The Ministry of Internal Affairs and Communication announced, on 23 March 2023, that it had released draft revisions to its guidelines on Personal Information Protection in the Telecommunications Sector and is requesting public comments on the same. In particular, the draft revised guidelines provide information regarding data handling, data handling policies, and data breach notification, among other things.

More specifically, the draft revised guidelines clarify what information will be considered as specific user information, highlighting that information, such as IP addresses, alone cannot necessarily identify a contracted and/or registered user; however, it can be easily collated with other information which makes it possible to identify the contracted and/or registered user. Furthermore, the draft revised guidelines outline recommendations to prevent leakage, loss, or damage of specific user information, including security management, in the following areas:

• organisational security control measures;
• personnel security control measures;
• physical security control measures; and
• technical security control measures.

Public comments can be submitted here until 25 April 2023.

You can read the press release here and a comparison table with the draft revised guidelines here, both only available in Japanese.