VSO announcements
VAP / VSO ·

VeritasChain files public comment on Japan PPC's draft security-measures guideline

On 11 November 2026, VeritasChain Co., Ltd., the company that operates the VeritasChain Standards Organization (VSO), submitted a public comment to Japan's Personal Information Protection Commission (PPC). The consultation concerns the PPC's draft amendment to the Guidelines for the Act on the Protection of Personal Information (General Rules), specifically the annex on security control measures (e-Gov case 240000133). The PPC accepts comments until 27 November 2026, 23:59 JST.

The comment does not name VAP, VCP or any other VSO specification, and it does not ask the PPC to adopt one. It asks a narrower question. When a business relies on its logs to investigate and report a data leak, can it show that those logs are complete and unaltered?

Technology-neutral; no adoption requested

The comment names no VSO specification or product and does not ask the PPC to adopt VAP or VCP. The PPC does not reply individually and may publish comments with submitter-identifying information removed. Submitting a comment does not mean the PPC agrees with it.

What the draft changes

The draft adds a new item to the technical security measures, 10-6(5), on detecting unauthorized access. Businesses must have measures in place in ordinary times to detect unauthorized access to systems that handle personal data early, and must operate them so that damage does not spread inside the internal network.

The example methods for this item include:

  • keeping logs, such as authentication, access, operation and communication logs, "for a certain period";
  • protecting those logs from leakage, loss, damage, alteration and unauthorized deletion;
  • analysing the logs periodically;
  • deploying monitoring tools such as IDS/IPS or EDR.

According to the PPC's overview, the PPC's existing Q&A already called for log protection, and the draft moves it into the guideline itself.

The guideline separates measures that must be taken from example methods. The PPC states that a business does not violate the law merely because it has not adopted every example method.

The seven points

1. Detect gaps after the fact. Restricting access to logs does not help when administrator privileges are compromised or misused. We asked for example methods that make deletion or alteration detectable afterwards:

  • give records sequence numbers and chain each one to the previous record by hash;
  • periodically record a digest of the whole log under a separate administrative authority, including third-party timestamps;
  • reconcile the two regularly.

We asked that the same apply to the system logs a business uses to confirm how it handles personal data, under item 10-3(2).

2. Define what is logged, and log failures. Integrity checks cover only what was recorded. We asked for three example methods:

  • document the scope of logging in advance;
  • record failed and denied attempts as well as successes;
  • pair each request with its outcome, so that a request with no recorded outcome can be found.

3. Time. Investigations reconcile logs from many systems, including systems run by contractors and cloud providers. We asked for example methods on clock synchronisation and a common time basis. Item 10-6(5) of the draft does not mention time.

4. Verification by someone other than the log keeper. In an incident, whoever holds the logs may have been compromised or may be involved. We asked that the material needed to check completeness be kept with the logs. It should be available to the business that outsourced the work or to an outside investigator, and outsourcing contracts should require that logs be delivered in a form that can be checked.

5. Retention versus deletion. Logs can contain personal data themselves, and gap detection makes a legitimate deletion look like a gap. We asked for two kinds of guidance:

  • how to keep personal data out of logs where possible;
  • how to delete expired log content without breaking the integrity checks, for example by encrypting the content and destroying the key, or by chaining only digests.

6. Non-human actors. The draft extends authentication to every "person who uses" a system that handles personal data. We asked whether this covers programs and AI agents. We also asked for example methods:

  • separate credentials for automated processes;
  • least privilege;
  • logs that record which process acted, on whose instruction or authority.

7. Smaller businesses. The simplified example method for small and medium-sized businesses mentions keeping logs but not protecting them. We suggested simple options, such as switching on the log retention and deletion-restriction features of the cloud services they already use.

Why completeness is the hard part

A log that has been edited is a problem. A log with a missing week is often a bigger one, because nothing in the remaining entries points to the gap. Chaining and external digests make that kind of gap visible.

These techniques have a limit, and the comment says so. No integrity mechanism can recover an event that was never recorded. That is why point 2 asks businesses to define in advance what they log. Without that definition, an empty log cannot tell "nothing happened" apart from "this was never recorded".

What VAP would not have done

VSO develops VAP, a metaframework for making records of AI and other automated processing auditable and attributable after the fact. The comment does not mention VAP, but its limits are worth stating plainly.

  • VAP does not stop unauthorized access, log deletion or data leaks. It works only after the fact and cannot intervene while a system is running.
  • VAP records are tamper-evident. Omissions are detectable only at anchor granularity, after anchoring. VAP cannot recover events that were never recorded at all, which the VAP specification calls "pre-measurement drop".
  • In the words of the VAP specification, VAP "does not warrant the correctness, fairness, or safety of the underlying AI decisions — only the integrity, completeness (at anchor granularity), and attributability of their records".

What happens next

The PPC does not reply to individual comments. It states that comments may be published with information identifying the submitter removed. Under Article 43 of Japan's Administrative Procedure Act, the PPC publishes the results when it issues the final text: the comments received or a summary of them, and how it took them into account. Submitting a comment does not mean the PPC agrees with it.

Disclosures

VeritasChain Co., Ltd. operates VSO. Because the comment is about verifying the integrity of records, the company has an interest in its subject. To date there is no independent external implementation of VAP, and no Evidence Pack has been accepted in any proceeding. VSO makes no claims about numbers of contracts, customers or revenue.

Sources

Related