CyberInsight Asia

East Asia

Japan

日本

Last updated:

CyberInsight Asia assessment Seed score

Risk score
~52
Country risk level
Medium
U.S. coercion and market-exclusion risk
High
Maturity
82CMM level: Level 5 Optimising · Leading
Composite risk index
0.63Broadly balanced
Quadrant
Under pressure
Last verified

Scores and risk labels are our own assessment, based on public sources as of the date shown. They are opinions, not findings or statements of fact about any government, organisation or group.

Scores start from a seeded CyberInsight assessment and move as new evidence is recorded. A dimension with no new evidence keeps its last valid contribution.

These dimensions have no evidence yet and are held unchanged: Critical-infrastructure exposure, Regulatory enforcement capability (inverse), Enterprise practice, Geopolitics and great-power risk, Historical incident severity, International cooperation, Laws and regulations, Regulatory capability, Strategy, Threat activity

automated calibration: not run · See the Methodology page for how scores are produced

Trend

A trend needs at least two monthly points; there is only one so far.

Automated coverage

Limited automated coverage

  • Automated coverage is limited: some official sources cannot currently be read, so the content below may be incomplete.
  • Last run (2026-10-12): 6 of 7 tier-1 sources readable.
  • Register areas only partly verified: telecom security

This means some official sources cannot currently be read automatically, so this page may be incomplete. It does not mean the related laws or events do not exist.

Threat landscape

Threat items are not yet attributed to this jurisdiction.

Industry focus

Industry focus will be generated once sourced material exists.

Compliance points

cybersecurity

Verification state: Verified

  • Basic Act on Cybersecurity (unofficial English translation of the name)
    Basic Act on Cybersecurity (unofficial English translation of the name) (サイバーセキュリティ基本法（平成二十六年法律第百四号）): in force, As of 2026-10-12 · Source
  • Act on Prevention of Damage from Unauthorized Acts against Critical Computers (active cyber defence law) (unofficial English translation of the name)
    Act on Prevention of Damage from Unauthorized Acts against Critical Computers (active cyber defence law) (unofficial English translation of the name) (重要電子計算機に対する不正な行為による被害の防止に関する法律（令和七年法律第四十二号）): partly in force, As of 2026-10-12 · Source

personal data

Verification state: Verified

  • Act on the Protection of Personal Information (unofficial English translation of the name)
    Act on the Protection of Personal Information (unofficial English translation of the name) (個人情報の保護に関する法律（平成十五年法律第五十七号）): in force, As of 2026-10-12 · Source

critical infrastructure

Verification state: Verified

  • Act on Prevention of Damage from Unauthorized Acts against Critical Computers (active cyber defence law) (unofficial English translation of the name)
    Act on Prevention of Damage from Unauthorized Acts against Critical Computers (active cyber defence law) (unofficial English translation of the name) (重要電子計算機に対する不正な行為による被害の防止に関する法律（令和七年法律第四十二号）): partly in force, As of 2026-10-12 · Source
  • Economic Security Promotion Act (unofficial English translation of the name)
    Economic Security Promotion Act (unofficial English translation of the name) (経済施策を一体的に講ずることによる安全保障の確保の推進に関する法律（令和四年法律第四十三号）): in force, As of 2026-10-12 · Source

cross-border data

Verification state: Verified

  • Act on the Protection of Personal Information (unofficial English translation of the name)
    Act on the Protection of Personal Information (unofficial English translation of the name) (個人情報の保護に関する法律（平成十五年法律第五十七号）): in force, As of 2026-10-12 · Source

incident reporting

Verification state: Verified

  • Act on the Protection of Personal Information (unofficial English translation of the name)
    Act on the Protection of Personal Information (unofficial English translation of the name) (個人情報の保護に関する法律（平成十五年法律第五十七号）): in force, As of 2026-10-12 · Source
  • Telecommunications Business Act (unofficial English translation of the name)
    Telecommunications Business Act (unofficial English translation of the name) (電気通信事業法（昭和五十九年法律第八十六号）): in force, As of 2026-10-12 · Source
  • Act on Prevention of Damage from Unauthorized Acts against Critical Computers (active cyber defence law) (unofficial English translation of the name)
    Act on Prevention of Damage from Unauthorized Acts against Critical Computers (active cyber defence law) (unofficial English translation of the name) (重要電子計算機に対する不正な行為による被害の防止に関する法律（令和七年法律第四十二号）): partly in force, As of 2026-10-12 · Source

telecom security

Verification state: Partly verified

  • Telecommunications Business Act (unofficial English translation of the name)
    Telecommunications Business Act (unofficial English translation of the name) (電気通信事業法（昭和五十九年法律第八十六号）): in force, As of 2026-10-12 · Source

cybercrime

Verification state: Verified

  • Act on the Prohibition of Unauthorized Computer Access (unofficial English translation of the name)
    Act on the Prohibition of Unauthorized Computer Access (unofficial English translation of the name) (不正アクセス行為の禁止等に関する法律（平成十一年法律第百二十八号）): in force, As of 2026-10-12 · Source

finance sector rules

Verification state: Verified

  • Guidelines on Cybersecurity in the Financial Sector (unofficial English translation of the name)
    Guidelines on Cybersecurity in the Financial Sector (unofficial English translation of the name) (金融分野におけるサイバーセキュリティに関するガイドライン): Guidance, As of 2026-10-12 · Source

telecom sector rules

Verification state: Verified

  • Telecommunications Business Act (unofficial English translation of the name)
    Telecommunications Business Act (unofficial English translation of the name) (電気通信事業法（昭和五十九年法律第八十六号）): in force, As of 2026-10-12 · Source

regulator

Verification state: Verified

No record can be shown from the Law Register yet.

Notes for ICT equipment suppliers

This section is based on publicly available sources only.

Suggested checks

  • cybersecurity

    Check what Basic Act on Cybersecurity (unofficial English translation of the name) requires of ICT equipment suppliers and operators.

    Source
  • critical infrastructure

    Check what Act on Prevention of Damage from Unauthorized Acts against Critical Computers (active cyber defence law) (unofficial English translation of the name) requires of ICT equipment suppliers and operators.

    Source
  • cross-border data

    Check what Act on the Protection of Personal Information (unofficial English translation of the name) requires of ICT equipment suppliers and operators.

    Source
  • incident reporting

    Check what Act on the Protection of Personal Information (unofficial English translation of the name) requires of ICT equipment suppliers and operators.

    Source
  • telecom security

    Check what Telecommunications Business Act (unofficial English translation of the name) requires of ICT equipment suppliers and operators.

    Source

Latest updates

No recent updates yet.