SAKURA Law Office | Legal Update by Managing Partner Kenshiro Michishita
October 8, 2026
SAKURA Law Office | Managing Partner Kenshiro Michishita
The ability to protect sensitive technology and information has become a condition of access to certain public-sector projects and strategic collaborations, not merely a defensive matter for information-security teams. Japan's Act on the Protection and Utilization of Critical Economic Security Information (Act No. 27 of 2024), generally referred to as the economic security clearance legislation, took effect on 16 May 2025. It creates a statutory mechanism under which government authorities designate particularly sensitive economic-security information, make that information available to certain businesses where necessary, and restrict the persons permitted to handle it. For a Japanese or international technology, infrastructure or industrial group, the central question is how participation in a sensitive project can be reconciled with shareholder structures, research collaborations, personnel privacy, data architecture and contractual responsibilities.
The regime must be understood on its own terms. It is not a general security certificate obtainable by any corporation, nor does a personal clearance amount to a universal professional credential. The competent government authority first determines whether disclosure of specified information to a particular business is necessary for a national-security-related activity. It then considers recognition of that business as an eligible contractor, taking account of the required protective arrangements, and conducts the prescribed individual assessments for persons expected to handle the information. Classification, organizational recognition, personal suitability and contractual authorization are separate legal steps. A private company cannot create the same legal status by labelling confidential material as 'security-cleared' or by adopting foreign-government terminology in an NDA.
The regulatory framework is now operational rather than hypothetical. The Cabinet Office published detailed implementation standards and separate guidelines for administrative authorities and prospective eligible contractors in 2025. The first annual parliamentary report, released on 26 June 2026 and covering 16 May to 31 December 2025, recorded 20 designations by nine government bodies and 18 completed personnel assessments at two bodies, while reporting no eligible-contractor recognitions during that reporting period. Those figures should not be represented as the position on the date of this article. They nonetheless show both the importance of the government's information-designation function and the need to distinguish the existence of a legal framework from the practical timing of a commercial project's access to classified material.
For boards, General Counsel, compliance officers, foreign investors, defence-adjacent suppliers and research partnerships, the challenge is therefore one of transaction design. A business must be capable of demonstrating why it needs access, how its ownership and governance will be assessed, how the relevant persons will consent to and undergo official assessments, what happens when executives or shareholders change, and how materials will be segregated, accessed, returned or destroyed. The following analysis follows that decision-making process from legal scope and need-to-know, through corporate and personnel assessment, into contract drafting, cross-border investment, incident response and continuing oversight.
Executive Summary
Japan's economic security clearance framework is in force, but its protection obligations apply to specifically designated 'critical economic security information', not automatically to all confidential know-how or commercially sensitive information. The designation decision is made by the competent administrative authority under statutory criteria that concern protected economic foundations, non-public character and the particular need for secrecy in order to safeguard national security. The statutory system sits alongside, rather than replacing, trade-secret, export-control, personal-data, cybersecurity and other rules. This distinction matters at the threshold: an overseas investor's data room, a manufacturer's drawings and a university's research results are not made designated information solely because they are commercially valuable or security-sensitive.
A corporate recognition is not a self-service certification. Under Article 10 and the Cabinet Office eligible-contractor guidelines, the authority's determination that the business needs the information for an activity supporting national security precedes the recognition assessment. The contractor must establish protective governance, trained officers and personnel, appropriate premises and systems, and internal rules and contract-based obligations. The standards expressly examine possible foreign ownership, control or influence, but the disclosure factors used in that examination should not be misreported as a blanket statutory prohibition on all foreign shareholding. Recognition and the continued ability to handle the information are tied to the designated project and its governance arrangements.
Personnel assessments are a separate official process. Employees cannot simply apply to become 'cleared'; the relevant authority assesses those selected for expected classified-information duties, normally using an investigation undertaken centrally by the Cabinet Office. Personal consent is required, and refusal of consent and complaints must not be met with prohibited adverse treatment. The assessment is not a test of an employee's general aptitude or character. Corporate HR and legal functions must not turn it into indiscriminate background checking, acquire personal investigation materials outside authorized channels, or allow assessment-related data to become part of routine promotion, hiring or disciplinary decisions.
A government contract and a company's internal protection regulations translate the status into day-to-day duties. Segregated premises, named protection and operational managers, access registers, restrictions on portable devices, training, incident reporting and return or destruction requirements form an operational chain; clearance of an employee alone does not create unrestricted access. Share acquisitions, changes in directors and ownership, new foreign partnerships, outsourcing, changes in premises and transfers of assets may trigger re-examination or notification obligations. Buyers and financing parties should therefore identify government-dependent information-handling arrangements early in due diligence and draft change-of-control and closing provisions with the supervising agency in mind.
