Reading Japan's Technology Leakage Guidance, Second Edition (Part 1 of 2)

Hello, this is Ryuta Hamamoto from TIMEWELL. If you have opened METI's Technology Leakage Prevention Guidance and found yourself facing 182 pages of slides with no idea where to start, you are not alone.

I have split this walkthrough in two. Part 1 covers the aims and stance in Chapter 0, the common measures in Chapter 1, overseas production sites in Chapter 2, and leakage through people in Chapter 3. Joint research in Chapter 4, supplier coordination in Chapter 5, the reference section on the research security procedure, and a suggested order of work for a small company are in Part 2.

I wrote this after reading the original through. Each factual statement carries a footnote with the chapter, section, and page. The page numbers match both the position in the PDF and the number printed at the bottom right of each slide.

The big picture, and how to read Part 1

The official title is "Technology Leakage Prevention Guidance, Second Edition." It is issued by the Trade and Economic Security Bureau of METI.¹ The original does not give a publication date or the date of the First Edition. I describe it as published in April 2026.

The chapters are organized by route of leakage, so you can start with the route that concerns you most.²

Route of leakage	What happens	Chapter
All routes	Management involvement, a coordinating unit, deciding what to protect	Chapter 1
Overseas production sites	Production know-how leaks through joint ventures, contract manufacturers, subsidiaries	Chapter 2
Leakage through people	Removal of data, job changes, approaches, mistakes	Chapter 3
Joint research	Leaks through research partners or participants	Chapter 4
Supplier and customer coordination	Leaks while adjusting specifications with suppliers, customers, equipment makers	Chapter 5

Chapters 2 to 5 share a similar shape. Case studies of leakage come first, followed by what to do at the planning stage, the contract stage, the execution stage, and the ending stage. The people chapter is organized differently, into measures to prevent leakage in advance, measures after a leak, and measures regarding the departure of engineers.²

Chapter 0: what the guidance asks, and what it does not

Chapter 0 is the premise you need before reading the measures. It is short, but it contains several statements that prevent misreading.

On the aim, the document says technological superiority is essential for economic security and for a company's ability to win in international competition. It notes that states are moving more actively to obtain advanced technology held by companies of other countries, and that in METI's interviews with industry many companies said they face leakage risk. Leakage takes many forms, such as technology transfer as a service, loss of personnel, acquisitions, and improper acquisition of technical information, and the methods are becoming more sophisticated.¹

On regulation, METI says it is strengthening rules, including the dialogue scheme on technology management under the Foreign Exchange and Foreign Trade Act. But as routes multiply and methods grow subtler, it is not realistic to block every leak by regulation. Companies that think "complying with the rules the state sets is enough" should drop that idea immediately and strengthen voluntary efforts to protect their own interests and credibility.¹

The document also warns against shrinking back out of fear. Overseas sites, diverse talent, and partnerships with strong foreign companies are essential for growth, and a company that fears leakage too much will not survive international competition. Countermeasures are treated not as a mere cost but as an investment that reduces future losses and supports sustainable management.¹

The guidance sets out four points about its own stance.¹

First, the measures are not obligations. It says explicitly that it does not explain duties under the Foreign Exchange and Foreign Trade Act or the requirements for trade secret protection. Second, it is meant to be used in public-private dialogue, as a reference when companies and the government discuss and consult, including under the technology management dialogue scheme. Third, it does not demand perfection. No perfect countermeasure exists, and however much a company does, it cannot completely prevent leakage. Small and medium-sized companies in particular face limits on resources, so it is desirable to reliably carry out the measures they can. Fourth, it will keep being revised and extended.

The fourth point states where the Second Edition fits. The First Edition focused on leakage tied to overseas production sites, which is the target of the technology management dialogue scheme, and on leakage through people. The Second Edition updates that content and adds joint research and supplier coordination as transactions that involve handing technology to others. For competitive research funding programs where results are meant to be published, certain designated programs require risk management under a research security procedure compiled by a Cabinet Office expert panel, so the document sets out the correspondence as reference material.¹

The original does not include a mark or list showing whether each item inside a chapter is new in the Second Edition or revised from the First. So from this PDF alone I cannot say "this item was added in the Second Edition." If you need the exact differences, compare it directly with the First Edition.

