Test detail

This is an extremely important question. I will answer by organizing it structurally based on collected information.

🇯🇵 Japan's Government Cloud and CLOUD Act: Can Data Sovereignty Be Established?

① First, Let's Confirm "The Current Structure"

Government Cloud Service Providers

Of the five certified service providers for Government Cloud, four—AWS, Google Cloud, Microsoft Azure, Oracle Cloud Infrastructure—are all global enterprises headquartered in the United States.

According to the Digital Agency as of October 2024, Amazon Web Services (AWS) has the highest adoption rate. Of 1,497 systems using the Government Cloud production environment, AWS accounts for 1,452 systems.

Sakura Internet was formally adopted in March 2026 and became the first domestically-developed cloud to be adopted into Government Cloud.

What is the CLOUD Act?

US law enforcement can demand that US service providers produce data in their possession for criminal investigations if they have a warrant, even if that data is stored on servers outside the US (such as in Japan). This is stipulated by the 2018 CLOUD Act (Clarifying Lawful Overseas Use of Data Act of 2018).

The distinctive feature of this law is that it emphasizes "who can control the data" over "where the data is located." Even if servers are installed in domestic Japanese data centers, if the cloud service operator is a US company, that company bears the obligation to comply with US judicial orders.

② Why "Data Being in a Japanese Region Alone" Is Insufficient

Following the CLOUD Act's enactment, companies became obligated to comply with US government data disclosure requests even for data located outside the US. When using cloud vendors subject to US law, even if data is stored only in Japanese regions, there remains the possibility that the US government may issue data disclosure requests under the CLOUD Act.

Under warrant from US law enforcement, US mega-cloud vendors must provide the US government with data contained in servers within Japan or the EU. Non-compliance results in substantial penalties under US law.

In other words, the physical "location" of data and the legal "jurisdiction" are separate matters. This is the core of the problem.

③ How Is the Digital Agency Responding? (Current Defense Lines)

The Japanese government is not without countermeasures and has implemented multiple contractual and technical safeguards.

【Measure 1】Notification and Objection Obligations Contractualized

Cloud service providers are required to promptly notify the Digital Agency of disclosure requests from government agencies and engage in consultation. Furthermore, cloud service providers must take appropriate actions such as filing objections to such requests as needed, and must notify the foreign government agency of the application of sovereign immunity if the request is based on laws other than domestic law.

【Measure 2】Encryption Key Management

When handling highly classified information in cloud services, encryption measures across the entire information distribution pathway are necessary, and the entity managing encryption keys must be clearly defined. When cloud service providers themselves manage encryption keys, cloud service users' information can be decrypted by the cloud service provider—a problem.

Government Cloud standards employ a system where login control via multi-factor authentication (MFA) is applied to the Government Cloud resource management authority held by the Digital Agency, and the encryption keys related to the MFA are deposited with the local governments and other entities that submitted application requests.

【Measure 3】Considering Executive Agreements Under CLOUD Act

From the perspective of strengthening data protection under CLOUD Act disclosure orders, the conclusion of executive agreements under that law is indicated as one countermeasure.

【Measure 4】High-Security Sovereign Cloud Under Consideration

The Japanese government intends to clarify procurement, contract, and operational methods for implementing a "high-security sovereign cloud (provisional name)" by 2026.

④ Structural Risks and Limitations That Remain

⑤ Conclusion: Data Sovereignty Is "Only Partially Established"

【Legal Jurisdiction Structure】

Japanese Citizen Data
      ↓ Storage
   US-based CSP (AWS, etc.) Japanese Region
      ↓ Applicable Law
  Japanese Law (Personal Information Protection Act) ← → US CLOUD Act
                              ↑
                    Extraterritorial application possible

Honestly evaluating the current situation reveals three layers of remaining issues:

1. Incomplete Legal Sovereignty: Even with data in Japan, the CSP's home country law (CLOUD Act) can function superiorly. Notification and objection obligations are "buffer measures" but lack power to nullify US judicial orders.