The policy case is real but cannot be used to overstate the law. The regime can facilitate responsible sharing of particular public-sector economic-security information with industry, especially in relation to critical infrastructure, cyber threats and supply-chain vulnerabilities. It does not provide an automatic entitlement to procure government contracts or receive overseas classified information, nor is it an export licence. The durable compliance solution is a traceable system of designation and access scope, official recognition, consent-based assessment, physical and digital controls, contractual risk allocation and continuing supervision, with the board able to explain why each control exists.
1. A targeted national-security information regime, not an extension of every NDA
The Act was enacted on 10 May 2024, promulgated on 17 May 2024 and implemented principally on 16 May 2025. Its stated purpose is to protect and enable appropriate utilization of information concerning essential economic foundations where unauthorized disclosure would endanger the security of Japan and its citizens. The focus includes critical infrastructure, the supply chains of important goods and information about cyber threats, countermeasures or structural vulnerabilities. Article 3 entrusts the designation decision to the relevant head of an administrative authority. Under the implementation standards, information must meet three cumulative features: it must fall within the statutory category of critical-economic-foundation protection information relevant to the authority's functions; it must not be publicly known; and it must be particularly necessary to keep it secret because its leakage may adversely affect national security. The government's power to designate is thus delimited both by subject matter and by necessity.
This matters because a commercial secrecy label is not sufficient. Intellectual property owned by a private company, pricing negotiations, ordinary employee information or results of confidential joint development remain protected by the laws and contracts applicable to them, but do not enter this statutory classification regime merely because a party believes the information is strategic. Equally, designation should not be confused with the specially designated secrets regime established by the Act on the Protection of Specially Designated Secrets; official guidance addresses the division between the systems. The Act's own classification period is generally limited to five years for an individual designation, subject to extension and a principle that the total period does not exceed thirty years. A request for classified material should therefore begin with confirmation of the competent authority, the actual designated information, the authorised purpose and the applicable handling period.
The statute contemplates carefully controlled sharing as well as secrecy. An agency may provide the information to other authorities when required for their functions and, under Article 10, may disclose it to a business conducting activities that contribute to national security where the information is needed and the enterprise meets the applicable standards. The Act also contains a route for information originating from a contractor's own research or other activities to be handled in the prescribed framework. Government sharing is subject to legal authority and protective conditions; it is not a transfer of ownership or a general licence to circulate the information within a corporate group. A private NDA may supplement the controls, but cannot enlarge the class of statutory recipients.
The first operational report illustrates the discipline required in using official statistics. The government's June 2026 parliamentary submission reported twenty designations in calendar 2025, of which one had been de-designated by year-end; consequently nineteen remained designated on 31 December 2025. It also reported forty-three relevant administrative documents held by eight government bodies, eighteen completed assessments at two bodies, and no recognised eligible contractors during the specified May–December 2025 period. The absence of recognitions in that historical reporting period does not establish that none existed by October 2026, and these figures should never be used as a substitute for project-specific consultation with the relevant agency. What they do establish is that corporate readiness and official recognition are different from the immediate availability of a government information-sharing channel.
The initial legal assessment should accordingly produce an information-and-authority map. It should identify precisely what information is designated, by which agency, for which activity, which entity in the group will handle it, whether consultants or subcontractors are involved, and whether any existing contract purports to require disclosure to persons who have no statutory authority to access it. This map sets the boundaries for legal advice on corporate eligibility, employee assessments and contract performance. It also protects the business from the opposite error: imposing intrusive 'security clearance' requirements on an ordinary collaboration that does not involve designated information.
2. Corporate recognition begins with need-to-know, not with an open application
The most important commercial misconception is that a company can apply in the abstract for a government security clearance and use it as a badge of trustworthiness. The Cabinet Office's May 2025 guidelines for eligible contractors explain the opposite. The recognition process is triggered by a competent administrative authority's determination that the relevant business needs access to specified designated information for activities contributing to Japan's national security. Only after that determination and coordination with the business does the authority review an application and assess whether the organization satisfies the government-prescribed protective requirements. The guidelines expressly invoke the need-to-know principle. A company that does not have a substantiated information need is not entitled to recognition merely because it has adopted impressive security facilities or seeks a competitive advantage in public procurement.