A word on related documents. According to a note in the original, the Trade Secret Management Guidelines set out the minimum level of management needed for protection under the Unfair Competition Prevention Act, and the Handbook for Protecting Confidential Information introduces a variety of measures.³ The Technology Information Management Certification (TICS) is a scheme operated by the government under the Industrial Competitiveness Enhancement Act, in which a company works with guidance from a certification body and its status is objectively reviewed and certified.⁴ It helps to think of the guidance as a menu of options that sits in front of these.

After Chapter 0, check these points in your own company.

1. Do we treat complying with export and other regulations as the same thing as preventing technology leakage?
2. Are we stalled because we try to do everything? Have we decided the scope of measures we can carry out?
3. Does management know the priorities, rather than leaving everything to staff?

Terms to know first

A run of technical terms can drain the energy to read on. Here are the main ones. The everyday analogies are mine.

Term	Meaning	Everyday analogy
Core technology	The technology that is the source of a company's competitiveness	The secret recipe that defines a restaurant's taste
Trade secret	Information kept secret, useful to the business, and not publicly known	A recipe locked in a safe
Secrecy management	The reality that you actually manage it as secret	Locking it away and deciding who can touch it
DD	Due diligence: investigating a partner before a deal	Viewing a house before renting it
Least privilege	Give access only to those who need it	Kitchen staff do not get the key to the accounts safe
Black-boxing	Hiding manufacturing methods or sourcing from a counterparty	Peeling the names off the spice jars
Non-compete covenant	A promise not to take a competing job after leaving, within limits	A chef promising not to open an identical restaurant next door
Suriawase	Adjusting specifications and processes together with a business partner	Planning a custom-built house with the builder

Chapter 1: measures common to every route

Chapter 1 is the foundation under every route in the later chapters. It has three parts: management involvement, a coordinating unit, and identifying what to protect.

Management leads, and a unit acts as the command post

The document says it is not appropriate to leave economic security risk response to the judgment of frontline staff, because it can mean decisions that run against short-term profit and even major changes in strategy. Executives should position it as an important management matter and lead it themselves. They should first refer to METI's Economic Security Management Guidelines and build a company-wide structure.⁵

The role of management is described in three parts: awareness, strategy, and structure and dialogue. For example, recognize that managing core technology is a management issue tied directly to superiority and indispensability; account for the risk of know-how leaving through acquisitions and capital alliances when setting capital policy; and explain countermeasures to key stakeholders in normal times.⁵

On the coordinating unit, the original does not prescribe a form. Using or expanding an existing department is fine, as is creating a dedicated one. Overseas expansion and joint research cut across business units, R&D, legal, intellectual property, and HR. To stop projects from moving forward without a leakage risk assessment, you need a cross-functional unit that gathers and manages information on such deals. The unit should take part in review and approval procedures so its judgment is not ignored, and should also be involved in contact and response during emergencies.⁶

The common stumbling block is creating the unit without giving it authority. The document says the top executives should be involved so that the unit has strong leadership and its judgment is respected.⁶

As a reference, the document also introduces METI's Cybersecurity Management Guidelines, with three principles for executives and ten key instructions for the responsible officer, against the background of rising cyberattacks aimed at technical information.⁶

Identify and evaluate the technology to protect

If you have not decided what to protect, measures miss their mark. The document recommends sorting the importance of technology into four areas.⁷

They are core technology that is the source of competitiveness; technology of importance to security, with potential for military diversion; technology important to economic security; and technology the company does not hold but wants to acquire.

The second area includes technology on the Foreign Exchange and Foreign Trade Act control lists, which calls for especially careful handling together with classification procedures. The third covers technology important for securing the autonomy and indispensability of Japan's economic activity, where sanctions and trade suspensions by third countries also call for attention. The fourth is technology to be obtained through activities such as joint research while balancing countermeasures against innovation, which requires care about reputational risk and conflict with third-country law.⁷

Identifying core technology proceeds in this order. Confirm what customers value in your products, analyze the element technologies that make that possible, and identify them as core technology. Next, check whether companies in other countries already hold it or could easily develop it, and look at future prospects and indispensability in the supply chain. Finally, confirm where and in what form the technology exists. It may be in drawings or formula data, in engineers' experience and know-how, or embedded in customized manufacturing equipment. Software and data are easy to copy, hard to trace, and hard to retrieve once leaked, so they need particular care. Involving frontline engineers in the process also raises awareness across the organization.⁸

