Japan: incident reporting is now law, and data-protection fines are on the way

For a board, the key change in Japan is this: on 1 October 2026 cyber security stopped being mainly voluntary for the country's critical operators. 258 firms in 15 sectors must now report incidents to their minister and the Prime Minister, and police and the Self-Defense Forces may now act against attacking servers [1][2]. Data protection is moving the same way. Japan's first administrative fines for privacy breaches became law in July 2026 and will start by July 2028 [5][7]. The style has not changed, though. Regulators still mostly use guidance, public naming and follow-up reports, not large penalties.

At a glance

• Active Cyber Defence law in force: designated core-infrastructure operators must send a first report within 3–5 days of a ransomware or other attack, and a full report within 30 days [3].
• Privacy fines are coming: the 2026 amendment to the Act on the Protection of Personal Information (APPI) adds surcharges equal to the money gained from serious, large-scale misuse of data. It must take effect by 17 July 2028 [5][7].
• Breaches are frequent: the Personal Information Protection Commission (PPC) handled 17,139 breach reports from businesses in the year to March 2026, but issued only 2 recommendations and 1 order [10].
• AI law without teeth: the AI Promotion Act has no fines. Policy runs through an annual AI Basic Plan, the second of which was adopted on 14 July 2026 [14][15].
• Supply chains next: a government security rating for suppliers (★3/★4) is due to open for applications around March 2027 [20].

The rulebook now

Active Cyber Defence. The Act on Preventing Damage from Unauthorised Acts against Important Computers was enacted in May 2025. Its main provisions took effect on 1 October 2026 [1]. Designated operators (特別社会基盤事業者) must:

• report incidents on key systems, such as malware or unauthorised access: DDoS attacks as soon as possible, ransomware and other attacks within 3–5 days, and a detailed report within 30 days [3];
• notify the products in their key systems by the end of March 2027, and within four months for new systems [2].

If a firm fails to report, its minister can order it to do so. Breaking that order carries a fine of up to ¥2m, which can also be imposed on the company [4]. The same law lets the state access and "neutralise" attacking servers from 1 October 2026. An oversight commission set up in April 2026 reviews those operations [2][24].

Personal data. Under the APPI, a business must report a breach to the PPC if it affects more than 1,000 people or involves sensitive or malicious cases. The first report is due "promptly", which PPC guidance puts at roughly 3–5 days. The final report is due within 30 days, or 60 days where the breach may be malicious [9]. Today the main sanction is a corporate fine of up to ¥100m, for breaking a PPC order or for unlawfully supplying a personal-information database [6].

Financial services. The Financial Services Agency (FSA) has applied its Cybersecurity Guidelines for the Financial Sector since 4 October 2024 [16]. From 1 October 2026 financial firms report incidents on the government's shared forms for DDoS, ransomware and other attacks [17].

AI. The AI Promotion Act fully took effect on 1 September 2025 and set up an AI Strategy Headquarters chaired by the Prime Minister [14]. Businesses must cooperate with government measures. The state may analyse cases where AI caused harm and give guidance, but there are no fines [14].

The regulators and how they behave

• PPC (個人情報保護委員会): the only independent regulator here. Its posture is cooperative and slow, but it does name firms. In 2025–26 it handled 17,139 private-sector breach reports and gave guidance or advice 455 times [10]. Its one order was an emergency order to a list broker on 16 May 2025 for selling data it knew could reach fraud gangs [10]. On 19 August 2026 it gave KDDI formal guidance after attackers stole login details for 12,231,954 email users from a system KDDI ran for internet providers. 7,616,173 of the passwords had been stored in plain text. KDDI must report on its fixes by 19 October 2026 [11].
• Ministry of Internal Affairs and Communications (MIC, 総務省): regulates telecoms. In the same KDDI case it found a leak of communications secrecy and issued written guidance with a strict warning on 29 July 2026 [12].
• National Cybersecurity Office (NCO, 国家サイバー統括室): replaced the old NISC in July 2025 and runs the new reporting regime with the Cabinet Office [1][21]. Its Common Cybersecurity Standards for Critical Infrastructure also took effect on 1 October 2026 [22]. Reports from government bodies alone rose from 447 in 2024–25 to 517 in 2025–26 [21].
• FSA (金融庁): supervises through inspections, sector-wide exercises and business-improvement orders. A wave of securities-account takeovers peaked in April 2025, when brokers reported more than 5,000 unauthorised logins in a single month [19]. Its 2026 priorities target AI-driven threats, phishing-resistant login and the move to post-quantum cryptography [18].
• Ministry of Economy, Trade and Industry (METI, 経済産業省): uses guidelines and certification rather than penalties [20].