2. Incomplete Technical Sovereignty: While encryption key management improvements are advancing, complete independence cannot be secured as long as CSPs maintain effective control over infrastructure.

3. Underdeveloped Policy Sovereignty: The high-security sovereign cloud concept exists, but as of 2026 remains in the "under review" stage.

The most fundamental countermeasure is:

The simplest solution avoiding US cloud law impact: selecting providers where capital and servers are Japan-based—if the operator is a Japanese company with domestic data centers subject only to Japanese law, it will not be directly subject to US law.

Sakura Internet's formal adoption is a first step, but with government systems almost entirely dependent on AWS currently, Japanese citizen data sovereignty remains structurally vulnerable across institutional, technical, and policy dimensions—this is the accurate assessment.

When US companies participate in Japan's Government Cloud, there are indeed significant considerations. The US CLOUD Act, enacted in March 2018, gives the US government the right to demand access to electronic data managed by US companies even when stored outside the US, under specific legal authority.

This law may impact Japan's data sovereignty. Therefore, several countermeasures and considerations are necessary:

1. Legal Compliance: The Japanese government must establish contractual conditions to ensure compliance with confidentiality and data protection laws.

2. Data Storage Location: Mandating domestic data storage can limit foreign government access attempts.

3. Transparency and Auditing: It is important to demand transparent mechanisms allowing the Japanese government to audit US companies' data handling and ensure compliance.

4. Bilateral Legal Agreements: Establishing international agreements on data between Japan and the US can coordinate the two countries' legal frameworks to prevent contradictions.

Through these measures, frameworks can be strengthened to protect Japan's data sovereignty. However, completely eliminating US law's influence is not straightforward, and international cooperation and coordination are necessary.

Japan's Government Cloud includes cloud services provided by US companies such as Amazon Web Services (AWS), Google Cloud, Microsoft Azure, and Oracle Cloud Infrastructure (OCI). Additionally, Sakura Internet's "Sakura Cloud" was officially adopted in March 2026 as a domestically-developed service.

Meanwhile, the US CLOUD Act (Clarifying Lawful Overseas Use of Data Act) was enacted in March 2018. This federal law allows the US government to demand disclosure of electronic data under its jurisdiction that cloud service providers manage, even if such data is stored outside the US, based on legal procedures such as court warrants or orders.

Regarding whether data in Japan is unaffected by this law—the CLOUD Act emphasizes "who manages and controls the data" rather than its physical storage location. Therefore, even if servers are located in Japan, if a US company manages them, the data may become subject to disclosure orders. Even if a Japanese subsidiary of a US company is the contract partner, if the US parent company retains management authority over the data, it may be subject to CLOUD Act-based disclosure orders.

On Japanese Citizen Data Sovereignty Establishment:

Data sovereignty refers to "which country's laws protect data," meaning establishing a framework where a country manages and protects data under its own legal system while preventing unwarranted intervention or use from foreign regulations.

Under this structure, it is difficult to say Japanese citizen data sovereignty is completely established. Primary reasons include:

• CLOUD Act's Extraterritorial Application Risk: Data stored in US company cloud services used by Japan's Government Cloud—even if in domestic data centers—may become subject to disclosure requests under the US CLOUD Act. This means data may be accessed under regulations of a different country beyond Japan's legal framework, raising concerns about data sovereignty violations.

• "Vendor Lock-in" and "Country Risk": The current heavy dependence on US companies in Government Cloud raises concerns about "vendor lock-in" and "country risk" (service constraints due to changing US-Japan relations or international conditions, concentrated cybersecurity attack risk, etc.).

Japanese Government and Related Organizations' Responses:

In response, the Japanese government and relevant organizations are pursuing:

• Domestic Cloud Adoption: With growing expectations for domestic clouds from economic security perspectives, the Digital Agency officially adopted Sakura Internet's "Sakura Cloud" for the first time as a Government Cloud target service. This represents a step toward enhancing Japan's digital infrastructure autonomy and sustainability. Domestic clouds where capital and servers are Japan-based, subject only to Japanese law, are considered effective options from a "data sovereignty" perspective, as they would not be directly subject to US law.