As reference, the document lists many sources for identifying technologies related to security and economic security. They include technologies on the Foreign Exchange and Foreign Trade Act control lists and the key-control technologies, technologies in industries subject to prior notification under inward direct investment screening, specified technology fields under the patent non-disclosure system, twelve key technology fields in the 2023 defense technology guideline, technologies subject to the U.S. Export Administration Regulations, and the EU dual-use regulation. It also cautions that even Japanese companies may face re-export or deemed re-export controls when disclosing technology subject to U.S. rules.⁸ The idea of deemed exports is covered in detail in our article on deemed export risk.

Choose between patenting and keeping secret

There are two ways to protect technology: acquire rights such as patents, or keep it secret. The document treats this as a management judgment but warns that deciding without considering the technology's characteristics and competitors' development trends can cause you to leak what should have been protected.⁹

In general, things like composition or shape, where infringement is easy to detect, are often patented, while know-how in manufacturing methods, where infringement is hard to detect, is often kept secret. Because patent filings are published, you need to avoid writing related technology you want to keep secret in the specification. The document also touches on securing evidence to claim prior-use rights in case another company files a patent on leaked technology.⁹

Manage trade secrets rigorously

Important technology that you neither patent nor publish should be managed as a trade secret. The document says that, to be able to respond under the Unfair Competition Prevention Act, you must at minimum apply secrecy management measures at the level required for legal protection. Because legal protection may only recover damage after the fact, it adds that you should go beyond the minimum and take every measure possible.³

Three examples are given: manage information so that secrecy management is recognized; classify secret information by the same level of management (top secret, confidential, internal, and so on); and, with litigation in mind, introduce systems that preserve objective evidence. For documentation, notarization and timestamping are listed as options.³

After Chapter 1, check these points in your own company.

1. Have we evaluated our technology once from three angles: source of competitiveness, security importance, and economic security importance?
2. Does our core technology live only in drawings and data, or also in people's heads and equipment settings?
3. Do we classify secret information, such as top secret or internal, and vary management by class?

Chapter 2: leakage tied to overseas production sites

Chapter 2 assumes a Japanese company that produces or develops products overseas. The typical cases are a joint venture with a subsidiary or local company, or production commissioned or technology licensed to a local company.¹⁰

The document depicts four entrances to leakage: an executive dispatched by the joint venture partner accesses and takes technical information; a subsidiary's lax information management lets local staff take it; a contract manufacturer's lax management lets it leak; and system administration left to the local site leads to a cyberattack.¹⁰

From the case studies

There are five cases. I summarize them within the facts the original gives, leaving out company and country names.¹⁰

The first is a mid-sized company that licensed technology. Unfamiliar with international business, it accepted the other side's explanation of local law and practice without scrutiny, did not examine the contract, and did no monitoring of the licensee. A few months later it found the licensee's subsidiary making its own product with the licensed technology. The licensee said this was "within the contract," and by then the damage could not be undone.

The second is a joint venture set up on a 50-50 basis. Afterward the partner told the company that, because of domestic-production policy, it would be treated as a foreign maker unless the partner held a majority, and demanded a change in the shareholding. The company had already invested heavily, could not easily withdraw, and ended up yielding management control.

The third is an overseas subsidiary whose employees left one after another, many joining local competitors. Some had taken drawings on departure and kept inducing former colleagues to supply information. The company considered a suit under local unfair competition law but concluded it was difficult, because its trade secret management had been sloppy and evidence was insufficient.

The fourth is a withdrawal. Manufacturing equipment embodied important technology, but it had become the partner's asset at the time of investment, so it could not be scrapped, and the partner took it over.

The fifth is contract manufacturing. The company supplied the core parts itself and outsourced only final processing and assembly, but a few months later the contractor began selling a similar, cheaper product. It had reverse-engineered the supplied parts.

The common thread is that loose contracts and management show up later in forms that cannot be reversed. The third case carries a particular lesson: even if you try to fight legally after a leak, you cannot prove your case if everyday trade secret management was weak.

The planning stage

There are six items to address before and during planning.¹¹

First, establish information management in the Japanese head office. What the head office cannot do, overseas sites cannot do either. Set a company-wide information management policy that covers overseas sites, add rules for the use of AI, and update training and pledges regularly.

