Personal Information Protection Commission Seeks Comment on Security-Measure Guideline Revisions: Password Reuse, Multi-Factor Authentication and Log Retention Added as Examples (29 October 2026)

On 29 October 2026 the Secretariat of Japan's Personal Information Protection Commission (PPC) opened public comment on draft notices partially amending the Guidelines for the Act on the Protection of Personal Information (General Rules) and related guidelines.

This page sets out the content of the case page on e-Gov Public Comment, the guidelines for submitting comments, the draft notice (with a comparison of old and new text), and the PPC Secretariat's outline of the additions to the examples of security-control methods (October 2026).

Article 23 of the APPI provides that a business handling personal information must take necessary and appropriate measures to manage the security of the personal data it handles, including preventing its leakage, loss or damage. Article 24 requires the business to supervise employees who handle personal data in a necessary and appropriate manner.

Part 10 (Annex) of the General Rules guidelines, "Security-control measures to be taken", sets out these measures in organisational, human, physical and technical categories. The PPC outline distinguishes two kinds of text in the Annex:

• "Measures that must be taken": obligations; failing to follow them may be judged a breach of the Act
• "Examples of methods": examples, not obligations. The specific method should be necessary and appropriate in light of the risk, taking into account the harm to individuals, the size and nature of the business, how the personal data is handled and the media on which it is recorded

The outline states that the present revisions add examples of methods and do not create new rules.

According to the outline, the direction of the review was set out at the 369th meeting of the PPC on 16 September 2026. It cites the growing sophistication of cyber attacks as a major cause of data leaks and identifies four issues:

1. Responding to more varied forms of handling (spread of cloud services, more capable devices)
2. Introducing a zero-trust model (trust nothing inside or outside the organisation and verify everything)
3. Measures against lateral movement (limiting damage after an intrusion, for example by intrusion-type ransomware)
4. Clarifying the text (organising how "measures that must be taken" relate to "examples of methods")

As of 16 September the plan was to start public comment around December 2026 and bring the changes into force in April 2027. The outline explains that, in light of cases in which businesses handling large volumes of personal information suffered unauthorised external access leading to actual or possible leaks of large amounts of personal data, entry into force will be brought forward as far as possible.

• Setting up a responsible department and clarifying roles added as an example under organisational structure
• The items "operation in line with the rules on handling personal data" and "means of checking how personal data is handled" merged into one
• Clarifying the rules on handling personal data and informing employees, and checking actual handling against those rules, added
• Regularly evaluating and reviewing the security measures taken, in light of how data is handled and advances in information technology, and improving them where necessary, added

• Evaluating, reviewing and improving the content and delivery of regular employee training added

• The subject of identification and authentication changed to "persons using information systems that handle personal data" (the outline describes this as a clarification)
• Fingerprint, vein and face authentication added as authentication methods
• Where user IDs and passwords are used: a general prohibition on reusing the same user ID and password, limits on reusing similar passwords, a minimum password length, and suspension of IDs after a set number of failed log-ins
• Multi-factor authentication (including phishing-resistant forms) for access from outside the organisation's network, access with administrator privileges, and access to important personal data
• A mechanism that evaluates dynamic context for each access request, such as the location, time and security status of the device, and decides whether to allow access according to the risk
• Allowing access to personal data only from devices approved by the organisation that meet its security standards
• Keeping to a minimum the employees given privileged accounts and the devices and situations in which those accounts are used
• Changing access rights appropriately when the organisation changes, for example on transfers or departures of employees
• Using methods that make data hard to recover, such as cryptographic erasure, when deleting personal data or disposing of equipment

The draft adds an item "(5) Detection of unauthorised access, etc." to the technical measures. It refers to keeping logs, such as authentication, access, operation and communication logs, for a set period; protecting those logs from leakage, tampering and unauthorised deletion; analysing them regularly to detect unauthorised access or signs of it early; introducing mechanisms for early detection (for example IDS/IPS and EDR); and taking the measures needed so that damage to information systems does not spread even if unauthorised access occurs.

The "examples of methods" currently in the Q&A on the APPI Guidelines are to be consolidated into the Annexes of the guidelines themselves. The My Number Guidelines for businesses will add that, where copies are made of documents submitted by employees in the course of preparing withholding tax slips and similar documents, it is important to set out clearly how those copies are disposed of or deleted.

According to the guidelines for submission, comments may be submitted by one of the following:

• The comment form on the e-Gov page for this case
• Post (must arrive by the deadline; mark the envelope as a comment on the draft guideline revisions)
• Email (with the specified subject line)

Comments by telephone are not accepted, and comments must be written in Japanese. Comments must relate to the revisions set out in the drafts. The final text may differ from the drafts.

• e-Gov Public Comment, case no. 240000133 (with PDFs of the submission guidelines, draft notices, outlines and updated drafts; Japanese): https://public-comment.e-gov.go.jp/servlet/Public?CLASSNAME=PCMMSTDETAIL&id=240000133&Mode=0
• e-Gov, Act on the Protection of Personal Information (Act No. 57 of 2003): https://laws.e-gov.go.jp/law/415AC0000000057

This page is compiled from material published by government agencies and from statutory text. Please consult a lawyer where a decision is needed on a specific matter.