Information Security Laws and Regulations

Which of the following falls under an act of unauthorized access prohibited by the Act on Prohibition of Unauthorized Computer Access?

1. Taking a company's manufacturing know-how, managed as a secret, without permission and disclosing it to a competitor.
2. Directly operating a PC that is not connected to any network and logging in with a coworker's ID and password.
3. Entering someone else's ID and password without their permission and logging into a company server over the internet from outside the company.
4. Creating a virus that causes a computer to act contrary to the user's intent, and keeping it stored on one's own PC without distributing it.

Asked by a coworker who says they are busy, a person tells that coworker their own business system ID and password without a legitimate reason. Which combination of a law and provision does this act raise a problem under?

1. The act of facilitating unauthorized access prohibited by the Act on Prohibition of Unauthorized Computer Access
2. The Penal Code's offense concerning unauthorized command electromagnetic records (the so-called virus offense)
3. The unlawful acquisition and disclosure of trade secrets prohibited by the Unfair Competition Prevention Act
4. Infringement of the reproduction right and the right of public transmission under the Copyright Act

Someone directly operated a standalone PC not connected to the internal network, right there in person, and logged in by entering a coworker's ID and password. Which of the following is the appropriate reason this act does not fall under an act of unauthorized access under the Act on Prohibition of Unauthorized Computer Access?

1. Because the act was not carried out over a telecommunications line
2. Because that PC had no access control function configured on it
3. Because the person had been told the ID and password by the coworker
4. Because no file was viewed or taken out

Which law can apply to someone who created a program that makes a computer act contrary to the user's intent, and kept it stored on their own PC without yet distributing it to anyone?

1. The Unfair Competition Prevention Act
2. The Act on Prohibition of Unauthorized Computer Access
3. The Basic Act on Cybersecurity
4. The Penal Code's offense concerning unauthorized command electromagnetic records

Which of the following offenses can most appropriately apply to entering someone else's obtained credit card number into a shopping site and having merchandise purchased and delivered to oneself?

1. Unlawful acquisition of limited-provision data under the Unfair Competition Prevention Act
2. Infringement of the right of public transmission under the Copyright Act
3. The Penal Code's offense of fraud by means of an electronic computer
4. The Penal Code's offense of obstructing business by damaging a computer, and the like

Which of the following offenses can most appropriately apply to sending a flood of requests to another company's web server, making it unable to respond, and stopping that company's online sales business?

1. The Penal Code's offense of obstructing business by damaging a computer, and the like
2. The Penal Code's offense concerning unauthorized command electromagnetic records
3. Unlawful acquisition of a trade secret under the Unfair Competition Prevention Act
4. An act of unauthorized access under the Act on Prohibition of Unauthorized Computer Access

Which of the following correctly describes the content of the Basic Act on Cybersecurity?

1. It sets out the responsibilities of the national and local governments and the efforts expected of critical infrastructure operators, and establishes a Cybersecurity Strategic Headquarters within the Cabinet.
2. It contains provisions making it a punishable crime to log into a computer using someone else's ID and password without permission.
3. It provides that, when providing personal data to a third party, the individual's prior consent must in principle be obtained.
4. It defines the three requirements — being managed as a secret, usefulness, and non-public knowledge — for something to be legally protected as a trade secret.

Which combination correctly lists the three requirements needed for something to be protected as a trade secret under the Unfair Competition Prevention Act?

1. Accuracy, comprehensiveness, and being up to date
2. Confidentiality, integrity, and availability
3. Being limited-provision, being accumulated in a substantial quantity, and being managed electromagnetically
4. Being managed as a secret, usefulness, and non-public knowledge

A departed employee copied and took out a customer list that had been kept in a shared folder viewable by anyone in the company, with no marking such as “internal use only.” Which of the following is the main reason it would be difficult to claim this as an infringement of a trade secret under the Unfair Competition Prevention Act?

1. The person who took it out had held legitimate access rights while employed
2. It would be hard to recognize that it was managed as a secret, so it lacks the requirement of secret management
3. The customer list is already publicly known information, so it lacks the requirement of non-public knowledge
4. A customer list cannot be said to be information useful for business activity, so it lacks the requirement of usefulness

A company accumulates and manages, electromagnetically, a large volume of weather observation data that it provides to member companies for a fee, but it does not manage this data as a secret. Under which category of the Unfair Competition Prevention Act is this data protected?

1. A trade secret under the Unfair Competition Prevention Act
2. Special-care-required personal information under the Act on the Protection of Personal Information
3. Limited-provision data under the Unfair Competition Prevention Act
4. Anonymized information under the Act on the Protection of Personal Information

Which of the following falls under personal information as defined by the Act on the Protection of Personal Information?