Second, check the other country's systems. Depending on the country, a company may be required to disclose technical information under safety, environmental, or competition law, or may have equipment seized in a crisis. Points to check include whether technical data may have to be submitted to public bodies, whether engineers may be detained, whether favorable terms for domestic firms may be forced, whether high foreign ownership leads to disadvantage in subsidies or procurement, whether drawings must be filed in local litigation and become public as part of the record, and whether laws impose a duty to cooperate with a foreign government's information gathering. The document suggests using lawyers, having small companies draw on trade associations and public bodies, and considering consultation with METI when unsure.

Third, check the other country's technological interests. As countries pursue domestic production and technological advantage, leakage risk rises in fields where the government drives localization. It is inefficient for each business unit to research this separately, so build a cross-company structure to gather information.

Fourth, check labor law, customs, and employment conditions. What is common sense in Japan often does not hold elsewhere, so explain from the basics. In countries with high job turnover, the chance of leakage through staff moving jobs is relatively high, so judge the scope of technology transferred carefully.

Fifth, due diligence on counterparties. For joint venture partners and contract manufacturers, check information management rules, the responsible department, training, access controls, past leaks, and monitoring for improper handling. Where a counterparty falls short of your own level, ask them to build the needed controls and sign the contract only after they are in place.

Sixth, explain in advance to stakeholders. Investment and loan agreements may require prior approval for overseas technology transfer, so check the contracts first, then explain leakage risks and countermeasures to investors and lenders.

The contract stage

There are five items.¹²

Make the technology to be provided clear in the contract, in content and scope. Sign an NDA before negotiations begin, and until the final contract provide only the minimum needed to assess feasibility. Specify the means of provision, such as the medium, and sign a new contract if more than the original scope becomes necessary. Prepare internal guidelines so that staff can judge correctly whether technology may be provided.

Clarify the rules for handling. Limit who may handle the information, prohibit unauthorized sublicensing, subcontracting, and reverse engineering, and include an audit clause. When dispatching employees through contract manufacturing or a joint venture, prohibit the counterparty from poaching your employees. The document tells readers to keep in mind that contracts are not always observed and to pay attention to implementation as well as wording.

Decide in advance what happens when circumstances change. Issuing shares that change control, entering a competing business, changes to the information management system, deteriorating credit, and applications to the other country's government for subsidies are set as items requiring prior approval or notification, or as grounds for termination. If the other country's authorities order a report on technical information or conduct an on-site inspection, require notification and provide for halting and recovering the technology.

Decide post-termination procedures too. Dispose of recording media yourself, or at least be able to choose the disposal contractor, and make confidentiality survive termination. An arbitration clause is also useful, to keep technical information from becoming public through litigation records.

For a joint venture, secure governance. Hold a majority of equity, hold the right to nominate directors, make acts that risk leakage subject to a veto (technology transfer deals, changes to information management rules, poaching engineers), and set conditions for dissolving the venture if the partner breaches.

The relationship between overseas sites and information systems is also covered in our article on cyberattacks and export control.

The execution stage

There are four items.¹³

First is staged provision of technology. Start with basic information and release important information as the project progresses and trust develops. Keep contract terms short, such as six months to a year, and renew them, and where renewal is automatic, review the contract against audit results at renewal.

Second is black-boxing information. Code-name production processes and raw materials and use those names in daily work, with the correspondence table held by a few responsible people. Prepare a separate version of drawings sent overseas with highly confidential information removed. Because knowing the source of parts can invite approaches to those suppliers, keep sources off documents and avoid company names on packaging.

Third is information management after providing technology: set policies, manage access rights, manage a list of what was provided (content, timing, method, with control numbers for distributed documents), divide know-how so it is not all in one place, and audit compliance on site.

Fourth is equipment maintenance. Equipment can embody know-how through customization, and even the type, layout, and manufacturer of equipment can be sensitive. Have engineers from the head office or equipment maker carry out maintenance as far as possible. Where local companies must be used, confirm they are trustworthy, limit areas and electronic devices, conceal adjacent processes, make important spare parts in house, and observe on site.