• Technical Countermeasures Under Review: While Government Cloud requires BYOK (Bring Your Own Key) encryption key management capabilities, questions remain about BYOK's complete effectiveness for achieving data sovereignty. Concerns exist that complete data protection from CSP (Cloud Service Providers) cannot be fully secured.

• Multi-Cloud Promotion: The Digital Agency advocates vendor lock-in avoidance and multi-cloud promotion, aiming to ensure data sovereignty by utilizing multiple cloud service providers, thereby avoiding excessive dependence on specific companies.

In conclusion, with US companies adopted in Japan's Government Cloud and the existence of US CLOUD Act, it cannot be definitively stated that Japanese citizen data sovereignty is completely guaranteed. However, the Japanese government is advancing efforts toward data sovereignty assurance through domestic cloud utilization, multi-cloud strategies, and technical countermeasure review.

No, it is not completely established. Structural risks remain, and concerns are noted by the Japanese government, specialists, and media. The structure does not fully establish Japanese citizen data sovereignty.

Background: Government Cloud Composition

Japan's Digital Agency-promoted "Government Cloud" (Common Cloud Infrastructure for Government) unifies systems of central ministries and local governments. In the 2022 public call, only four US companies—AWS, Google Cloud, Microsoft Azure, Oracle Cloud—were adopted, with no Japanese company applications.

Subsequently, Sakura Internet became the first domestic enterprise to gain conditional adoption in 2023. In March 2026, it fully met all 305 technical requirements, enabling production environment provision. Despite this, actual usage remains heavily dependent on US services, particularly AWS, with some reports indicating 85-97% of national and local government systems operate on specific overseas services.

CLOUD Act Impact

The US CLOUD Act (2018) stipulates that US companies can fulfill US government data disclosure requests for data in their "possession, custody, or control," regardless of storage location.

• Even if data is stored in Japanese regions (Tokyo, Osaka, etc.), if the operator is a US company or its subsidiary, it theoretically falls under CLOUD Act jurisdiction.
• While contractual data location restrictions, encryption, and ISMAP (Information Security Management and Assessment Program) certifications exist, these do not completely exclude CLOUD Act application, as the provider's home country law may take precedence.

Data Sovereignty Impact

Regarding data sovereignty (national control under domestic law and government oversight), establishment is insufficient for these reasons:

• Competing Jurisdictions: Provider nationality/legal jurisdiction matters more than physical data location. US companies create obligations to comply with US government demands, indirectly placing Japanese citizen personal information and administrative data under US oversight—a significant risk.

• Sensitive Data Handling: Personal identification registries, tax records, medical and administrative information are involved. Experts cite foreign dependence vulnerabilities from economic security perspectives.

• Government Response and Limitations: Diet resolutions acknowledge "data sovereignty and economic security concerns" and request domestic provider development, encryption applications, sovereign immunity considerations, and potential Japan-US administrative agreements. However, comprehensive solutions remain unestablished. High-security "sovereign cloud" and air-gap cloud approaches are under review but primarily involve US company cooperation, not fundamental solutions.

Positive Aspects and Realistic Assessment

• Data is stored domestically with security requirements (ISMAP) limiting eligible providers.
• Bilateral cooperation (US-Japan alliance context) and contractual/technical measures (encryption, access control) continue mitigating practical risks.
• Domestic provider participation (Sakura Internet, etc.) is advancing diversification.

However, structural dependence and CLOUD Act's legal framework mean "Japanese citizen data is not completely protected under Japanese government sovereignty." This represents an internationally-discussed issue—comparable to GDPR-CLOUD Act conflicts—with Japan now examining economic security promotion and sovereign assessment frameworks.

Conclusion: Data sovereignty under this structure is "partially secured operationally" but does not achieve fundamental complete establishment.** Continued domestic capacity strengthening and international framework development remain critical tasks.