Japan Active Cyber Defense Act
Enacted Japan · In force Oct 1, 2026 · next deadline Oct 1, 2026 (in 5 days)
Deadlines
Summaries for reference, not legal advice. Check the official text.
What it does
Japan's active cyber defense law. Designated critical infrastructure operators must register the important computers they bring in (product and maker) with their sector minister and report cyber intrusions and precursor events to that minister and the Prime Minister. The Act also lets the government collect and analyse communications data on foreign cyber attacks under oversight by a new Cyber Communications Information Supervisory Commission.
- Who it applies to
- Special social infrastructure operators, meaning designated critical infrastructure operators under the Economic Security Promotion Act that use specified important computers, plus telecom carriers asked to cooperate with communications data measures.
- Penalties
- Fine of up to JPY 2 million for breaching a ministerial order to register or report (art. 83). Fine of up to JPY 300,000 for failing to give requested reports or giving false ones (art. 84). Leaks of secrets by officials carry up to 2 years in prison or JPY 1 million.
- Enforced by
- Prime Minister (Cabinet Office) and sector ministers; Cyber Communications Information Supervisory Commission for communications data
- Official name
- Act on the Prevention of Damage from Unauthorized Acts against Important Computers (Act No. 42 of 2025)
- Citation
- Act No. 42 of 2025 (Reiwa 7)
- Topics
- cybersecurity, breach-notification
Research notes
Dates come from the e-Gov law revision history. e-Gov also lists a 2025-07-01 revision, which was not mapped to specific provisions here, so it is not listed as a deadline.
Related
Questions about Japan Active Cyber Defense Act
- What are the Japan Active Cyber Defense Act compliance deadlines?
- May 23, 2025: Act promulgated. Apr 1, 2026: Supervisory Commission provisions in force. Oct 1, 2026: Registration and incident reporting duties start. Nov 22, 2027: Communications data measures in force (latest date) (tentative).
- When does Japan Active Cyber Defense Act take effect?
- Japan Active Cyber Defense Act takes effect on Oct 1, 2026. The next milestone is Oct 1, 2026: Registration and incident reporting duties start.
- Who does Japan Active Cyber Defense Act apply to?
- Special social infrastructure operators, meaning designated critical infrastructure operators under the Economic Security Promotion Act that use specified important computers, plus telecom carriers asked to cooperate with communications data measures.
- What are the penalties under Japan Active Cyber Defense Act?
- Fine of up to JPY 2 million for breaching a ministerial order to register or report (art. 83). Fine of up to JPY 300,000 for failing to give requested reports or giving false ones (art. 84). Leaks of secrets by officials carry up to 2 years in prison or JPY 1 million.