Japan is increasing barriers for Chinese companies by introducing security certifications for data centers and cloud services, following similar measures for power grid equipment. The government plans to recommend certified services for financial and medical institutions that handle sensitive personal information and will enhance oversight of data management.
According to the Nihon Keizai Shimbun (Nikkei) on October 20, the Japanese government intends to implement a safety certification system for data center operators and cloud service providers with servers in Japan starting in the 2027 fiscal year (beginning April 2027). The plan includes assessing operators' risk management systems and procurement sources to certify their safety. The government aims to encourage financial institutions, medical facilities, and research organizations that handle critical personal data to contract with certified providers. Nikkei analyzed that this system would effectively exclude companies influenced by China and Russia.
Additionally, the government plans to require companies storing and providing critical personal information to report their data management practices in advance. If the government determines that there is a risk of data leakage based on these reports, it could order or recommend the suspension of data storage or provision. The government will submit a bill to amend the Economic Security Promotion Law during the regular Diet session convening in January 2027, and the new certification system will be implemented in line with the law. While companies will decide whether to use certified services, those handling sensitive personal information will likely find it difficult to choose unverified services due to the required oversight.
The introduction of this system is driven by the growing use of data centers and cloud services amid security concerns. The rise of generative artificial intelligence (AI) has led to a surge in data center construction in Japan, while Chinese company Alibaba is emerging in the global cloud market alongside American giants Amazon and Microsoft. However, Nikkei noted that Japan has lacked a comprehensive system to manage data center and cloud service providers that store and process critical data. Concerns have been raised that services influenced by countries like China could lead to data breaches or service disruptions during emergencies due to cyberattacks.
Nikkei reported worries that companies established with Chinese capital may be compelled to cooperate with the Chinese government’s information collection under Chinese law. The National Intelligence Law imposes obligations to assist in state information collection activities, while the Defense Mobilization Law mandates that companies provide facilities or equipment to the state upon request during emergencies.
The Japanese government plans to reference the 'JC-STAR' certification system operated by the Information Processing Promotion Agency (IPA) under the Ministry of Economy, Trade and Industry. JC-STAR evaluates and certifies the security levels of Internet of Things (IoT) products, including network devices. Although there are no regulations excluding products from specific countries, Nikkei reported that no Chinese products have been certified to date. Starting April 2027, Japan will require solar power and energy storage systems (ESS) connected to the power grid to meet the basic Level 1 standards of JC-STAR. The certification requirements vary by level; higher levels for administrative agencies and critical infrastructure require evaluations of software components, making them more challenging to obtain, according to Nikkei.
Local governments will also face stricter standards for purchasing information technology devices. The Ministry of Internal Affairs and Communications has proposed requiring local governments to investigate and manage security risks associated with suppliers and products when making purchases. While there will be no restrictions based on the country of manufacture, local governments that struggle to manage risks independently will be encouraged to select products and services from the JC-STAR or the government's cloud security evaluation system, ISMAP. Nikkei noted that this could significantly reduce opportunities for some foreign products.
However, large-scale cyberattacks have also affected cloud services operated by Japanese companies. On October 7, a ransomware attack on SoftBank subsidiary IDC Frontier impacted 495 businesses and local governments using its services. The company stated on October 8 that some customer data would be difficult to recover without separate backups. The effectiveness of the new certification system in verifying whether providers can prevent attacks and recover from damages remains a challenge.
Meanwhile, the recent tightening of security certifications targeting Chinese companies comes amid deteriorating relations between Japan and China. Relations have significantly cooled since last year following Prime Minister Sanae Takaichi's remarks regarding Taiwan, leading to various sanctions exchanged between the two nations.
* This article has been translated by AI.
Copyright ⓒ Aju Press All rights reserved.