On this page
What happened in Japan
On 9 October 2026, the National Cybersecurity Strategy Headquarters of Japan's Liberal Democratic Party met to hear the government on a series of leaks of personal data from private companies through unauthorised access. Its head, a member of the House of Representatives, said cybersecurity "has entered a new phase" and that "it is now a state of emergency, a crisis" (our translation). The party published the account on 14 October.
That was a party body speaking. The National Cybersecurity Office's alert of 9 October asks businesses to act and uses no emergency wording. We read the alert and the NICT release on 14 October 2026.
In that alert, Japan's National Cybersecurity Office said it had confirmed several cases where systems of businesses holding large amounts of personal data were broken into, and data stolen, through routes such as:
- exploited weaknesses in web systems,
- intrusion through suppliers and contractors, and
- weak data management.
By 14 October, Japan's personal information regulator, its financial regulator and several other bodies had issued their own alerts or notices.
The alert does not use the word ransomware. It says attackers increasingly target the data itself, threatening to publish what they stole or selling it.
What the video shows
- JAPAN · 9 OCT 2026
- "A state of emergency"?
- A party official's words (translated), at a party meeting
- The government issued a security checklist
- Was AI behind it?
- Whether AI was misused: not clear at present
- (party report of the official briefing)
- Routes Japan's cyber office found include
- Weak web systems
- Suppliers and contractors
- Weak data management
- From 13 May 2027, India's DPDP Rules require similar safeguards, including
- Access control, where applicable
- Logs kept for at least 1 year
- Data security, such as encryption or masking
- Security terms in Data Processor contracts, where applicable
- 13 MAY 2027
- These become duties for Data Fiduciaries under India's DPDP Rules
- A drafting aid. Get legal advice for your situation.
Is AI behind it?
Not shown so far. According to the party's report of the 9 October briefing, the National Cybersecurity Office said that, at present, it is not clear whether the incidents are linked or whether AI was misused. Its written alert says attack methods, including the misuse of AI, are becoming more sophisticated.
On 13 October, Japan's National Institute of Information and Communications Technology (NICT) named one cause of the leaks: attackers take apart a company's public Android app, learn how it talks to the company's servers, then attack those servers where they have weaknesses. It added that AI may make this kind of analysis faster and spread the attacks to more systems.
On these sources, AI may be making attacks more efficient. Neither the National Cybersecurity Office alert nor the NICT release says AI caused these leaks.
Japan's checklist, and the closest Indian provision
Japan's office asked businesses to act on three areas. From 13 May 2027, India's DPDP Act and Rules require similar safeguards.
| Japan asked businesses to | From 13 May 2027, India's DPDP Act and Rules require a Data Fiduciary to |
|---|---|
| Patch web systems quickly, use multi-factor login, cut admin access to the minimum | Take appropriate measures to control access to the computer resources it and its Data Processors use, wherever applicable (no DPDP rule names patching or multi-factor login) |
| Keep logs, watch for unusual access, be ready to respond | Keep logs with monitoring and review, so unauthorised access can be detected, investigated and fixed |
| Store logs for a set period | Keep logs and personal data for at least one year, and longer where another law requires it |
| Encrypt stored data and data in transit | Use appropriate data security measures, such as encryption, obfuscation, masking or virtual tokens |
| Check suppliers' security, write security and breach-reporting terms into contracts, share only the data they need | Remain responsible for complying with the Act and Rules for processing a Data Processor does on its behalf, despite any agreement to the contrary; engage one for offering goods or services only under a valid contract; where applicable, put a security safeguards term in that contract |
| Know what data you hold, and delete it when its purpose is over | Erase personal data, and have its Data Processor erase it, when consent is withdrawn or it is reasonable to assume the purpose is no longer served, whichever is earlier, unless a law requires it to be kept |
From 13 May 2027, if a breach still happens, the Rules require the Data Fiduciary to tell each affected person and the Data Protection Board without delay, and to send the Board a detailed report within 72 hours of becoming aware, or a longer period the Board allows on a written request.
From the same date, the Board may impose a penalty if, at the end of an inquiry, it finds a person's breach of the Act or Rules significant, after giving the person a chance to be heard. The amounts are maximums: up to ₹250 crore for failing to take reasonable security safeguards, and up to ₹200 crore for failing to give notice of a personal data breach.
