| Act on the Protection of Personal Information (APPI)Regulator: Personal Information Protection Commission (PPC) · 2020 amendment | In forceAmended APPI in force from 1 Apr 2022. Higher corporate fines from 12 Dec 202020. | Report breaches to the PPC: a first report promptly, ideally within 3–5 days, then a full report within 30 or 60 days. Triggers include sensitive data, possible financial harm, malicious acts such as ransomware, or more than 1,000 people. Corporate fines up to ¥100 million20. | Implication: a ransomware hit on a customer's data starts a PPC clock.
Response: privacy operations adapted to the APPI, DLP, and a runbook with PPC report templates. |
| APPI amendment 2026Act No. 56 of 2026 · from the triennial review | Enacted · phasedPassed 10 Jul 2026, promulgated 17 Jul 2026. Penalty changes from 17 Jan 2027. Main reforms by Cabinet Order, no later than 17 Jul 20281819. | Administrative surcharges for serious violations, such as improper use or unlawful third-party provision, where more than 1,000 people are affected and the firm took no reasonable care. Under-16s: consent through a legal representative. New rules for biometric data. A consent exception for statistics, including AI training data, where risk is low. Lighter notice duties for low-risk breaches18. | Implication: privacy failures now carry a money penalty, and AI training gets a clearer legal path.
Response: data mapping, consent records and AI governance ready before 2028. |
| Cross-border transfers (APPI Art. 28)Transfers to a third party outside Japan | In forceInformation duties for consent-based transfers since 1 Apr 202221. | A transfer abroad needs one of: the person's consent, after being told the country and its data protection system; a recipient bound by APPI-equivalent measures, such as a data transfer agreement; or a country on the PPC's approved list2120. India is not on that list. | Implication: access from Mumbai is a transfer to India.
Response: data stays in Tokyo; Mumbai works under an APPI-equivalent processing agreement with logged, least-privilege access. |
| Telecommunications Business Act: external transmission rulesCookie and tag rules for websites and apps | In forceFrom 16 Jun 202332. | Covered services, including messaging, SNS, online games, marketplaces, video sharing and search, must notify or publish what user data their tags send to third parties, or get consent or offer an opt-out32. | Implication: every Japanese web property needs a tag inventory.
Response: digital risk monitoring and website tag audits within managed web services. |
| Active Cyber Defense lawsAct on preventing damage from unauthorised acts against important computers, with related amendments | In force · phasedEnacted 16 May 2025, promulgated 23 May 202523. Critical-infrastructure duties and access and neutralisation measures from 1 Oct 202622. Staged through Nov 202723. | Designated critical-infrastructure operators notify the government of key systems and report specified incidents and some precursor events, such as indicators of compromise: an initial report promptly, a detailed report generally within 30 days22. | Implication: SOC providers to these operators must detect, log and hand over evidence on time.
Response: managed SOC, DFIR retainers and reporting templates in Japanese. |
| Basic Act on Cybersecurity · National Cyber OfficeNISC reorganised | In forceThe National Cyber Office (NCO) in the Cabinet Secretariat replaced NISC in Jul 20252423. | The NCO leads national cyber policy and the active cyber defence framework. Unified security standards for critical infrastructure took effect on 1 Oct 202622. | Implication: one government counterpart sets the bar for critical sectors.
Response: map services to the unified standards in each partner proposal. |
| Economic Security Promotion ActPrior screening of critical-infrastructure equipment and outsourcing | In forceScreening operates from 17 May 202425. | Designated operators in 14 sectors, including telecom, finance, credit cards, electricity, railways and aviation, notify the minister before outsourcing maintenance or management of critical facilities. Contractors disclose ownership of 5% or more, officers' nationalities and work locations. Review takes 30 days, extendable25. | Implication: XcellHost, as a foreign contractor, will appear in these filings.
Response: a ready disclosure pack, and delivery through Japanese primes where screening applies. |
| Supply-chain security star rating (SCS)METI · alongside the Cybersecurity Management Guidelines | Due by Mar 2027Planned launch by the end of FY202626. | ★3: basic defences for every supplier, self-assessed with expert confirmation. ★4: governance, supplier management, detection and incident response, assessed by a third party. ★5 is still under study. The buyer sets the level each supplier needs26. | Implication: SME suppliers will be asked for a star level.
