecurity rules
Sector-specific obligations layer onto the framework: the Financial Services Agency's guidelines for financial institutions, the Telecommunications Business Act (MIC) for carriers, Electricity Business Act rules (METI) for utilities, and medical-sector cybersecurity guidelines from MHLW. The Cybersecurity Strategic Headquarters' Common Cybersecurity Standards for Critical Infrastructure (31 July 2026 update) set baseline requirements across these sectors.
このページは便宜上翻訳されたものです。英語版が正式なものであり、法的助言ではありません。