Our view: five checks to start with
These five steps are our own suggestions, drawn from Japan's alert and the NICT release.
- List every system and app you run online, including old ones nobody uses. Japan's office asks businesses to stop and remove what they no longer use.
- Turn on multi-factor login for every admin account and remove accounts of people who have left.
- Ask your main suppliers in writing how they would tell you about a breach, and how fast.
- Check your logs are switched on and kept, and that someone looks at them.
- If you publish a mobile app, ask your developer what the app reveals about your servers, and whether those servers have been checked for weaknesses.
Related: DPDP security safeguards: a checklist for small business · Personal data breach: what to do · Vendors and data processing agreements · Check what applies to you
Sources: Japan
Japan (official sources, for context):
- National Cybersecurity Office, Cabinet Secretariat, alert dated 9 Oct 2026: https://www.cyber.go.jp/pdf/press/taiou.pdf
- National Cybersecurity Office, round-up of agency alerts, 14 Oct 2026: https://www.cyber.go.jp/news/20261014.html
- National Institute of Information and Communications Technology (NICT), press release, 13 Oct 2026: https://www.nict.go.jp/press/2026/10/13-1.html
- Liberal Democratic Party of Japan, news page, 14 Oct 2026: https://www.jimin.jp/news/information/214364.html
Common questions
Did Japan declare a cyber emergency?
The emergency words came from the head of a Liberal Democratic Party cybersecurity panel, at a party meeting on 9 October 2026. The National Cybersecurity Office's alert of 9 October asks businesses to act and uses no emergency wording.
Did AI cause the Japan data leaks?
Not shown so far. According to the party's report of the 9 October briefing, the National Cybersecurity Office said that, at present, it is not clear whether the incidents are linked or whether AI was misused. Neither the National Cybersecurity Office alert nor the NICT release says AI caused these leaks.
Do India's DPDP Rules require the same safeguards?
From 13 May 2027, India's DPDP Act and Rules require similar safeguards. No DPDP rule names patching or multi-factor login. From 13 May 2027, if a breach still happens, the Rules require the Data Fiduciary to tell each affected person and the Data Protection Board without delay, and to send the Board a detailed report within 72 hours of becoming aware, or a longer period the Board allows on a written request.
Next steps
- Check whether the DPDP Act applies to your business, free, in a few clicks
- How-to 04: Set the rules, in the toolkit
- How-to 09b: Sign the vendor contract, in the toolkit
- How-to 11: When something goes wrong, in the toolkit
- The free duties list, every duty in plain words
Sources
The DPDP sections, rules and dates above were checked against the official text on 14 Oct 2026.
Digital Personal Data Protection Act, 2023 (No. 22 of 2023)
Official text: the Digital Personal Data Protection Act, 2023 (MeitY, PDF)
- Section 8(1)Responsible for complying with the Act and Rules for processing by a Data Processor, whatever the agreement says
- Section 8(2)A Data Processor engaged for offering goods or services to Data Principals only under a valid contract
- Section 8(5)Reasonable security safeguards to prevent personal data breach
- Section 8(6)Intimation of a personal data breach to the Board and affected Data Principals
- Section 8(7)Erasure of personal data, and by the Data Processor, when consent is withdrawn or the purpose is no longer served, unless a law requires it to be kept
- Section 33(1)Penalty only if an inquiry finds a breach of the Act or Rules significant, after a hearing
- Schedule, items 1 and 2Penalty for failing to take reasonable security safeguards may extend to two hundred and fifty crore rupees; for failing to give notice of a personal data breach, two hundred crore rupees
DPDP Rules, 2025 (G.S.R. 846(E), 13 November 2025)
- Rule 1(4)Rules 3, 5 to 16, 22 and 23 in force eighteen months from publication
- Rule 6Reasonable security safeguards: the minimum items
- Rule 7Intimation of a personal data breach: without delay to each affected Data Principal and the Board; detailed report to the Board within 72 hours, or a longer period the Board allows on a written request
- Rule 8(3)Logs and personal data kept for a minimum of one year
Notifications
Official text: commencement notification G.S.R. 843(E) (MeitY, PDF)
- G.S.R. 843(E), clause (c)Sections 8 and 33, among others, in force eighteen months from 13 November 2025
A drafting aid. Get legal advice for your situation. This article explains the published text of the Act and the Rules.