Once an actual government information-sharing need exists, the proposed contractor's internal architecture becomes legally relevant. Article 10, the implementing Cabinet Order and the unified operational standards require the ability to protect the information through internal rules, accountable managers, training, suitable locations and facilities and enforceable arrangements with the authority. The sample government contract includes a protection officer responsible for overall oversight and operational managers responsible for designated handling areas. The guidelines address the adequacy of facilities and containers, restrictions on entry, portable communications devices and electronic systems, and the records required for receipt, use, reproduction, transmission, transportation, return and disposal. These are connected controls. An encrypted document repository is not enough if management cannot identify authorized users, enforce location restrictions or reconstruct who accessed a document and when.
The eligibility assessment also examines ownership and influence. The official guidance considers whether, in light of shareholding and board composition, the enterprise's decision-making is free from foreign ownership, control or influence that would jeopardize the applicable information protection standard. The application materials require disclosures concerning persons directly holding more than 5% of voting rights, directors and certain related information, and the proportion of revenue associated with foreign transactions. These are information-gathering and risk-assessment elements, not a simple rule that every non-Japanese shareholder or every company with foreign sales is automatically ineligible. The authority makes an overall assessment under the operative standard. An enterprise should not promise lenders or an acquirer that a particular percentage of local ownership alone guarantees recognition, or that a blanket exclusion of foreign nationals necessarily resolves all concerns.
A prospective contractor should nevertheless prepare before an agency approaches it. It can identify ownership chains and beneficial interests, adopt a governance structure with defined protection responsibility, map personnel needing access, plan appropriate segregated facilities, draft internal handling regulations, and prepare a training programme and incident protocol. Those preparatory acts improve readiness but do not confer statutory status. The more fundamental commercial planning decision is whether a project genuinely depends on access to designated governmental information or can be scoped to unclassified outputs and interfaces. Proper scoping may avoid expensive and intrusive controls where government disclosure is not required, while preserving an escalation pathway if classified material later becomes necessary.
Once recognition is granted, its continuing conditions should be treated as a monitored contractual commitment. The sample agreement requires advance examination of changes to application information in specified circumstances, with exceptions where prior review is impracticable or a change is accepted as minor. The guidelines contemplate information about changes in the direct holders of more than 5% of voting rights, directors, the proportion of overseas-related revenue, managers, protected premises, internal rules and training. Accordingly, governance should be embedded in corporate-secretarial and transaction processes; a security department cannot be expected to discover a refinancing, reorganisation or acquisition after the company's legal department has completed it.
3. Personnel suitability, consent and privacy: what an employer may and may not do
Recognition of the organization does not confer clearance upon every employee. Article 12 establishes a separate suitability assessment conducted by the head of the relevant administrative authority in relation to persons expected to handle the designated information. The investigation on which the assessment is ordinarily based is administered centrally under the Cabinet Office/Prime Minister framework. Under Article 11, the ten-year period is measured from notification of the outcome to the assessed individual under Article 13(1), not simply from the internal date of assessment. Article 12(7)–(8) provides specific rules concerning reliance on qualifying assessments by other authorities, and reassessment can also be required if relevant circumstances change. Personnel who have undergone qualifying assessments under the specially designated secrets system may benefit from the statutory interface between the regimes, but the resulting scope of actual access remains tied to the relevant official function and need-to-know.
The assessment is purpose-limited. The Cabinet Office's official Q&A stresses that it is not a test of general character or professional capability, and that an individual cannot seek it on personal initiative absent a genuine prospective assignment involving designated information. The statutory inquiry may encompass links to activities harmful to essential economic foundations, criminal and disciplinary history, misconduct in information handling, drug use, drinking habits, financial circumstances and other prescribed matters. The framework also deals with limited information on family members and cohabitants for the purpose of detecting exposure to foreign intelligence pressure. These are sensitive categories of information; the existence of a national-security purpose does not entitle a private employer to conduct its own unrestricted investigation into an employee's medical, financial or family circumstances.
Consent and employment protection must be designed into the workflow from the outset. The employee's consent is required before the official suitability assessment, and the Cabinet Office Q&A states that an employee need not give consent if unwilling. The authority or eligible contractor must not demand the reason for refusal or subject the employee to prohibited disadvantage merely because of refusal. The sample government agreement similarly restricts use of assessment-related information beyond information-protection purposes and addresses complaints, disclosure limits and retention periods. Corporate policy should make a genuine separation between choosing staff for a project role, the employee's free decision whether to undergo an official assessment, and managing business continuity when access cannot be assigned to that individual. No assurance of employee 'clearance' should be made in an employment offer before the competent authority completes the required process.
