Japan to introduce certification for data centers and cloud services, effectively excluding Chinese firms

【Financial News, Tokyo = Seo Hye-jin, Correspondent】The Japanese government will introduce a national security certification system for data centers and cloud services. It plans to recommend that financial and medical institutions and others handling sensitive personal information use certified services. Businesses under the influence of China or Russia are expected to find it even harder to operate in the Japanese market.
According to the Nihon Keizai Shimbun (Nikkei) on the 19th, Japan’s Ministry of Internal Affairs and Communications and Ministry of Economy, Trade and Industry (METI) plan to implement the new certification system after fiscal 2027. The government will assess business information, safeguards against data leaks and equipment suppliers, among other things, for operators with data centers in Japan and providers offering cloud services through servers located in Japan.
Use of certified services will not be mandatory. However, Nikkei projected that it would be difficult for these companies to choose uncertified services, as the government plans to directly examine and supervise the management practices of companies handling important personal information.
The government will also pursue legal amendments to support the system. It plans to submit a bill to amend the Economic Security Promotion Act to the regular Diet session in January next year, requiring companies that store or provide important personal information to give prior notification. The plan is to allow the government to issue suspension orders or recommendations if it determines that data storage poses a risk, and to operate the certification system under this law.
The certification criteria will draw on “JC-STAR,” a program run by the Information-technology Promotion Agency, Japan (IPA), which is under METI. The program assesses the security of Internet of Things (IoT) products such as network devices. It has no rules excluding specific countries, but no Chinese products have obtained certification to date. Starting next April, equipment connected to the power grid, including solar power generation and storage batteries, will also be required to meet JC-STAR Level 1 standards. Nikkei interpreted this, too, as a measure that effectively excludes Chinese products.
Japan is moving to manage its data infrastructure because the spread of generative artificial intelligence (AI) has sharply increased demand for data centers, heightening concerns about information leaks and service disruptions. Until now, Japan had no system governing data center and cloud operators responsible for storing and processing important data.
One risk factor cited is that Chinese companies may be subject to laws such as the National Intelligence Law, which requires cooperation with intelligence operations by Chinese authorities. Even if their servers are in Japan, it is difficult to guarantee data security if the operators are under the influence of a foreign government.
According to Japan’s Cabinet Secretariat, the Japanese cloud market exceeded ¥1.7 trillion (about 14.3 trillion won) in 2024. In the global market, U.S. companies Amazon.com, Inc. and Microsoft are leading the way, while China’s Alibaba Group is also expanding its presence.

[email protected] Seo Hye-jin Reporter