Data, privacy and AI rules

Due in 60 days12Regulations190

12 due in 60 days · 190 regulations

Japan Active Cyber Defense Act

Enacted Japan · In force Oct 1, 2026 · next deadline Nov 22, 2027 (in 13 months)

Official text
Add to calendar
Apple Calendar or OutlookGoogle Calendar Download .ics

Deadlines

Coming up
Takes effectTentativeNov 22, 2027 · in 13 months · Source
Communications data measures in force (latest date)Chapters 3 to 7 on agreements with operators and collection of communications data take effect by Cabinet Order within 2 years and 6 months of promulgation. e-Gov lists 22 Nov 2027 as the outer limit, not a fixed date.
Already passed
ComplianceOct 1 · 26 days ago · Source
Registration and incident reporting duties startMain provisions take effect, including Chapter 2 duties for special social infrastructure operators to register important computers and report specified intrusion incidents.
Takes effectApr 1 · 7 months ago · Source
Supervisory Commission provisions in forceProvisions setting up the Cyber Communications Information Supervisory Commission take effect, per the e-Gov revision history.
MilestoneMay 23, 2025 · 17 months ago · Source
Act promulgatedAct No. 42 of 2025 promulgated; preparatory supplementary provisions apply from this day.

Summaries for reference, not legal advice. Check the official text.

What it does

Japan's active cyber defense law. Designated critical infrastructure operators must register the important computers they bring in (product and maker) with their sector minister and report cyber intrusions and precursor events to that minister and the Prime Minister. The Act also lets the government collect and analyse communications data on foreign cyber attacks under oversight by a new Cyber Communications Information Supervisory Commission.

Who it applies to
Special social infrastructure operators, meaning designated critical infrastructure operators under the Economic Security Promotion Act that use specified important computers, plus telecom carriers asked to cooperate with communications data measures.
Penalties
Fine of up to JPY 2 million for breaching a ministerial order to register or report (art. 83). Fine of up to JPY 300,000 for failing to give requested reports or giving false ones (art. 84). Leaks of secrets by officials carry up to 2 years in prison or JPY 1 million.
Enforced by
Prime Minister (Cabinet Office) and sector ministers; Cyber Communications Information Supervisory Commission for communications data
Official name
Act on the Prevention of Damage from Unauthorized Acts against Important Computers (Act No. 42 of 2025)
Citation
Act No. 42 of 2025 (Reiwa 7)
Topics
Cybersecurity, Breach notification
Verified 2026-09-25 laws.e-gov.go.jp
Research notes

Dates come from the e-Gov law revision history. e-Gov also lists a 2025-07-01 revision, which was not mapped to specific provisions here, so it is not listed as a deadline.

Related

In forceAustralia
Australia Cyber Security Act (ransomware reporting)Australia's first standalone cyber law: mandatory reporting of ransomware or cyber-extortion payments within 72 hours, security standards for consumer smart devices, 'limited use' protections for information shared with ASD and the National Cyber Security Coordinator, and a Cyber Incident Review Board. Ransomware payment reporting has applied since 30 May 2025.In effect since Nov 30, 2024
AmendedAustralia
Australia Privacy ActAustralia's federal privacy law (13 Australian Privacy Principles, Notifiable Data Breaches scheme). The 2024 amendment adds a statutory tort for serious invasions of privacy, tiered civil penalties and infringement notices, a mandate for a Children's Online Privacy Code, clearer security duties, and privacy-policy transparency for substantially automated decisions from 10 December 2026. It also adds criminal doxxing offences.Next: Dec 10 Children's Online Privacy Code must be registered · in 44 days
AmendedAustralia
Australia SOCI ActAustralia's critical infrastructure security law. Owners and operators of critical infrastructure assets must register ownership and operational information, and many must report cyber security incidents to the Australian Signals Directorate. Responsible entities for many asset classes must also keep a critical infrastructure risk management program. Systems of national significance face enhanced cyber security obligations, and the government has step-in and assistance powers.In effect since Jul 11, 2018
In forceChina
China Cyber Incident Reporting MeasuresRequires network operators in China to grade cybersecurity incidents using an annexed grading guide and report incidents rated relatively major or above. CII operators must report within 1 hour, central government bodies within 2 hours, and other operators to the provincial CAC within 4 hours. A full post-incident report is due within 30 days after handling ends, and ransom demands must be disclosed.In effect since Nov 1, 2025
AmendedChina
China Cybersecurity LawChina's base cybersecurity statute: multi-level protection scheme duties for network operators, localization and security review duties for critical information infrastructure (CII) operators, and content controls. The 2025 amendment, in force from 1 January 2026, adds AI governance support, ties PI processing to PIPL, allows fines on first violations and sharply raises maximum fines.In effect since Jun 1, 2017
In forceChina
China Data Export Security Assessment MeasuresSets the CAC security assessment that must be passed before certain data leaves China, including exports of important data and large-scale personal information exports. Data handlers must run a self-assessment, then apply through the provincial CAC for a national CAC review. Transfers already under way had six months to come into compliance.In effect since Sep 1, 2022
In forceChina
China Data Security LawSets up China's data classification and grading system, with heightened protection for 'important data' and 'core data'. Requires data processors to run data security management systems, risk monitoring and incident handling, and restricts giving data stored in China to foreign judicial or law-enforcement bodies without approval.In effect since Sep 1, 2021
In forceChina
China Data Security Risk Assessment MeasuresImplements the annual risk assessment duty for important data handlers under the DSL and Network Data Security Regulations. Important data handlers must assess risk every year and submit the report to their regulator within 20 working days of finishing; general data handlers are encouraged to assess at least every 3 years. Regulators can order an assessment by a certified third party after serious risks or large leaks.In effect since Aug 20, 2026
Questions about Japan Active Cyber Defense Act
What are the Japan Active Cyber Defense Act compliance deadlines?
May 23, 2025: Act promulgated. Apr 1, 2026: Supervisory Commission provisions in force. Oct 1, 2026: Registration and incident reporting duties start. Nov 22, 2027: Communications data measures in force (latest date) (tentative).
When does Japan Active Cyber Defense Act take effect?
Japan Active Cyber Defense Act took effect on Oct 1, 2026. The next milestone is Nov 22, 2027: Communications data measures in force (latest date).
Who does Japan Active Cyber Defense Act apply to?
Special social infrastructure operators, meaning designated critical infrastructure operators under the Economic Security Promotion Act that use specified important computers, plus telecom carriers asked to cooperate with communications data measures.
What are the penalties under Japan Active Cyber Defense Act?
Fine of up to JPY 2 million for breaching a ministerial order to register or report (art. 83). Fine of up to JPY 300,000 for failing to give requested reports or giving false ones (art. 84). Leaks of secrets by officials carry up to 2 years in prison or JPY 1 million.