An enterprise has a legitimate need to know which individuals have been officially approved to perform handling duties, but this is different from being entitled to the full investigation file. The government guidance envisages controlled candidate lists and notification of permitted outcomes rather than broad circulation of questionnaires, inquiry details or underlying personal data to line managers. The organization should restrict access to assessment administration, segregate any employer-held information, observe specific retention requirements in the applicable agreement, maintain complaint channels and train HR and line management against discriminatory inferences. Particular care is needed when employment status changes, the employee transfers to another affiliate, outsourced staff are involved, or an individual withdraws consent during the process.
For cross-border groups, the personnel architecture is often more difficult than the legal principle. A central foreign HR system may aggregate sensitive employee data, a regional manager may request the reasons for an unsuccessful assessment, or a foreign parent may want a clearance list for global staffing. Those requests should not be treated as routine intercompany administration. The legal team should test each proposed disclosure against the statutory purpose limits, the guidance, Japan's personal-information legislation and any applicable overseas data rules. It may be possible to communicate the operational fact that a person is or is not authorized for a particular role without providing investigative detail. The governance objective is to protect both the classified information and the employee whose privacy is exposed by the assessment process.
4. From recognition to daily operations: why government-contract drafting is a control function
The official Cabinet Office sample agreement should be read as an operational document, not merely a confidentiality undertaking. It identifies duties of the contractor, protection and operational officers, personnel education, change notifications, candidate and assessed-person registers, safeguards for assessment-related personal information, restrictions on access, storage and movement of designated materials, inspection rights, incident procedures, return and destruction and consequences of breach. Companies accustomed to a two-page NDA may underestimate the resources required. Once the agreement applies, the business must make its access and protection procedures provable to the contracting authority. These arrangements cannot be satisfied by saying that the group already complies with general ISO-style information-security standards, although those standards may supply useful control infrastructure.
The commercial contract and internal regulations must match. A template confidentiality clause giving all 'affiliates, advisers and contractors' a right to receive information on a need-to-know basis is potentially far too wide where the statutory framework separately restricts authorized recipients and approved handling locations. A supplier subcontract, outsourcing agreement or cloud-processing arrangement cannot assume that ordinary contractual consent permits re-disclosure or data replication outside protected systems. Any subcontractor or technical service provider involvement should be evaluated against the government arrangement, the recognition requirements, personnel authorization and the prohibited modes of storing or transferring the information. Where permission has not been established, the safer design may be to segregate unclassified interface information for external service providers and retain designated information within the approved environment.
Practical implementation should therefore start from an information lifecycle. At intake, the organization records the origin, designation, responsible agency and authorized purpose of the material. Access is granted only to personnel who both satisfy the relevant suitability requirement and have a current operational need. The system logs receipt, viewing, reproduction, communication and transfer in the manner required by the regulations and agreement. Protection staff review changes in staff lists and technical environments, confirm that training occurs at the required interval, and verify that records remain sufficient to permit audits. Return, destruction and disposition after de-designation or contract expiry are separately controlled; an automatic backup or routine cloud retention rule may be inconsistent with a mandatory destruction or transfer procedure.
Incident response must also be pre-authorized. The official contractor guidelines and sample agreement address prompt escalation when loss, leakage or suspected incidents occur, and the roles of responsible managers and the government authority. A cyber incident plan for ordinary personal information may permit the company to employ external forensic investigators or upload logs to a global security platform. In the classified-information setting, the first question is whether those responders are authorized to access the specific material. The company should pre-agree an escalation channel and technical containment plan that preserve evidence while respecting classification boundaries. Private-sector investigations, litigation discovery, insurance reporting and public disclosures may require sanitized factual descriptions rather than the indiscriminate movement of designated documents.
The Act also creates significant criminal exposure for unlawful disclosure of designated information: the official government summary describes imprisonment for up to five years or a fine of up to JPY 5 million, or both, for specified unauthorized disclosure. Particular elements and any penalties for other conduct must be checked against the current Japanese statutory text before advising on a case. Criminal rules should not be collapsed into an unlimited contractual penalty, nor should every inadvertent internal mishandling be publicly described as a completed criminal offence. The proper response to a suspected breach is preservation, controlled escalation, competent-authority engagement, an assessment of the relevant statutory elements, and a plan for remediation consistent with the government contract and other applicable law.
