Act on Prohibition of Unauthorized Computer Access
不正アクセス行為の禁止等に関する法律
Makes it a crime to get into a computer over a network by entering someone else's identification code or by getting around its access control, bans obtaining, handing over and storing other people's codes and tricking people into entering theirs, and has the prefectural public safety commission () help computer operators who have been broken into.
- Text in force since
- Promulgated
- Articles
- 14
- Amendments on the way
- 0
What this law does
- An identification code (識別符号) is a code an access administrator (アクセス管理者) gives each user, and itself, so it can tell them apart: a code the administrator says must not be revealed to others without good reason, a code made by the administrator's method from an image of the person's body or part of it, from their voice or from their signature, or one of these combined with another code. An access control feature (アクセス制御機能) is a feature the administrator adds to the computer, or to another computer linked to it over a network, that automatically checks that the code someone enters is an identification code — or a code made from one by the administrator's method, combined with part of it — and then lifts some or all of the restrictions on use.(Art. 2(1), Art. 2(2), Art. 2(2)(i), Art. 2(2)(ii), Art. 2(2)(iii), Art. 2(3)) (the provisions it rests on)
Read the full overview
- No one may carry out unauthorized access (不正アクセス行為). It is, first, entering someone else's identification code over a network into a computer that has an access control feature, so that the computer can be used as the feature otherwise prevents. It is not unauthorized access when the access administrator who set up the feature does it, or when it is done with the consent of that administrator or of the user the code belongs to.(Art. 3(1), Art. 2(4)(i)) (the provisions it rests on)
- Unauthorized access is also entering, over a network, information (other than an identification code) or a command that gets around the access control feature, so that the computer can be used as the feature otherwise prevents; and entering information or a command that gets around the access control feature of another computer linked to it, which controls this computer's use. Neither is unauthorized access when the administrator who set up the feature does it or consents to it.(Art. 2(3), Art. 2(4)(ii), Art. 2(4)(iii)) (the provisions it rests on)
- No one may obtain someone else's identification code to use it for unauthorized access by entering it. No one may store someone else's identification code that was wrongfully obtained, for that purpose.(Art. 4(1), Art. 6(1)) (the provisions it rests on)
- No one may give someone else's identification code to anyone other than the access administrator and the user the code belongs to, unless it is done for work or another legitimate reason.(Art. 5(1)) (the provisions it rests on)
- No one may pose as an access administrator, or otherwise make people believe they are the administrator, to ask users to enter their identification code, either by putting the request on a site the public can view over a network or by sending it to a user by e-mail — unless the administrator has consented.(Art. 7(1), Art. 7(1)(i), Art. 7(1)(ii)) (the provisions it rests on)
What counts as unauthorized accessIdentification codesObtaining someone else's identification codeHanding over someone else's identification codeStoring someone else's identification codePosing as an administrator to ask for codesHelp for a computer that was broken intoPenalties
Amendments
A Japanese law is changed by another law or order that rewrites it — an . No amendment to this law is waiting to come into force. Its amendment history is below. The amendments this site has read the changes of are on this law's amendments page, provision by provision, in Japanese and English.
3 amendments already in force
1 June 2025
The text on this site
Act on the Arrangement of Related Acts upon the Enforcement of the Act Partially Amending the Penal Code, etc.
刑法等の一部を改正する法律の施行に伴う関係法律の整理等に関する法律
17 June 2022
Act on the Arrangement of Related Acts upon the Enforcement of the Act Partially Amending the Penal Code, etc.
刑法等の一部を改正する法律の施行に伴う関係法律の整理等に関する法律
1 November 2012
Act Partially Amending the Penal Code, etc. to Address the Advancement of Information Processing, etc.