1. A statistic of visitor counts aggregated so that no specific individual can be identified
2. The name and last known address of someone who has already died
3. The driver's license number of a living individual
4. The head office address and main phone number of a corporation

Which of the following is the subject an individual can request a personal information handling business operator to disclose, correct the content of, or stop using?

1. Pseudonymized information
2. Anonymized information
3. A personal information database, etc.
4. Retained personal data

Which of the following falls under special-care-required personal information under the Act on the Protection of Personal Information?

1. An employee's company email address
2. Information about an employee's nationality
3. An employee's annual income for the past year
4. The results of an employee's health checkup

Regarding the handling of special-care-required personal information, which of the following is appropriate?

1. Even when passing it to a contractor within the scope necessary to achieve the purpose of use, the individual's prior consent is always required.
2. Once processed into pseudonymized information, it can be provided to a third party without the individual's consent.
3. Obtaining it requires the individual's prior consent in principle, and third-party provision through opt-out is not permitted.
4. If it is information the individual has published themselves, there is no longer any need to treat it as special-care-required personal information once obtained.

Which of the following is required to carry out third-party provision of personal data through opt-out?

1. Reporting the content of the personal data provided and the name and address of the recipient to the Personal Information Protection Commission in writing every single time it is provided
2. Processing the personal data to be provided into anonymized information that cannot identify a specific individual and cannot be restored
3. Notifying the individual of the prescribed matters, or placing them where the individual can easily learn of them, and filing a notification with the Personal Information Protection Commission
4. Obtaining individual consent from each person in advance for every destination the data is provided to

Which of the following correctly describes the difference between joint use of personal data and third-party provision through opt-out?

1. Joint use requires no notification to the Personal Information Protection Commission, while opt-out requires such a notification.
2. Joint use cannot cover special-care-required personal information, while opt-out can.
3. Joint use falls under third-party provision, while opt-out is excluded from third-party provision.
4. Joint use requires no notification to the individual at all, while opt-out requires notifying the individual.

Which of the following correctly describes the difference between pseudonymized information and anonymized information?

1. Both require notifying the recipient of the individual's contact information when providing them to a third party.
2. Anonymized information can be provided to a third party without the individual's consent, while pseudonymized information cannot be provided to a third party except for outsourcing, business succession, or joint use.
3. Both can be provided to a third party with the individual's consent and cannot be provided without it.
4. Pseudonymized information can be provided to a third party without the individual's consent, while anonymized information cannot be provided to a third party even with the individual's consent.

A company wants its internal marketing department alone to analyze its member data. After deleting names and processing the data so that individuals cannot be identified unless cross-referenced with other information, and then using it that way, which of the following correctly describes the status and restrictions of the processed information?

1. It is pseudonymized information, and because it stops being personal information once processed, it becomes entirely outside the scope of the Act on the Protection of Personal Information.
2. It is pseudonymized information; it must not be cross-referenced with other information for the purpose of identifying an individual, and in principle it cannot be provided to a third party either.
3. It is anonymized information, and the processed information can be used to contact the individuals.
4. It is anonymized information, and requests from the individual for disclosure or a stop of use must be honored.

Which of the following does not violate the restriction on third-party provision even though personal data is passed to another business operator without the individual's consent?

1. Providing it after confirming that the recipient is a business operator that has made the necessary filing with the Personal Information Protection Commission
2. Providing it to another company in the same corporate group, on the grounds that they belong to the same group
3. Providing it to a contractor to whom work is outsourced, within the scope necessary to achieve the purpose of use, for that work
4. Providing it to a company whose business card was exchanged at a trade show, for the purpose of later sales activity

Regarding when a report to the Personal Information Protection Commission and notification to the individuals become mandatory upon a personal data leak, which of the following is appropriate?

1. Only when an inquiry has actually been received from an affected individual
2. Cases such as where special-care-required personal information is involved, where there is a risk of wrongful intent, or where the number of affected individuals exceeds 1,000
3. Only the contractor needs to report a leak that occurred at the contractor, and the outsourcing party bears no obligation to report to the Personal Information Protection Commission
4. Every single case of a leak, loss, or damage that occurs at the business operator, regardless of the number of records or the content leaked

A customer list entrusted by a business partner was used without permission for the company's own sales activity, a purpose different from what the contract specified. Which law is most directly implicated?

1. The Act on the Protection of Personal Information
2. The Penal Code's offense concerning unauthorized command electromagnetic records
3. The Copyright Act
4. The Act on Prohibition of Unauthorized Computer Access

What is the name of the law that came into force on April 1, 2025 (Reiwa 7), the result of a revision to the former Provider Liability Limitation Act?

