New Regulations on Cyber Harm Prevention Notifications to National Police Agency

The National Public Safety Commission promulgated on September 25 the rules regarding notifications to administrators, etc., based on the provisions of Article 6-2, Paragraph 8 of the Police Duties Execution Act (Act No. 136 of 1948), as National Public Safety Commission Rule No. 19. Based on Article 6-2, Paragraph 8 of the same Act and Article 13, Paragraph 1 of the Order for Enforcement of the Police Act (Cabinet Order No. 151 of 1954), these rules establish the matters to be notified to administrators when cyber-harm prevention measures are taken, as well as the reporting procedures to the Commissioner General of the National Police Agency. The promulgation was issued in the name of Yasuhiro Nashi, Chairperson of the National Public Safety Commission, and will come into effect on October 1, 2026.

Framework to be applied from October 1 in conjunction with the enforcement of the Adjustment Act

Article 6-2 of the Police Duties Execution Act, which serves as the basis for these rules, is a provision adjusted by the Act on Adjustment of Related Laws, etc., accompanying the enforcement of the Act on Prevention of Damage Caused by Unlawful Acts against Important Computers (Act No. 42 of 2025) (Act No. 43 of 2025). The supplementary provisions stipulate that these rules shall come into effect on October 1, 2026, the date of enforcement of the said Adjustment Act.

Article 1 defines five terms—Cyber-Harm Prevention Measure Execution Officer, Cyber-Harm Prevention Measure, Harm-Related Computer, Request for Approval, and Recommendation—all in accordance with the respective paragraphs of Article 6-2 of the Police Duties Execution Act.

Matters to be notified to administrators and notification methods via email

Article 2 stipulates that notifications under Article 6-2, Paragraph 8 of the same Act shall be conducted by sending electronic mail (electronic mail as defined in Article 2, Item 1 of the Act on Regulation of Transmission of Specified Electronic Mail (Act No. 26 of 2002)) or by other methods. The four matters to be notified are as follows:

• The date on which the relevant cyber-harm prevention measure was taken
• The IP address (as defined in Article 164, Paragraph 2, Item 3 of the Telecommunications Business Act (Act No. 86 of 1984)) or other identifying information used to identify the relevant harm-related computer
• An outline of the relevant cyber-harm prevention measure
• The organization to which the Cyber-Harm Prevention Measure Execution Officer who took the measure belongs

Reports to the Commissioner General by the Director of the Kanto Regional Police Bureau and the Chief of Police Headquarters

Article 3 stipulates that when the Director of the Kanto Regional Police Bureau deems it necessary to take cyber-hazard prevention measures, they must promptly report that fact to the Commissioner General of the National Police Agency (the Commissioner General). When an enforcement officer, who is a police officer of the Kanto Regional Police Bureau, initiates or terminates measures, requests consultation or approval pursuant to Article 6-2, Paragraph 3 of the same law, or provides notification pursuant to Paragraph 8 or Paragraph 9, they must report to the Commissioner General in advance through the Director and act under their command.

Article 4 establishes similar reporting obligations for the Police Chief, referring to the Superintendent General of the Metropolitan Police Department or the Chief of a prefectural police headquarters, and provides for reading-substitution provisions regarding enforcement officers of prefectural police. The Police Chief must also promptly report to the Commissioner General upon receiving a recommendation.

Records of Measures, Agreements on Joint Processing, and Reports to the National Public Safety Commission

Article 5 mandates that enforcement officers record the status of cyber-hazard prevention measures in writing or on an electromagnetic recording medium. Article 6 stipulates that when relevant prefectural police conduct joint processing based on Article 61-2, Paragraph 1 of the Police Law (Law No. 162 of 1954), the relevant Police Chiefs must conclude an agreement including the target prefectural police, the case, matters to be observed by the police officers in command, and the designation of said officers.

Article 7 provides that the Commissioner General shall report to the National Public Safety Commission at least once per fiscal year on the number and summaries of requests for approval, approvals, and Paragraph 9 notifications, as well as the number and summaries of recommendations, and shall report promptly upon receiving a recommendation. This provision is applied mutatis mutandis to the Police Chief’s reporting to the Prefectural Public Safety Commission.

For telecommunications carriers and network administrators, the minimum unit of notification consists of four items: the date of the measure, the IP address of the target computer, a summary of the measure, and the implementing agency. On the police side, a system in which both the Kanto Regional Police Bureau and prefectural police operate under the command of the Commissioner General prior to the initiation/termination of measures or the issuance of notifications will begin operation on October 1st.

Source: National Public Safety Commission Rule No. 19, “Rules Concerning Notification to Administrators, etc., Based on the Provisions of Article 6-2, Paragraph 8 of the Police Officers’ Duties Execution Act,” promulgated September 25, 2026, Yasuhiro Nashi, Chairperson of the National Public Safety Commission. Legal basis: Article 6-2, Paragraph 8 of the Police Officers’ Duties Execution Act (Law No. 136 of 1948), Article 13, Paragraph 1 of the Order for Enforcement of the Police Act (Cabinet Order No. 151 of 1954); effective date: the date of enforcement of Law No. 43 of 2025 (October 1, 2026).