情報処理の高度化等に対処するための刑法等の一部を改正する法律
Who it applies to
It applies to
- Any person (何人も): the bans on unauthorized access and on obtaining, handing over, storing and asking for other people's identification codes bind everyone.(Art. 3(1), Art. 4(1), Art. 5(1), Art. 6(1), Art. 7(1)) (the provisions it rests on)
- Access administrators (アクセス管理者) — whoever manages how a networked computer runs when it is used over the network — who have set up an access control feature. They are to endeavour to manage identification codes and the codes used to check them properly, to keep checking that the feature works, and, where needed, to upgrade it promptly or take other measures to protect the computer. This is a duty to endeavour, with no penalty attached.(Art. 2(1), Art. 8(1), Art. 11(1), Art. 12(1), Art. 13(1)) (the provisions it rests on)
1 more
- Anyone who has done case analysis entrusted by a prefectural public safety commission, who must keep its secrets.(Art. 9(3)) (the provisions it rests on)
Special rules and exceptions (3)
- The access administrator who set up an access control feature does not commit unauthorized access by using another's identification code or getting around the feature; nor does anyone who acts with that administrator's consent, or, when entering another's code, with the consent of the user the code belongs to.(Art. 2(4)(i), Art. 2(4)(ii), Art. 2(4)(iii)) (the provisions it rests on)
- Giving someone else's identification code to a third party is not banned when it is done for work or another legitimate reason.(Art. 5(1)) (the provisions it rests on)
- Asking users to enter their identification code in the administrator's name is not banned when the administrator has consented.(Art. 7(1)) (the provisions it rests on)
How it is enforced (8)
- Unauthorized access is punishable by imprisonment (拘禁刑) of up to three years or a fine of up to 1 million yen.(Art. 11(1), Art. 3(1)) (the provisions it rests on)
- Obtaining someone else's identification code for unauthorized access, storing one that was wrongfully obtained for that purpose, and posing as an administrator to ask for codes, are each punishable by imprisonment of up to one year or a fine of up to 500,000 yen.(Art. 12(1)(i), Art. 12(1)(iii), Art. 12(1)(iv), Art. 4(1), Art. 6(1)) (the provisions it rests on)
- Handing over someone else's identification code to anyone other than the access administrator and the code's user, without work or another legitimate reason as grounds, is punishable by imprisonment of up to one year or a fine of up to 500,000 yen if the giver knew the recipient meant to use it for unauthorized access by entering it. Any other such handing over is punishable by a fine of up to 300,000 yen.(Art. 5(1), Art. 4(1), Art. 12(1)(ii), Art. 13(1)) (the provisions it rests on)
- Under Article 14, the crimes of unauthorized access and of obtaining, knowingly handing over, or storing identification codes follow Article 4-2 of the Penal Code (刑法, Act No. 45 of 1907), a separate Act. Under the transitional provisions (附則) of Act No. 74 of 2011, Article 14 applies only to crimes that a treaty requires to be punished even when committed outside Japan, where that treaty took effect for Japan on or after the day the Convention on Cybercrime (サイバー犯罪に関する条約) did.(Art. 14(1), Suppl. Prov. Art. 1(1)(ii), Suppl. Prov. Art. 7(1)) (the provisions it rests on)
- Where unauthorized access appears to have happened, the access administrator of the computer may ask the prefectural public safety commission () for help to prevent it happening again, submitting documents and other material on how the computer was running and managed at the time. If the commission finds the request appropriate, it gives material, advice, guidance and other help so that the emergency measures needed against the method or cause of the attack are taken properly. In parts of Hokkaido, the area public safety commission (方面公安委員会) does this.(Art. 9(1)) (the provisions it rests on)
- The commission may entrust the technical analysis of the method and cause behind a case, in whole or in part, to a body that National Public Safety Commission Rules (国家公安委員会規則) name. Anyone who does that analysis must not reveal secrets learned in it, on pain of imprisonment of up to one year or a fine of up to 500,000 yen.(Art. 9(2), Art. 9(3), Art. 9(4), Art. 12(1)(v)) (the provisions it rests on)
- The National Public Safety Commission, the Minister for Internal Affairs and Communications and the Minister of Economy, Trade and Industry publish, at least once a year, how much unauthorized access is taking place and how research on access control technology is progressing. They are also to endeavour to give information and other help to bodies formed by businesses working on more advanced access control features to support the protective measures administrators take under Article 8, where a body is found able to give that support properly and effectively.(Art. 10(1), Art. 10(2)) (the provisions it rests on)
- The prefectural public safety commissions and the national government must endeavour to raise awareness of, and spread knowledge about, protecting computers from unauthorized access.(Art. 9(5), Art. 10(3)) (the provisions it rests on)
How it connects to other laws
Cites this lawLawThis law cites it
It also names 2 laws not yet held here.
Where the translation comes from
- 37
- 24
- 3not translated
The Ministry of Justice's translation is shown only where the Japanese it translates matches the law in force today. Everywhere else the English is a machine translation, marked on the paragraph itself.
Only the Japanese is the law, and no lawyer has reviewed the machine translation.
Sources
Everything this page rests on
- e-Gov (Digital Agency)不正アクセス行為の禁止等に関する法律 — the text in force from 2025-06-01Original
- e-Gov (Digital Agency)不正アクセス行為の禁止等に関する法律 — revision historyOriginal
- Japanese Law Translation, Ministry of JusticeAct on Prohibition of Unauthorized Computer Access — Ministry of Justice translationOriginal
- Machine translation, not official
- Written for this site with AIEnglish titles of amending laws, written for this site
- Written for this site with AIDescriptions of each law, written for this site
- Written for this site with AICorrections to the Ministry of Justice's English
- Worked out by this site from e-Gov's text