Cybersecurity law & regulation in Japan (2026)
Cybersecurity in Japan: comprehensive law.
Japan operates a comprehensive, multi-layered cybersecurity regime anchored by the Basic Act on Cybersecurity (2014, amended 2025) and recently strengthened by the Active Cyber Defense (ACD) Acts enacted on 16 May 2025, which impose incident-reporting and cooperation duties on operators across 15 critical-infrastructure sectors with phased implementation through 2026-2027 and most provisions commencing 1 October 2026. The National Cybersecurity Office (NCO), established July 2025 as the enhanced successor to NISC within the Cabinet Secretariat, is the central coordinating authority, while the APPI (overseen by the Personal Information Protection Commission) governs personal-data breach notification. Sectoral regulators (FSA, METI, MIC, MHLW, etc.) layer additional cybersecurity rules on finance, telecoms, energy, healthcare and other critical sectors.
Legal framework
Basic Act on Cybersecurity (Act No. 104 of 2014, amended 2025) supplemented by the Active Cyber Defense Acts (May 2025), the Economic Security Promotion Act (2022), and the Act on the Protection of Personal Information (APPI); coordinated by the National Cybersecurity Office (NCO, successor to NISC, July 2025)
Key points: cybersecurity in Japan
Framework law
The Basic Act on Cybersecurity (Act No. 104 of 2014) establishes the national cybersecurity strategy, allocates responsibilities to central/local government and critical infrastructure operators, and underpins the Common Cybersecurity Standards for Critical Infrastructure (updated under the 2025 amendments).
Active Cyber Defense Acts (2025)
The Cyber Response Capabilities Enhancement Act and related amendment Act were enacted on 16 May 2025; most provisions take effect on 1 October 2026 with full phased implementation by 2027. They authorise government monitoring of communications, pre-emptive neutralisation of attack infrastructure, and new mandatory reporting/cooperation duties on operators in 15 critical infrastructure sectors.
National Cybersecurity Office (NCO)
The NCO was established in July 2025 within the Cabinet Secretariat as the control-tower successor to NISC, led by the National Cyber Director, to coordinate public- and private-sector cybersecurity policy and operations.
Critical infrastructure (15 sectors)
Designated Specified Essential Infrastructure Service Providers across 15 sectors (information & communications, finance, aviation, airports, railways, electric power, gas, government services, medical, water, logistics, chemicals, credit cards, petroleum, ports) are subject to prior screening of critical equipment under the Economic Security Promotion Act (2022) and to incident-reporting duties to competent ministries and the NCO.
Personal-data breach notification (APPI)
Under the Act on the Protection of Personal Information, controllers must report qualifying breaches (including leaks of Special Care-Required Information, leaks suspected to be malicious, or incidents affecting 1,000+ individuals) to the Personal Information Protection Commission - a preliminary report within 3-5 days and a detailed report within 30 days (60 days where malicious intent is suspected) - and notify affected individuals. A 2026 amendment (promulgated July 2026) introduces a more risk-based individual-notification regime.
Sectoral cybersecurity rules
Sector-specific obligations layer onto the framework: the Financial Services Agency's guidelines for financial institutions, the Telecommunications Business Act (MIC) for carriers, Electricity Business Act rules (METI) for utilities, and medical-sector cybersecurity guidelines from MHLW. The Cybersecurity Strategic Headquarters' Common Cybersecurity Standards for Critical Infrastructure (31 July 2026 update) set baseline requirements across these sectors.
Timeline of decisions
- GuidanceNew five-year National Cybersecurity Strategy adopted
Japan's Cabinet adopted a new five-year cybersecurity strategy framing cyberattacks as a 'serious security threat' and committing to a state-led model coordinating police, the SDF, and the private sector to detect and respond to threats.
The Japan Times
- Decision · officialNational Cybersecurity Office (NCO) replaces NISC
Japan reorganized NISC into the National Cybersecurity Office, headed by a National Cyber Director, with enhanced staffing and elevated reporting to the prime minister, centralizing cross-government cyber policy ahead of active-defense implementation.
National Cybersecurity Office (NCO)
- LawActive Cyber Defense Law enacted
The Diet passed landmark legislation authorizing the government to monitor foreign-origin internet traffic and pre-emptively neutralize hostile cyber infrastructure abroad, a decisive shift from passive to active cyber defense, phasing in through 2026-2027.
Nippon.com
- IncidentPort of Nagoya paralyzed by LockBit ransomware
A LockBit 3.0 ransomware attack disabled the Nagoya Port Unified Terminal System, halting Japan's busiest cargo port (≈10% of national trade) for over two days and exposing critical-infrastructure OT vulnerabilities.
The Register
- Law · officialEconomic Security Promotion Act enacted
This law introduced prior government screening of critical equipment and outsourcing by designated essential-infrastructure operators (electricity, finance, telecoms, etc.), embedding supply-chain cybersecurity review into national economic security.
Japanese Law Translation (Govt of Japan)
- Guidance · officialCybersecurity Strategy 2021 adopted
The Cabinet approved Japan's third national strategy under the Basic Act, prioritizing a 'free, fair and secure cyberspace' and explicitly citing rising state-sponsored threats from China, Russia, and North Korea.
NISC / Govt of Japan
- LawBasic Act on Cybersecurity amended
Amendments expanded coordination mechanisms, creating a Cybersecurity Council to facilitate public-private information sharing among government, critical-infrastructure operators, and experts.
U.S. Library of Congress
- Law · officialBasic Act on Cybersecurity enters into force; NISC empowered
The Act took effect, establishing the Cybersecurity Strategic Headquarters and giving the renamed National center of Incident readiness and Strategy for Cybersecurity (NISC) statutory authority over national policy and government-wide defense.
Japanese Law Translation (Govt of Japan)
- LawBasic Act on Cybersecurity enacted
Japan passed its first dedicated cybersecurity law, the first among G7 nations, setting national principles, defining responsibilities of government and infrastructure operators, and mandating a national cybersecurity strategy.
U.S. Library of Congress
- Law · officialAct on Prohibition of Unauthorized Computer Access enacted
Act No. 128 of 1999 criminalized unauthorized access, obtaining/supplying others' login credentials, and related conduct, the foundational statute underpinning Japan's anti-hacking enforcement and access-control obligations.
Japanese Law Translation (Govt of Japan)
Sources
- japaneselawtranslation.go.jp/en/laws/view/3677/en
- cyber.go.jp/eng/
- cyber.go.jp/eng/index.html
- cyber.go.jp/pdf/policy/kihon-s/cs_strategy2025_english.pdf
- connectontech.bakermckenzie.com/japans-new-active-cyber-defense-law-impact-on-businesses/
- practiceguides.chambers.com/practice-guides/cybersecurity-2026/japan
- bakermckenzie.com/en/insight/publications/2026/05/japan-appi-reform-key-changes
- morihamada.com/en/insights/newsletters/138006
Next for Japan: Starting a BusinessModerate
Next topicOrientation, not legal advice: verify against the primary sources linked above. Last verified 12 Oct 2026. Methodology & how to cite · State of Technology Regulation 2026