JapanImportant Computers Act, Report of Specified Infringement Events
In force since .
A vulnerability and incident reporting rule binding private bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Reporting, Security
As of .
What it requires
- Applies to a specified social infrastructure business operator, meaning an operator designated under Article 50(1) of the Economic Security Promotion Act (Act 43 of 2022) that uses a specified important computer; reached by declaring that you operate an essential service. The Act and its ministerial order apply from .
- On becoming aware of a specified infringement event on a specified important computer, or of an event the ministerial order names as a possible cause of one, report it to the minister in charge of your business and to the Prime Minister (Article 5 of the Act).
- File a first report promptly after becoming aware of the event, stating what you know at that time, and file a full report within 30 days of the day you became aware of it (Article 4(2) of the order).
- Include in each report the matters the order lists: the report category, an outline of the operator, an outline of the event, the computer affected, technical matters, the response taken and other notes (Article 4(3) of the order).
- Events within six months of your designation, or of a computer becoming a specified important computer, are outside the duty (Article 4(2)(1) and (2) of the order).
- Comply with a ministerial order to make or correct a report by a set deadline (Article 6 of the Act).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
Article 83 punishes a person who violates an order under Article 6 with a fine of up to 2,000,000 yen; Article 86 applies the same fine to the company.
Penalty structure
Article 83 sets a fine of up to 2,000,000 yen for violating an order under Article 6.
- Rule
- Fixed only
- As of
- Currency
- JPY
- Fixed cap
- 2,000,000
Who enforces it
Enforcement body
The minister in charge of the specified social infrastructure business, who may order an operator to make or correct a report by a set deadline.
Settledness
- As of
- Open questions
- How soon after becoming aware must the first report be made, given that the ministerial order says only promptly and states no hour count?
What this law does
Article 5 of the Act requires a specified social infrastructure business operator that becomes aware of a specified infringement event on a specified important computer, or of an event the ministerial order names as a possible cause of one, to report it to the minister in charge of its business and to the Prime Minister. The ministerial order requires the operator to file a first report promptly after becoming aware of the event and a full report within 30 days of becoming aware of it.
A specified social infrastructure business operator is a designated social infrastructure business operator that uses a specified important computer. Article 6 of the Act lets the minister in charge order an operator that violates Article 5 to make the report or correct its content by a set deadline. Violating an order under Article 6 is punishable by a fine of up to 2,000,000 yen. The ministerial order, and so the Act it implements, applies from .
When LexLint raises it
When your app profile says your app runs an essential service.