The withdrawal stage, and other matters

Withdrawal is when local staff can easily move to competitors and leakage is hard to notice. The document gives three tasks.¹⁴

First, manage information according to the withdrawal plan: set a policy for handling information, reset access rights as operations shrink, strengthen monitoring for unnatural downloads, and review confidentiality agreements with local employees. Second, dispose of manufacturing equipment, sorted into general-purpose equipment used as is, general-purpose equipment with settings adjusted in house, and dedicated equipment built or ordered specially. Equipment embodying core technology is returned or scrapped, and general-purpose equipment can be sold. Do not leave scrapping to a contractor; select the contractor carefully and be present on site yourself. Third, follow up after withdrawal: regularly check whether local competitors have launched similar products, where former staff have moved, and whether related patents have been filed locally, and keep relations with partners. If a problem is found, respond promptly and firmly, including through litigation.

Among other matters, for companies with overseas R&D sites the document covers control of technology transfer between sites. Transfers from Japan to overseas are easy for head office to govern, but transfers between overseas sites may slip through, risking leakage and violations of export rules. A site holding core technology should be managed to the same standard as in Japan, and technology transfers should be reported to head office for approval.¹⁵

After Chapter 2, check these points in your own company.

1. Can we explain the scope of technology given to overseas sites and contractors, in the contract and in what was actually provided?
2. Does any equipment or drawing embody our core technology? Who would dispose of it on withdrawal?
3. Is there a way to learn when a counterparty's shareholders or controls change after the contract?

Chapter 3: leakage through people

Chapter 3 applies across the widest range of any chapter in the guidance. The document says countermeasures through people matter regardless of company size or business type, and that overseas transfers and joint research also leak through people at those sites, so the chapter should be consulted for other business scenarios too.¹⁶

It is not only about regular employees

The document uses the term "officers and employees" for those who handle technical information. It includes not only regular employees (managers included) but also directors without an employment relationship, temporary agency staff, secondees, freelance contractors, and former employees. Leakage prevention should be written not only into work rules but also into employment contracts, mandate contracts, secondment agreements, and service contracts.¹⁶

Measures to prevent leakage in advance are organized in four layers: rules, personnel, systems, and operations on the floor. It repeats that doing everything in every layer is hard on resources, so one should vary effort with the importance of the technology and the size of the company and reliably carry out what is feasible.¹⁶

From the case studies

The people chapter also has five cases. I summarize them anonymously, within the facts given.¹⁶

The first is exchange on social media. An engineer received a question about their company's product technology from a person at a foreign company through a social media account registered under their real name. Pleased to be noticed, they answered, even disclosing non-public information. Dissatisfied with their pay, they handed over important technology on the condition that the other side would send information in return, but nothing came back. A coworker found it suspicious and reported it internally, which exposed the leak. The engineer was dismissed and criminally charged. The fact that a coworker's report triggered discovery shows how much it matters to have a culture where reporting is easy.

The second is an executive's job change. An executive who had been offered a job by a foreign company they met through work saved a large volume of design information to a USB drive before leaving. The new employer developed a competing product from that information and gained market share. An internal audit found the removal of the data.

The third is contact over a meal. An employee who struck up a conversation at a restaurant with an official of a foreign government agency grew close to them. At first the requests concerned public information, then gradually important technical information. Having already accepted meals and gifts, the employee could not refuse and provided it.

The fourth is an overseas trade show. An exhibitor asked by a company that said it wanted to buy handed over a copy of design drawings, hoping for a new sales channel. A year later a similar product was circulating at a lower price.

The fifth is improper disclosure by an employee. An engineer moved to a local university with close ties to a foreign company as a visiting professor, disclosed technical information in lectures, and was offered a large sum by that company. Some inside the company worried that publicity would harm its image, but it decided to respond firmly, sued for damages, and settled with a payment.

None of these cases teaches that a particular country or company is dangerous. What the cases show is that the motives are ones anyone can have, such as dissatisfaction with pay, curiosity, a wish for recognition, and difficulty saying no; that once contact begins, the flow cannot be stopped; and that discovery came from internal mechanisms, such as a coworker's report and an internal audit. Motives behind outside approaches are also covered in our article on why people are recruited for espionage.

Rule-based measures

There are two.¹⁷

One is setting information management rules and applying them thoroughly. Besides the information management policy, individual contracts such as employment or mandate contracts should also make all officers and employees bound by confidentiality. To prevent rules from becoming empty, collect opinions from the front line when drafting or revising them. IT, HR, legal, IP, and audit units cooperate to run training, handle concerns, and revise rules as an organization, and management shows that this is an important management matter.