Overall the posture is cooperative: large incidents bring guidance, publicity and a deadline for a progress report, not fines. In 2025–26 that pattern covered ransomware at a major drinks maker (about 115,000 records) and a large online retailer (about 740,000 records) [21].

What's coming in the next 12 months

• Oct 2026: first incident reports under Active Cyber Defence. KDDI's report to the PPC is due by 19 Oct [11]. On 7 Oct the PPC warned large data holders and previewed tougher technical safeguards [13].
• Autumn 2026 (expected): METI's evaluation guide for the supplier rating scheme [20].
• 17 Jan 2027: tougher APPI criminal penalties take effect. The maximum prison term for unlawfully supplying databases doubles to two years. There is also a new offence of obtaining personal data by fraud or unauthorised access [6][7].
• Early 2027 (expected): PPC consultation on the Cabinet Order and rules that set the surcharge calculation and the new consent exceptions [8].
• End of Mar 2027: core-infrastructure operators must have notified the products in their key systems [2]. Supplier rating ★3/★4 applications are expected to open around this time [20].
• Apr 2027 (expected): PPC finalises its revised examples of technical security measures [13].
• Mid-2027 (expected): draft PPC guidelines for the amended APPI [8]. An annual update of the AI Basic Plan, which promises a "proactive and continuous review" of AI laws including the AI Act [15].
• Autumn 2027 (expected): the government starts using communications data to detect attacks under the Active Cyber Defence law [2].
• By 17 Jul 2028: surcharges, child-data rules and the eased breach-notice rule must be in force [7][25].

What it means for organisations

• If you are a designated operator, or supply one, check that your incident process can produce a first report within 3–5 days on the government's shared forms [3][17].
• Do not read the coming APPI surcharge as a "breach fine". It targets profitable misuse of data, such as unlawful sharing or improper collection, affecting 1,000 or more people, and not security failures as such [6]. Security failures still bring guidance and public naming, as KDDI found [11].
• Treat plain-text passwords, unpatched VPNs and weak authentication as likely findings. The PPC and MIC cited these failings in 2026 [11][12][13].
• Expect Japanese customers to ask for a ★3 or ★4 supplier rating from 2027 [20].
• For AI, follow the government's AI guideline and the annual Basic Plan rather than waiting for a statute with penalties [14][15].
• Watch phishing volumes. JPCERT/CC counted 8,313 phishing sites in April–June 2026, 89% of the incidents it logged, against only 8 ransomware reports [23].

This article is general information, not legal advice.