1. The Act on Improving Transparency of Specified Digital Platforms
2. The Act on the Prevention of Internet Rights Infringement
3. The Telecommunications Carrier Information Disclosure Act
4. The Act on Countermeasures against Information Distribution Platforms

Which of the following is an obligation the Act on Countermeasures against Information Distribution Platforms imposes on a large-scale specified telecommunications service provider?

1. Publishing the sender information of a post suspected of infringing rights, even without a request from the victim
2. Publishing the method for accepting takedown requests, investigating a request and notifying the result within a set period, and establishing and publishing the criteria for takedown
3. Following an individual takedown order issued by an administrative agency for a post about which a rights-infringement claim has been made, and immediately deleting that post
4. Reviewing the content of every single posted piece of information before publication and refraining from posting anything with a risk of infringing rights

Which law provides that a telecommunications carrier must not disclose the secrecy of another person's communications that it comes to know in the course of its handling?

1. The Act on Prohibition of Unauthorized Computer Access
2. The Act on the Protection of Personal Information
3. The Penal Code's offense of unlawfully creating a private electromagnetic record
4. The Telecommunications Business Act

Which law establishes the principle that email sent for advertising or promotional purposes may only be sent to those who have given prior consent?

1. The Act on the Protection of Personal Information
2. The Act on Regulation of Transmission of Specified Electronic Mail
3. The Act on Prohibition of Unauthorized Computer Access
4. The Copyright Act

Under the Act on Regulation of Transmission of Specified Electronic Mail, which of the following must a sender do when sending advertising and promotional email?

1. Give prior notice to each individual recipient at least three days before sending the advertising email.
2. Display the sender's name or designation, along with contact information for receiving a notice that the recipient does not wish to receive further mail.
3. State, at the start of the body, the filing number received when a notification was made in advance to the Personal Information Protection Commission.
4. Change the sending email address every time, and never reuse the same address.

Which of the following correctly describes the content of the Act on Electronic Signatures and Certification Business?

1. For an electromagnetic record with an electronic signature attached, not only that the creator is genuine but also the truthfulness of its content is legally guaranteed.
2. An electromagnetic record bearing an electronic signature that satisfies certain requirements which only the person themselves could have made is presumed to have been established genuinely.
3. A certificate used for an electronic signature can only be one issued directly by the government.
4. To use an electronic signature, the other party's written consent must be obtained in advance.

Commercially sold software was installed and used on company PCs without authorization, exceeding the number of licenses purchased. Which law is most directly implicated?

1. The Unfair Competition Prevention Act
2. The Act on the Protection of Personal Information
3. The Act on Prohibition of Unauthorized Computer Access
4. The Copyright Act

Which of the following is not a subject of protection under the Copyright Act?

1. A photograph taken by an employee for publication in the company newsletter
2. The underlying algorithm of a program, or a communication protocol itself
3. A macro program that runs on top of spreadsheet software, written by an employee for business use
4. An internal database whose selection or systematic arrangement of information is recognized as creative

A company wants to collect a large volume of text published on the web to develop generative AI in-house, analyzing it as training data. Which of the following is the correct way of thinking under copyright law?

1. Use for information analysis that does not aim to enjoy the thoughts or feelings expressed in a copyrighted work may be carried out without permission, to the extent recognized as necessary, except where it would unreasonably harm the copyright holder's interests.
2. As long as it was used for training, no copyright infringement occurs even if the generated text resembles an existing copyrighted work and is found to be based on it.
3. Information published on the internet is not subject to the Copyright Act even if it is a copyrighted work, so it can be freely collected, analyzed, and its output freely published.
4. When used as training data, even use for information analysis not aimed at enjoying thoughts or feelings requires individual permission from the copyright holder for every collected work, with no use permitted otherwise.

Which of the following is a use recognized under the Copyright Act without needing the copyright holder's permission?

1. Downloading and saving a paid manga while knowing it was uploaded illegally.
2. Quoting part of a published paper, citing the source, clearly distinguishing it from one's own writing, and keeping one's own writing as the main body with the quotation as a subordinate part.
3. Copying the necessary portion of a commercially published book, one copy per participant, to distribute as material for in-house training, with each person keeping their own copy.
4. Bypassing copy protection to duplicate a commercially sold DVD for personal viewing at home.

Which of the following correctly describes the difference between a subcontract (ukeoi) arrangement and a worker dispatch (haken) arrangement?