The other is auditing information management regularly and reflecting results in staffing of important projects. Report results to management and use them to update rules and training. In individual staffing too, treat information management as one of a person's important skills, and when assigning someone to work on important technology consider their record of misconduct that could lead to leakage and their results on learning tests. People assigned should be told about, and agree to, strict confidentiality obligations that continue after retirement.

Personnel measures

There are five.

Training should be regular and tiered. Include recent and familiar cases, use role-play, and vary content by position and department. Having people sign a pledge at each session to keep confidentiality is useful for awareness. The same applies to temporary agency staff and secondees from business partners who may touch your technical information.¹⁷

Checks at hiring have two aspects. One is where your technology may be subject to export control under the Foreign Exchange and Foreign Trade Act, since providing technology to non-residents and to certain residents who fall into specified categories can be subject to deemed export control, so confirm whether they apply. The other is that if a mid-career hire brings in the previous employer's trade secrets, your company may be accused of misappropriation. Confirm the previous employer, the work, and the person's attitude toward information management in interviews to prevent that. On checking nationality for roles that handle important technology, the document refers readers to the Ministry of Health, Labour and Welfare's guidance on fair hiring. It explains that collecting matters beyond an applicant's responsibility, such as nationality, can lead to discrimination in hiring, but that where there is individual reasonableness and necessity, such as a special occupational need, it is not necessarily inappropriate.¹⁸

The check at assignment to a department handling important technology, called a suitability check, is the item to handle most carefully. The original sets detailed conditions.¹⁸

It applies only to technical information requiring a high degree of secrecy, especially technology with potential for military diversion and technology important to economic security. Examples of cases include where it is needed to comply with law (for instance, foreign export control law restricts providing to employees of a certain nationality, or a business partner requests it) and where the loss from a leak would be extreme. Because collecting information touches privacy, the company should seek the person's understanding and limit collection to what is necessary and reasonable. Examples of items are the person's information management record in the company, whether they bear a legal duty to cooperate with a foreign government's information gathering, their relationship to foreign governments, convictions related to handling information, and past misconduct in handling information. Yet the document says it is rare that any single fact decides an assignment, and it asks for a comprehensive and objective evaluation together with other items, work performance, and track record. In the Cabinet Office Q&A it carries as reference, a deep relationship with a foreign country alone does not immediately mean a person is judged unsuitable.

There are strong limits on how results may be used. This evaluation checks whether the person is unlikely to leak important technology; it is not a personnel evaluation or a proof of ability. It must not be used for personnel evaluation, dismissal, discipline, pay cuts, demotion, or disadvantageous reassignment. The company must comply with Article 3 of the Labor Standards Act, which prohibits discriminatory treatment in working conditions on grounds of nationality, creed, or social status, and with the Act on the Protection of Personal Information, which requires specifying and stating the purpose of use and obtaining consent for sensitive personal information. It must also tell the person clearly that this differs from the government's suitability assessment under the Act on the Protection and Use of Critical Economic Security Information. A consultation desk separate from the evaluating unit is also recommended.¹⁸

A common stumbling block is failing to explain in advance that the result of not obtaining consent may be that the person cannot be assigned. The document asks companies to find ways to help people understand beforehand that if consent is not obtained or if the evaluation finds a risk of leakage, they may not be able to work on tasks needing access to important technology and may be reassigned.

Side jobs and concurrent work can send technical information to the other employer, so set clear rules in internal regulations and require prior notification. Judge permissibility by whether the person handles key technical information and whether there is a competitive or business relationship. One example is periodically checking whether employees are registered on spot-consulting platforms.¹⁹

On non-compete covenants, the document treats them as important for preventing leakage after departure, but notes they may restrict freedom to choose an occupation and so must stay within what is necessary to protect the company's legitimate interests. Courts look at the person's position, the geographic area of the new employer, the duration, the scope of prohibited competing activity, and whether compensation is provided. Regarding the relationship between work rules and individual pledges, it explains that stating the principle in work rules and giving priority to any individually agreed terms avoids a problem under Article 12 of the Labor Contract Act.¹⁹

System measures

There are five.²⁰

Access control follows the principle of giving rights only to those who need to know. When people move, change jobs, or leave, reset rights immediately, with close sharing of information with HR. Beware of directors without rights who use their position to make staff disclose important information. Separating print rights from view rights, and limiting the period of access, are also listed.