Sources

1. Cabinet Office, Cyber Security (Active Cyber Defence law, orders and guidance). https://www.cao.go.jp/cybersecurity/index.html
2. National Cybersecurity Office and Cabinet Office, "Implementation of the Cyber Response Capability Enhancement Act" (Sep 2026). https://www.cao.go.jp/cybersecurity/pdf/sekousetsumei.pdf
3. Cabinet Office, explanation of the incident-reporting system for core-infrastructure operators (Oct 2026), §6-2. https://www.cao.go.jp/cybersecurity/pdf/cyber_kaisetsu_202610.pdf
4. Act on Preventing Damage from Unauthorised Acts against Important Computers (Act No. 42 of 2025), Arts. 5, 6, 83, 86 (e-Gov). https://laws.e-gov.go.jp/law/507AC0000000042
5. PPC, 2026 amended APPI page. https://www.ppc.go.jp/personalinfo/legal/r8kaiseihogohou/
6. PPC Secretariat, "On the Act amending the APPI" (Jul 2026), slides 5, 17–19. https://www.ppc.go.jp/files/pdf/260717_kaiseihounitsuite.pdf
7. Act amending the APPI (promulgated 17 Jul 2026), Supplementary Provisions Art. 1. https://www.ppc.go.jp/files/pdf/260717_houritsu.pdf
8. PPC, "Future work following enactment of the amending Act" including roadmap (31 Jul 2026). https://www.ppc.go.jp/files/pdf/260731_kongonotorikumi.pdf
9. PPC, APPI Guidelines (General Rules), 3-5-3-3 and 3-5-3-4. https://www.ppc.go.jp/personalinfo/legal/guidelines_tsusoku/
10. PPC, summary of FY2025 annual report (Jul 2026). https://www.ppc.go.jp/files/pdf/080707_annual_report_gaiyou.pdf
11. PPC, administrative response to KDDI and internet providers (19 Aug 2026). https://www.ppc.go.jp/files/pdf/260819_01_houdou.pdf
12. MIC, measures on protection of communications secrecy at KDDI (29 Jul 2026). https://www.soumu.go.jp/menu_news/s-news/01kiban18_01000285.html
13. PPC, alert on responses to large-scale breaches (7 Oct 2026). https://www.ppc.go.jp/files/pdf/261007_houdou.pdf
14. Cabinet Office, AI Promotion Act page; Act text Arts. 7 and 16 (e-Gov). https://www8.cao.go.jp/cstp/ai/ai_act/ai_act.html and https://laws.e-gov.go.jp/law/507AC0000000053
15. Cabinet Office, AI Basic Plan (Cabinet decision 14 Jul 2026) and English summary. https://www8.cao.go.jp/cstp/ai/ai_plan/ai_plan.html and https://www8.cao.go.jp/cstp/ai/ai_plan/aiplan_g_eng_20260714.pdf
16. FSA, results of consultation on the Cybersecurity Guidelines for the Financial Sector (4 Oct 2024). https://www.fsa.go.jp/news/r6/sonota/20241004/20241004.html
17. FSA, amended supervisory guidelines adopting shared incident-report forms (18 Sep 2026). https://www.fsa.go.jp/news/r8/sonota/20260918/20260918.html
18. FSA, 2026 Strategic Priorities (15 Sep 2026). https://www.fsa.go.jp/news/r8/202609/260915.html
19. FSA, warning on unauthorised access and trading in online securities accounts (updated 9 Sep 2026). https://www.fsa.go.jp/ordinary/chuui/chuui_phishing.html
20. METI and NCO, Supply Chain Security evaluation scheme design policy (27 Mar 2026). https://www.meti.go.jp/press/2025/03/20260327001/20260327001.html
21. NCO, "Cybersecurity 2026" summary (31 Jul 2026). https://www.cyber.go.jp/pdf/policy/kihon-s/cs2026_abstract.pdf
22. NCO, English site (Cybersecurity Strategy, Dec 2025; Common Cybersecurity Standards for Critical Infrastructure, 1 Oct 2026). https://www.cyber.go.jp/eng/index.html
23. JPCERT/CC, Quarterly Report Apr–Jun 2026, tables 1.1–1.2. https://www.jpcert.or.jp/qr/2026/QR_FY2026-Q1.pdf
24. Nippon.com (Jiji), "Japan Launches Active Cyberdefense Program" (30 Sep 2026). https://www.nippon.com/en/news/yjj2026093001094/
25. A&O Shearman, "Amendments to the APPI promulgated" (2026). https://www.aoshearman.com/en/insights/ao-shearman-on-data/amendments-to-the-act-on-the-protection-of-personal-information-promulgated