5. Foreign ownership, joint ventures and M&A: security eligibility is a transaction issue
Economic security clearance can become a central transaction constraint even when the investment itself is legally permissible. A prospective buyer may acquire an enterprise with strategic public-sector contracts, critical-infrastructure systems or research projects in which designated government information is involved. If the seller has obtained eligible-contractor status, the buyer must determine the scope and conditions of recognition, whether ownership and director changes require notification or re-examination, what the government agreement says about changes in control, and whether the buyer's acquisition structure could change the authority's assessment of foreign ownership, control or influence. A generic representation that the target 'holds all material governmental permits' will not adequately answer these questions.
The first step in diligence is separation of information content from transaction rights. Designated information must not be uploaded indiscriminately to a data room or exposed to advisers who have no authority to handle it. Due diligence may instead proceed through descriptions of classifications, anonymized project data, confirmation of compliance systems, contract schedules reviewed by appropriately authorized persons, and carefully negotiated disclosure requests to the authority. A clean team in an antitrust review or a conventional NDA does not by itself satisfy statutory clearance restrictions. Corporate counsel should identify early which information can be provided to the buyer, which requires official permission and which must remain outside the transaction process.
The second step is an allocation of the regulatory timetable. An acquisition agreement may need warranties concerning recognition status, proper designation and handling records, absence of known breaches, accuracy of reported ownership data and effectiveness of internal controls, qualified by the information actually available to the seller. Conditions precedent may need to address government consultation, preservation or re-confirmation of recognition, implementation of a compliant post-closing governance structure and continuity of individuals entitled to handle the information. Covenants should control changes in directors, foreign-affiliate access, premises and systems between signing and closing. The parties should not make closing conditional on a public-facing 'facility clearance certificate' where no such general certificate is issued under the Japanese mechanism.
Joint ventures and international research collaborations raise related questions. A foreign strategic partner may lawfully contribute capital, personnel and technology yet lack any right to receive designated government information. The agreement should distinguish joint intellectual property, ordinary trade secrets, export-controlled know-how and officially designated information, with separate approval paths for access and disclosure. Work packages can be designed so that foreign collaborators receive permissible unclassified outputs without gaining access to protected source intelligence, vulnerability descriptions or other designated records. Relevant foreign investment screening, export controls, sanctions, contractual IP rights and competition law must be assessed separately; this Act is not an omnibus authorisation or prohibition for cross-border technology transfer.
The same analysis applies after completion. A group reorganisation can affect a recognized entity's board, direct voting-right holders, managers, premises or foreign transaction profile. A post-merger IT integration may route documents through a group-wide archive; a cost-saving outsourcing arrangement may move network administrators into another jurisdiction. The continuing duty to report and secure review of relevant changes should be included in the integration plan before the deal team relinquishes responsibility. The commercial value of holding a sensitive government contract may be lost if the buyer cannot preserve the legal and technical conditions on which access depends.
6. Conflicts and overlaps: trade secrets, export control, privacy and government procurement
A mature compliance framework does not label every security-sensitive issue a 'clearance' issue. The Unfair Competition Prevention Act protects qualifying trade secrets against prescribed misappropriation; the Foreign Exchange and Foreign Trade Act controls certain exports and transfers of controlled technology; personal-information rules govern employee and customer data; cybersecurity obligations may arise under sectoral rules and public procurement; and the Act on the Protection of Specially Designated Secrets applies to a different category of protected information. The Act on the Protection and Utilization of Critical Economic Security Information operates alongside these regimes and is activated by actual designation and the statutory handling framework. Misclassification in either direction can be costly: an enterprise can underestimate its obligations by treating government-designated material as an ordinary trade secret, or impair legitimate research by imposing clearance procedures without a legal basis.
Research and procurement contracts should make the boundaries explicit. A collaborative development agreement should distinguish background and foreground IP, confidential but unclassified information, controlled technology, and any category that an agency may designate under the Act. It should provide for an escalation mechanism if new designation or government instructions make performance incompatible with pre-existing data sharing, publication or subcontracting arrangements. Publication rights, open-source releases, patent filings and academic dissemination require special attention because a restriction on designated information may conflict with the project's original publication schedule. Rather than promise a blanket right to publish after a short embargo, the parties should design a classification review that identifies what may lawfully be released and who can authorize it.
