The Japanese government plans to establish a new safety certification system for data centers and cloud services, requiring companies that handle critical personal information to use certified providers, the Nikkei reported on October 20.

Related ministries, including the Ministry of Internal Affairs and Communications and the Ministry of Economy, Trade and Industry, plan to introduce the certification system starting in fiscal 2027 for data center operators in Japan and cloud service providers with servers located within the country.

Evaluation criteria for the certification are expected to include the operator's corporate information, risk management systems to prevent data leaks, and equipment procurement sources.

Financial institutions, medical facilities, and research institutes handling sensitive personal information related to national security will be advised to contract with data center or cloud providers that have received this certification.

At the same time, a prior notification system will be introduced for companies that store and provide important personal information, and related laws will be revised to allow the government to issue suspension orders or recommendations if data storage poses risks.

While whether to use certified data centers or clouds is up to corporate discretion, Nikkei noted that for companies under government regulation and oversight, choosing uncertified services will likely be difficult.

This measure is interpreted as essentially aimed at excluding data centers and cloud services from countries such as China.

With the rapid spread of generative artificial intelligence (AI) increasing demand for data centers, plans for new construction are gaining momentum within Japan.

According to data from Japan's Cabinet Secretariat, the Japanese cloud service market exceeded 1.7 trillion yen as of 2024.

Amid this situation, alongside U.S. companies Amazon.com and Microsoft (MS), China's Alibaba Group is emerging in the global cloud market.

Previously, there were no systems regulating information infrastructure operators that store and process critical data, such as data centers and clouds. Critics have pointed out that if information infrastructure under the influence of concerned countries like China spreads, it would be impossible to prevent data leaks caused by cyberattacks in times of emergency.

Furthermore, it has been pointed out that companies established with Chinese capital risk being subject to Chinese laws, meaning data could be handed over to the Chinese government at any time under Chinese law.

(Photo: AP, Yonhap News)