1. Under a subcontract, the ordering party cannot, and under dispatch, the client company also cannot, directly direct and supervise the workers it receives.
2. Under a subcontract, the ordering party cannot directly direct and supervise the other party's workers, while under dispatch, the client company can direct and supervise the dispatched workers.
3. Under both a subcontract and dispatch, the workers are employed by the company that takes on the work, and that company also directs and supervises them.
4. Under a subcontract, the ordering party can directly direct and supervise the other party's workers, while under dispatch, the client company cannot direct and supervise the dispatched workers.

Under a subcontract (ukeoi) agreement, a partner company's engineer is stationed at the company, and a manager at the company directly instructs that engineer's daily work content and procedures. What is this situation called, and which law does it primarily violate?

1. Unauthorized reproduction, which primarily violates the Copyright Act.
2. Use outside the stated purpose, which primarily violates the Act on the Protection of Personal Information.
3. Unlawful use of a trade secret, which primarily violates the Unfair Competition Prevention Act.
4. Disguised subcontracting, which primarily violates the Worker Dispatch Act.

The Subcontract Act was renamed effective January 1, 2026 (Reiwa 8). Which of the following correctly combines the new law's abbreviated name with the changes made alongside it?

1. The Fair Trade Fairness Act. The scope is limited to manufacturing, excluding outsourced transport or the creation of information-based deliverables, and no name change was made.
2. The Small and Medium Enterprise Support Act. The capital-based threshold was abolished, and a business operator's size is now judged solely by employee count, while the ban on payment by promissory note was postponed.
3. The Small and Medium Subcontracting Fairness Act (Torikitekihou). The main contractor is renamed the outsourcing business operator and the subcontractor the small and medium subcontracting business operator, and payment by promissory note is banned.
4. The Outsourcing Transaction Transparency Act. It requires the content of an outsourcing arrangement to be filed with the Japan Fair Trade Commission in advance.

A company outsourced data-entry work involving personal data, and an employee of the contractor took the data out and sold it to a list broker. Regarding the outsourcing party's responsibility, which of the following is appropriate?

1. Third-party provision was already complete the moment the data was provided to the contractor, so no responsibility remains with the outsourcing party.
2. The outsourcing party retains an obligation to exercise necessary and appropriate supervision over the contractor, and can be held responsible under the Act on the Protection of Personal Information.
3. Since this occurred at the contractor, the obligation to report to the Personal Information Protection Commission falls only on the contractor, not on the outsourcing party.
4. As long as a non-disclosure agreement was signed with the contractor, no responsibility reaches the outsourcing party.

Which of the following is a necessary precondition for disciplining an employee who violated the information security regulations?

1. That the types and grounds of discipline are set out in the work rules and communicated to employees
2. That the information security regulations have been filed in advance with the Personal Information Protection Commission
3. That the violation is also recognized as constituting a crime under the Penal Code
4. That a written non-disclosure agreement has been signed with each individual employee in advance

Regarding the Whistleblower Protection Act, which of the following is appropriate?

1. A report must always be made to a government agency; a report to an internal contact point is outside the law's protection, so disadvantageous treatment is not prohibited in that case either.
2. Regardless of a business operator's size, establishing an internal reporting contact point remains only a best-effort obligation.
3. Dismissal or other disadvantageous treatment on the grounds of having made a public-interest report is prohibited, and business operators above a certain size are required to establish a system for handling internal public-interest reports.
4. The whistleblower's name can be widely shared with relevant departments to smooth the internal investigation.

Which of the following correctly describes CVSS, the common metric for evaluating a vulnerability's severity?

1. An evaluation method that scores a vulnerability's severity on a common scale, expressed as a value from 0.0 to 10.0
2. The name of a database of vulnerability countermeasure information that gathers and publishes vulnerabilities reported domestically
3. A list of which software components a product contains, down to their names and versions
4. A globally common identification number assigned to each individual vulnerability, used in common by everyone involved

Which of the following correctly describes terms related to vulnerabilities?

1. JVN is merely a list classifying types of vulnerability and does not carry information about individual vulnerabilities or countermeasures.
2. CVE is a common scale for numerically evaluating a vulnerability's severity.
3. CVSS is a common identification number assigned to uniquely identify an individual vulnerability.
4. CVSS is a common scale for evaluating a vulnerability's severity, and CVE is a common number for identifying an individual vulnerability.

Which of the following correctly describes the content of the Cybersecurity Management Guidelines published by the Ministry of Economy, Trade and Industry and IPA?

1. It defines, as a standard, the examination criteria for obtaining ISMS certification.
2. It presents concrete criteria for interpreting the legal obligations concerning security control measures for personal data.
3. It presents three principles executives should be aware of and ten important items executives should direct a responsible executive such as the CISO to carry out.
4. It specifically names products to designate the minimum technical measures a small or medium-sized enterprise must carry out.