The 2026 regulatory context underscores the distinction. In April 2026, METI updated its Guidance on Preventing Technology Leakage to cover joint research and coordination with suppliers, and in January 2026 it published Economic Security Management Guidelines. Those are corporate risk-management guidance materials and should not be presented as additional criminal-law provisions under the clearance statute. Their value lies in identifying how employee mobility, overseas operations, joint R&D, supply-chain dependence and management oversight create channels for technology loss. They can assist a contractor in preparing a broader security framework, while the statutory recognition criteria and government agreement determine whether designated information may actually be received and handled.
International dealings add another layer. An overseas headquarters may have strong cybersecurity controls and contractual access rights but still be outside the approved Japanese handling arrangements. A Japanese contractor's recognition does not automatically become a U.S., UK or EU clearance, and receipt of information from another government is subject to the applicable information-sharing and protection arrangements. Counsel should be cautious about reciprocal-recognition assumptions, particularly in defence or dual-use projects. The official Cabinet Office English-language summary is helpful for explaining the architecture to overseas counsel, but the enacted Japanese law, Cabinet Order, unified standards and Japanese operational guidelines govern the actual obligations and should control in the event of any discrepancy in translation or terminology.
The practical integration point is governance. Rather than deploy separate unconnected review procedures for every label, the enterprise should have a common intake process for strategic contracts and sensitive research, with legal, export control, privacy, security, HR and business owners jointly identifying the relevant information types and rules. The outcomes should remain differentiated: official clearance, export licence, privacy consent, NDA, research-security protocol and procurement approval are separate decisions. A decision log recording who made each classification, on what source and under which contractual authority is more defensible than a single corporate statement that all projects are 'economic security compliant'.
7. What boards and General Counsel should implement before the next sensitive project
A company expecting to handle designated information should first determine whether there is a real governmental need-to-know pathway. Project teams should identify the responsible agency and the national-security-related activity, then use the official contractor guidelines to estimate the cost and timetable of internal regulations, responsible officers, personnel selection, secure premises, technical controls and government coordination. A staged readiness plan is preferable to a premature application: the company may build the necessary architecture, but the recognition decision depends on a government need to provide specified information. Management should not promise customers or investors that recognition is guaranteed or will occur by a unilateral company deadline.
Second, governance must be continuous and tied to corporate events. A director-level owner should coordinate legal, cybersecurity, corporate secretarial, HR and project-management functions. Registers of direct voting-right holders, directors and relevant foreign business links should be current; the controlling department should be alerted before material changes are implemented. Procurement procedures should flag cloud migration and outsourcing, while HR should control candidate lists, employee-consent communications, official assessment notifications and training. The company should designate one procedure for resolving differences between an ordinary business request and a statutory limitation on information transfer.
Third, transactional documentation must reflect actual process risk. Government-facing agreements, commercial procurement contracts, research and development agreements, financing covenants, joint-venture agreements and SPAs should be reviewed for incompatible disclosure provisions, changes in control, compliance cooperation, liability, suspension and termination. In a sensitive M&A, the buyer may need to conduct adequate diligence while being unable to receive specific classified material; the agreement should allocate that informational asymmetry rather than force the seller to breach classification restrictions. The more effective solution is often a carefully structured regulatory cooperation covenant, differentiated warranties and a closing plan for preserving security arrangements, with explicit recognition that the authority retains statutory discretion.
Fourth, the board should require evidence rather than assurance. Key records include the legal designation and information need, government communications, recognition outcome and conditions, access-authorised personnel and their roles, completed training, incident reports, inspection results, changes notified to the authority, and return or destruction certificates where required. Sensitive personal assessment materials should not be included wholesale in board packs or transaction data rooms. Oversight must rely on appropriately abstracted status reporting that demonstrates the control works without replicating the security risk the system is designed to prevent.
Finally, the 2026 parliamentary report provides a useful governance lesson. The government's first operating period recorded classification decisions and employee assessments but no contractor recognition during the reporting window, and an official review identified a case requiring correction of the designation marking arrangements. The lesson is neither that the system is dormant nor that every prospective contractor faces an immediate obligation. It is that the framework is subject to implementation and oversight, and an organization must be capable of adjusting procedures when guidance, official expectations or its own factual circumstances change. For management and General Counsel, the objective is a legally grounded capability to protect and use specified information only when authorized, integrated with commercial value creation and accountability to employees, counterparties and the competent authority.
Frequently Asked Questions
Q1. What is Japan's new economic security clearance law called?
The government's official English summary uses 'Act on the Protection and Utilization of Critical Economic Security Information' (Act No. 27 of 2024). Its principal provisions entered into force on 16 May 2025. It governs the designation, controlled provision and handling of specific economic-security information and related corporate and personal safeguards.