For access restrictions at departure, limit the work of anyone who has given notice to the minimum needed for handover, and remove data access and entry to secure areas. Analyze their access logs more strictly than usual, going back several months, and interview them before departure if signs of leakage appear. Return of loaned items and an explanation of post-departure confidentiality duties and legal measures for breach are also covered. The original cautions that a post-departure confidentiality pledge may be found unreasonable by a court if it neither defines nor gives examples of what is protected, so everyday trade secret management is a prerequisite.

Device management starts from the company owning and lending work devices and controlling them. Prohibit taking them on trips unrelated to work, such as personal overseas travel. Enable remote data wipe for loss or theft, and prohibit copying to USB drives, or limit it to approved, company-owned media.

For software and social media, because providers of search engines and generative AI may retain what users enter, set usage rules such as not entering key technical information into prompts. The approach is not just to ban, but to restrict data use by contract and create a negative list of tools of concern so the environment is as safe as possible. Also set up a check of your own information on social media and a reporting route for suspicious approaches.

For detection and warning, set up a way to detect unusual behavior, such as bulk printing or downloads, frequent late-night or holiday access, or sending data to free-address accounts, and announce that detection exists to deter. The document cautions that monitoring a company network calls for care about privacy, and must be necessary and reasonable for running the business, not excessive control or restraint.

Operational measures

There are three.²¹

Dividing processes limits the number of people who know the entire process. Narrow what each person can learn. Since some people must know the whole, list and track them, give them pay that fits the responsibility, and pay particular attention to any suspicious approaches to them.

For overseas trips and postings, the document lists resetting access rights, rules for taking devices, and counterintelligence training. A posted employee who keeps accessing systems in Japan can leak through that device. For trips to regions judged high risk, prohibit taking the usual device or make it subject to approval, and, if work requires, prepare a trip device that cannot reach core technology and can be wiped or blocked from Japan if lost. Issue a new work device for long trips or postings. Since the kind of approach in the case studies is more likely for travelers and posted staff, give training on preventing leakage through intelligence activity.

At trade shows and similar events, do not give out engineers' personal contact details, and prepare business cards with a dedicated trade-show work email address. Encourage staff to report recruiting approaches from other companies, decide how far technical questions may be answered, and check in advance the materials and exhibits to be shown.

When a leak occurs, and when engineers leave

When a leak is suspected, the document says to investigate promptly, pursue not only disciplinary action but also civil liability and liability for breach of contract under the Unfair Competition Prevention Act, and consult the police on criminal liability. Many companies, fearing reputation damage, hesitate over criminal complaints and handle matters quietly. Its reasoning is that a firm response is proof of everyday trade secret management and raises the trust of business partners and shareholders. It also notes that the 2023 amendment clarified that when a Japanese company's trade secrets managed in Japan are misappropriated abroad, a suit under the act can be brought in a Japanese court. Afterward, prevent recurrence through cause analysis, review of rules, and thorough training and audits.²²

Chapter 3 closes with the departure of engineers themselves. Because leakage cannot be stopped entirely, it calls continuing to innovate so that leaked technology quickly becomes obsolete "the greatest countermeasure." The move of an excellent engineer to a competitor weakens competitiveness even without any trade secret leak. List engineers close to core technology tied to that technology, and treat them well through executive-level positions, incentive pay, awards, and engineer communities, and provide retirement-age extension and rehiring for veteran engineers. Keep good relations with former employees through alumni associations and newsletters, to warn them and keep track of their movements.²³

Reading this together with our article that connects the people-related stages gives you the flow from hiring to departure.

After Chapter 3, check these points in your own company.

1. Do confidentiality rules and training reach people other than regular employees: agency staff, secondees, contractors, directors?
2. Is there a procedure to review access rights and several months of logs for someone who has given notice?
3. Are there rules on engineers' personal contact details and the devices they carry at trade shows and on overseas trips?
4. Is there a culture and a channel for reporting suspicious contact internally?