Response: fixed-fee ★3 and ★4 readiness assessments, then patching, MFA and supplier risk services. |
| FSA Cybersecurity Guidelines for the financial sectorPlus the FISC Security Guidelines (industry standard) | In forcePublished 4 Oct 202427. FISC edition: Not re-verified. | 177 items mapped to NIST CSF, of which more than 100 are basic measures. Areas include governance, asset and vulnerability management, cloud security, detection, incident response and third-party risk, with due diligence, contracts and monitoring27. | Implication: banks and insurers assess every ICT provider against these items.
Response: a guideline-mapped evidence pack with the BFSI Cloud and TPRM. |
| Credit Card Security GuidelinesMETI-backed industry guidelines | In forceRevision announced 15 Mar 2024. EMV 3-D Secure in principle for all e-commerce merchants by end Mar 202528. | Merchants plan and adopt EMV 3-D Secure, with high-fraud merchants first28. Card data protection follows PCI DSS. | Implication: e-commerce platforms must prove card-fraud controls.
Response: PCI DSS, WAAP and bot protection. |
| Medical Care Act regulation · MHLW guideline 6.0Cybersecurity duty for hospitals and clinics | In forceDuty from 1 Apr 2023. Guideline version 6.0 finalised 31 May 202329. | Hospitals, clinics and midwifery facilities must take cybersecurity measures, with the MHLW safety guideline for medical information systems as the reference29. | Implication: providers to hospitals must meet the guideline's vendor duties.
Response: Healthcare Cloud, immutable backup and VPN hardening. |
| AI Promotion ActAct on promoting research, development and use of AI-related technologies | In forcePromulgated 4 Jun 2025, fully in force 1 Sep 2025. AI Basic Plan adopted by Cabinet on 23 Dec 20253031. | A promotion law, not a risk-rule law. It created the AI Strategy Headquarters under the Prime Minister. The Basic Plan aims to make Japan the easiest country to develop and use AI, and is revised every year31. The government's AI Guidelines for Business stay voluntary (version Not re-verified). | Implication: AI demand is adoption-led, with governance as a buyer expectation.
Response: vCAIO advisory, ISO/IEC 42001 and AI literacy cohorts. |
| ISMAP and ISMAP-LIUGovernment cloud security assessment programme | OperatingDigital Agency page updated 22 May 202616. Start dates: Not re-verified. | Cloud services are pre-assessed and listed for government procurement. ISMAP-LIU covers SaaS for low-risk work, with a smaller audit scope: governance every year, key controls on rotation16. | Implication: XcellHost is not ISMAP-listed, so it cannot be the listed cloud itself.
Response: serve the public sector as a services layer on listed clouds, through Japanese primes. |
| Government Cloud & local system standardisationDigital Agency | OperatingFive services as of Jun 2026, with Sakura Cloud certified in Mar 202615. Local migration target: end FY202517. | Government Cloud runs on AWS, Microsoft Azure, Oracle Cloud Infrastructure, Google Cloud and Sakura Cloud15. 10,013 of 34,366 local systems (29.1%) were classed as needing more time, with about five years to move17. | Implication: migration and operations work continues to about 2031.
Response: managed operations and security on AWS, Azure, Google Cloud and Oracle via SIer partners. |
| Consumption tax on cross-border electronic servicesNational Tax Agency | In forceFrom 1 Oct 201533. | For B2B services, such as business-only cloud contracts, the Japanese customer accounts for consumption tax under the reverse charge, and the foreign provider must tell it in advance. Foreign providers of B2C services register and file themselves33. The standard rate is commonly cited as 10%. | Implication: invoices from India need reverse-charge wording.
Response: B2B-only contracts in phase 1; confirm treatment with a Japanese tax adviser. |
| India–Japan tax treaty (DTAA)Fees for technical services | In forceRates listed by India's Income Tax Department34. | Dividends, interest, royalties and fees for technical services are each capped at 10% in the source country34. | Response: check per contract whether Japanese withholding applies to Mumbai-delivered services, and claim credit in India. |
| Entity, corporate tax & My NumberGK or KK · corporate tax · My Number Act | CheckCommonly cited settings. We could not re-verify them online for this edition. | A godo kaisha (GK) is quicker and cheaper to form; a kabushiki kaisha (KK) is more familiar to large buyers. The effective corporate tax rate is commonly cited at about 30%. The My Number Act adds strict handling rules for staff ID numbers. | Response: confirm with a Japanese tax adviser and a judicial scrivener before opening the entity. See pricing & tax. |