Q2. Does the law apply to every confidential technical document held by a Japanese company?
No. Statutory 'critical economic security information' must be designated by a competent government authority under defined legal conditions. Ordinary trade secrets, confidential research data and export-controlled technology remain governed by their respective legal and contractual regimes unless they also come within the statutory designation framework.
Q3. Can a foreign-owned Japanese company obtain eligible-contractor recognition?
The official standards examine ownership, control and influence and the circumstances of the particular proposed contractor. They require specified shareholder and director disclosures, but a simple percentage test cannot replace the authority's overall legal assessment. A specific case should be discussed with the competent agency; foreign shareholding cannot be treated as an automatic yes or no solely from the headline of the law.
Q4. Can a company apply for a general security clearance before winning any government work?
Not as an open certification independent of an information-sharing need. The official contractor guidelines indicate that the competent authority must first find it necessary to provide designated information to that business for a qualifying national-security-related activity. The company can prepare its governance and facilities in advance but cannot compel recognition without that requirement.
Q5. Does eligible-contractor recognition automatically clear all its employees?
No. Corporate recognition and individual suitability assessments are separate. Only persons authorized under the relevant statutory and operational framework who also have a genuine handling need may access the designated information. A generic employee NDA is not a substitute.
Q6. Can employees refuse the official suitability assessment?
Yes. The assessment requires consent, and the Cabinet Office Q&A states that an employee need not agree. An authority or eligible contractor must not demand the reason for refusal or impose prohibited adverse treatment merely because the individual declines. Staffing and business-continuity consequences must be managed without breaching those protections.
Q7. Can HR inspect employees' medical and financial investigation records?
An employer should not assume such access. Official investigations are handled through a controlled government process, and the Act, operational standards, Q&A and sample government contract restrict use and disclosure of assessment-related personal information. Employers should administer the candidate and authorization process with tightly restricted access and purpose limitation.
Q8. Is personnel clearance valid for ten years and transferable to another employer?
Article 11 measures the ordinary ten-year period from the date on which the individual receives notification of the assessment result under Article 13(1). Specific provisions govern reliance on an assessment by another competent authority and reassessment when circumstances change. Neither the passage of less than ten years nor movement to a new employer automatically gives access to designated information or satisfies organizational recognition and need-to-know requirements.
Q9. May a global parent, cloud provider or overseas subcontractor access information held by a recognised Japanese contractor?
Not simply because a group contract or NDA allows it. The statutory authorization, government arrangement, personnel status, access locations and outsourcing conditions must all be assessed. Information should not enter ordinary group-wide archives or data rooms without confirming that this is permitted by the applicable handling regime.
Q10. What happens to clearance-related arrangements in a share acquisition or joint venture?
Relevant ownership, directors, business and handling-site changes may need to be notified or reviewed under the government's requirements and contract. Transaction diligence should identify the actual recognition and its conditions, use lawful information-access arrangements, and allocate regulatory cooperation, change-of-control and post-closing integration risk.
Q11. How serious are penalties for a leak?
The official government summary describes criminal penalties for specified unauthorized disclosure of up to five years' imprisonment or a fine of up to JPY 5 million, or both. Whether the statutory elements are established in an actual incident requires an analysis of the conduct and current Japanese text; commercial breaches and every mishandling event should not be treated as interchangeable with a completed criminal offence.
Q12. What did the government's June 2026 report say about actual recognition of companies?
For the historical period from 16 May to 31 December 2025, the report recorded zero eligible-contractor recognitions, alongside twenty designations and eighteen completed individual assessments. It did not state that the number would remain zero through October 2026. It is a reporting-period statistic, not a substitute for current project-specific agency confirmation.
About the Legal Update Series
SAKURA Law Office and Managing Partner Kenshiro Michishita publish the Legal Update series as a body of practical legal analysis on corporate and M&A matters, private equity, financial regulation, cross-border transactions and disputes, corporate governance, crisis management, economic security, artificial intelligence, data protection and other legal issues affecting enterprise decision-making. Each edition seeks to distinguish enforceable law from implementing rules, government guidance and practical recommendations, and to connect primary legal sources with decisions that executives, boards, General Counsel and transaction teams must make. Related information about the firm and the author is available through the SAKURA Law Office official website and the professional profile of Managing Partner Kenshiro Michishita.
