Cybercrime Law in Japan
Japan combines a dedicated unauthorized-access statute with computer-crime provisions in its Penal Code, and since 2025 has added a national “active cyber defence” framework.
Key laws
- Act on Prohibition of Unauthorized Computer Access (不正アクセス行為の禁止等に関する法律, Act No. 128 of 1999) — prohibits unauthorized access to a computer over a network, and related acts such as wrongfully obtaining, supplying, storing or soliciting another person’s identification code. An English translation is published by the Ministry of Justice as an unofficial reference.
- Penal Code (刑法, Act No. 45 of 1907) — Chapter XIX-2 (不正指令電磁的記録に関する罪, articles 168-2 and 168-3) criminalises creating, providing, obtaining or storing “electromagnetic records of unauthorized commands”, the provisions usually described as the computer-virus offences. Article 246-2 covers computer fraud (電子計算機使用詐欺, up to ten years’ imprisonment), and article 234-2 covers obstruction of business by damaging a computer or the electromagnetic records it uses, or by feeding it false information or unauthorized commands.
- Act on the Protection of Personal Information (APPI) (個人情報の保護に関する法律, Act No. 57 of 2003) — data protection, including breach reporting to the Personal Information Protection Commission.
- Act on Prevention of Damage to Critical Electronic Computers from Unauthorized Acts (重要電子計算機に対する不正な行為による被害の防止に関する法律, Act No. 42 of 2025, promulgated 23 May 2025, principal provisions in force from 1 April 2026) — the statute underpinning Japan’s “active cyber defence” (能動的サイバー防御) policy, covering information sharing with critical infrastructure operators, use of communications information, and access and neutralisation measures.
Japan is a party to the Budapest Convention on Cybercrime (ETS 185), which it ratified on 3 July 2012 and which entered into force for Japan on 1 November 2012.
Enforcement
The National Police Agency and the prefectural police investigate cybercrime, and the Personal Information Protection Commission supervises the APPI. National cybersecurity policy is coordinated from the Cabinet Secretariat, whose structure was reorganised as part of the 2025 active cyber defence legislation.
Plain-language overview, not legal advice. Laws change — read the current statutes linked above and consult a qualified lawyer for any specific question. The English translations linked here are official reference translations, not the authoritative text.
Sources verified 9 August 2026 against e-Gov Hōrei Kensaku (laws.e-gov.go.jp) and Japanese Law Translation.