Japan's Personal Information Protection Commission has published draft changes to its core security guidance for public comment. The draft adds a numbered duty to detect unauthorised access and a longer list of example controls, from multi-factor login to zero-trust-style access checks. Comments run from 29 October to 27 November 2026.
What the draft adds
The draft would add "detection of unauthorised access" as a fifth required technical safeguard, after access control, user authentication, protection against external intrusion and prevention of leaks through information systems. Businesses would have to put measures in place in normal times to catch intrusions early and keep damage from spreading across the internal network.
The examples under that duty include keeping access and authentication logs for a period, deploying intrusion detection and prevention systems and endpoint detection and response tools, and isolating compromised systems or disabling accounts.
Elsewhere, the draft's examples include:
- a general ban on reusing the same user ID and password across accounts;
- multi-factor authentication, including phishing-resistant forms, for access from outside networks, administrator access and access to important personal data;
- fingerprint, vein and face authentication;
- limits on who holds privileged accounts and on the devices and situations in which they are used;
- access rights updated when staff move or leave;
- access only from devices the organisation has approved and that meet its security standards;
- encryption erasure for personal data held on cloud servers.
The commission says it limited multi-factor authentication to those three situations because the extra login steps cost users convenience and cost administrators money. It also says it is not asking every business to adopt a zero-trust model.
Requirement or example?
The guidance separates "measures that must be taken", where failure can be judged a legal violation, from "examples of methods", which are not exhaustive and need not all be adopted. The commission says it uses the required-measure headings when deciding whether to use its supervisory powers.
Its overview describes the update as additions of examples that create no new rules. Yet the explanatory paper says the new detection item is added as a required measure, which the commission judged not excessive. That makes the detection item the part of the draft most worth reading closely.
For smaller businesses (100 employees or fewer, with exceptions), the draft adds a log-retention example.
A faster timetable
The commission's earlier schedule had public comment around December 2026, a decision around February 2027 and entry into force in April 2027. It now says it will bring forward entry into force as far as it can, citing recent cases in which widely used operators handling large volumes of personal information suffered external intrusions and actual or possible leaks.
The draft notice puts the effective date in 2027 but leaves the month and day blank. The commission also says the final content may change from the draft, and it accepts comments in Japanese only.
The same changes are proposed for the My Number guidelines for business operators and for government agencies, with some items varying between them.