Related resources: SAKURA Law Office Official Website | Profile of Managing Partner Kenshiro Michishita
How SAKURA Law Office Can Assist
SAKURA Law Office can assist Japanese and international businesses with scoping the statutory regime, identifying the appropriate agency and project-related information need, designing eligible-contractor readiness measures, reviewing internal security regulations and personnel-consent workflows, advising on government-facing agreements and supplier arrangements, and integrating classified-information governance with employment, personal-data, trade-secret, cybersecurity and export-control obligations. The firm can also advise on transaction risk arising from ownership, board composition, foreign control or influence, due diligence information boundaries and changes to security-related arrangements in financing, joint ventures, strategic collaborations and M&A. Where an official designation, suitability assessment or recognition is involved, advice must be coordinated with the competent government body and any necessary specialist technical support; legal counsel cannot itself confer clearance or promise its issuance.
Contact
SAKURA Law Office
Ark Hills South Tower 4F, 1-4-5 Roppongi, Minato-ku, Tokyo 106-0032, Japan
Managing Partner Kenshiro Michishita
Principal References
2. e-Gov Laws, Enforcement Order for the Act (Cabinet Order No. 26 of 2025; Japanese)
3. Japanese Law Translation Database, Official English Summary of the Act
4. Cabinet Office, Critical Economic Security Information Act: Official Materials Portal
5. Cabinet Office, Detailed Overview of the Act (Japanese)
6. Cabinet Office, Uniform Operational Standards (Cabinet Decision of 31 January 2025; Japanese)
7. Cabinet Office, Operational Guidelines for Eligible Contractors (Japanese)
8. Cabinet Office, Operational Guidelines for Administrative Authorities (Japanese)
9. Cabinet Office, Q&A on Personnel Suitability Assessments (Japanese)
10. Cabinet Office, Official Flow of Information Provision and Clearance (Japanese)
11. Cabinet Office, Implementing Forms and Templates (Japanese)
12. Cabinet Office, Model Government Agreement for an Eligible Contractor (Japanese)
13. Cabinet Office, Model Internal Information-Protection Regulations (Japanese)
14. Cabinet Office, Application Form for Eligible-Contractor Recognition (Japanese)
15. Cabinet Office, June 2026 Parliamentary Report: Executive Summary (Japanese)
16. Cabinet Office, June 2026 Parliamentary Report: Full Text (Japanese)
17. Cabinet Office, Parliamentary Reporting Portal (Japanese)
18. Cabinet Office, Protection Rules of Administrative Authorities (Japanese)
19. Cabinet Office, Suitability-Assessment Complaints and Consultation Channels (Japanese)
20. Cabinet Office, Reporting Channels for Critical Economic Security Information (Japanese)
21. Cabinet Office, Advisory Council on the Act (including June 2026 materials; Japanese)
22. Cabinet Office, Inter-Agency Committee for the Act (2026 Materials; Japanese)
23. METI, Second Edition of Guidance on Preventing Technology Leakage (27 April 2026; Japanese)
24. METI, Economic Security Management Guidelines and Policy Materials (January 2026; Japanese/English)
25. NEDO, Measures to Prevent Technology Leakage in R&D Projects (27 March 2026; Japanese)
26. e-Gov Laws, Act on the Protection of Specially Designated Secrets (Japanese)
27. e-Gov Laws, Foreign Exchange and Foreign Trade Act (Japanese)
28. e-Gov Laws, Unfair Competition Prevention Act (Japanese)
29. e-Gov Laws, Act on the Protection of Personal Information (Japanese)
Disclaimer
This Legal Update is based on publicly available primary material as of 8 October 2026, including Act No. 27 of 2024, the implementing Cabinet Order, the Cabinet-approved uniform operational standards, the Cabinet Office's eligible-contractor and administrative-agency guidelines and suitability Q&A, and the government's June 2026 report to the Diet. The official English-language material used in this edition is an explanatory summary rather than a substitute for the binding Japanese legal text. This publication is general legal information, not legal advice or a determination of the status of any particular enterprise, employee, government information, contract or transaction.
Designation, recognition, personal assessments, access permissions, ownership and influence reviews, and disclosure restrictions depend on the applicable agency, current law, governing contract and facts. The reported operational statistics relate to the periods expressly stated and are not a statement of the current status of all agency decisions. Government guidelines, model contracts and policy materials should be distinguished from statutes and Cabinet Orders. Readers should confirm the latest official sources and obtain case-specific advice before any information sharing, employment decision, procurement, outsourcing or transaction affecting designated information.