Summary of Part 1, and a guide to Part 2

In a sentence, Part 1 says technology leakage countermeasures do not end with complying with regulation. Management leads, decides what to protect, and combines layers of contracts, people, systems, and operations. The stance of the original is not to aim for perfection but to reliably advance the measures you can.

Part 2 covers Chapter 4 on joint research, Chapter 5 on supplier coordination, and the correspondence to the research security procedure, and sets out, based on the original, the order in which a small company might begin. Please continue with Part 2.

References

Footnotes

1. Ministry of Economy, Trade and Industry, Trade and Economic Security Bureau, Technology Survey and Leakage Prevention Office, "Technology Leakage Prevention Guidance, Second Edition" (published April 2026), Chapter 0, Section 1 "Purpose of this guidance," pp. 4-5. The original gives no public URL, so none is shown here. The original gives no publication date. In Japanese. ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶

2. Same document, Chapter 0, Section 2 "Routes of technology leakage and structure of this guidance," pp. 6-8. Chapter details are based on the table of contents and structure listing. ↩ ↩²

3. Same document, Chapter 1, Section 2 (4) rigorous trade secret management, p. 22. The positioning of the Trade Secret Management Guidelines and the Handbook for Protecting Confidential Information is from the note on the same page. ↩ ↩² ↩³

4. Same document, Chapter 5, Section 4 "Matters to address when working with parties outside the supply chain," item 2, note on the Technology Information Management Certification, p. 174. ↩

5. Same document, Chapter 1, Section 1 "Building an organization and risk management," (1) leadership and action by management, p. 11. ↩ ↩²

6. Same document, Chapter 1, Section 1 (2) establishing a coordinating unit, p. 12. Reference on cybersecurity, p. 13. ↩ ↩² ↩³

7. Same document, Chapter 1, Section 2 "Identifying and evaluating the technology to protect," (1) evaluating the position of important technology, p. 15. ↩ ↩²

8. Same document, Chapter 1, Section 2 (2) identifying core technology that is the source of competitiveness, p. 16. Reference on confirming technology related to security and economic security, pp. 17-20. ↩ ↩²

9. Same document, Chapter 1, Section 2 (3) intellectual property strategy suited to the characteristics of the technology, p. 21. ↩ ↩²

10. Same document, Chapter 2, assumed cases p. 24, leakage cases 1 to 5, pp. 26-30. ↩ ↩² ↩³

11. Same document, Chapter 2, Section 1 "Matters to address before and during planning," items 1 to 6, pp. 32-37. ↩

12. Same document, Chapter 2, Section 2 "Matters to address when concluding contracts," items 1 to 5, pp. 39-43. ↩

13. Same document, Chapter 2, Section 3 "Matters to address during overseas operations," items 1 to 4, pp. 45-48. ↩

14. Same document, Chapter 2, Section 4 "Matters to address at withdrawal or contract end," items 1 to 3, pp. 50-52. ↩

15. Same document, Chapter 2, Section 5 "Other matters," (1) thorough control of overseas R&D sites, p. 54. ↩

16. Same document, Chapter 3, assumed cases p. 56, basic understanding p. 57, leakage cases 1 to 5, pp. 59-63. ↩ ↩² ↩³ ↩⁴

17. Same document, Chapter 3, Section 1 "Matters to address in advance to prevent leakage," (1) rule-based measures items 1 and 2, pp. 65-66. (2) personnel measures, item 3 training, p. 67. ↩ ↩²

18. Same document, Chapter 3, Section 1 (2) personnel measures, item 4 checks required by law at hiring, p. 68; item 5 checks at assignment to departments handling important technology, pp. 69-77. ↩ ↩² ↩³

19. Same document, Chapter 3, Section 1 (2) item 6 preventing leakage through side jobs, pp. 81-82; item 7 appropriate use of non-compete covenants, pp. 83-84. ↩ ↩²

20. Same document, Chapter 3, Section 1 (3) system measures, items 8 to 12, pp. 85-91. ↩

21. Same document, Chapter 3, Section 1 (4) operational measures, items 13 to 15, pp. 92-94. ↩

22. Same document, Chapter 3, Section 2 "Matters to address when technology has leaked," items 1 and 2, pp. 96-97. ↩

23. Same document, Chapter 3, Section 3 "Matters to address regarding the departure of engineers," items 1 to 3, pp. 99-101. ↩