AP Subject A 31 — Law and Standardization

Basis: the 2026 IPA Applied Information Technology Engineer Examination (AP), Subject A, Syllabus Ver.7.2. Researched and checked 2026-10-21. This article uses only rules effective by that date and excludes 2027 proposals and not-yet-effective revisions. It explains exam concepts, not individual legal advice.

Revision history: 2026-10-28 corrected the closing note. AP32 is the next core installment and closes the AP1–32 core map; the series then continues through the AP33–38 completion plan and ends at AP38.

Learning index and exact scope

Area	Japanese exam terms
Intellectual property	著作権, 特許権, 営業秘密
Privacy/security law	個人情報, 要配慮個人情報, 個人データ, 仮名加工情報, 匿名加工情報, 不正アクセス禁止法
Contracts/labor	請負, 委任・準委任, 労働者派遣, 指揮命令
Standards	JIS/JISC, ISO, IEC, ITU, IETF, IEEE, デジュール, デファクト, SLCP, 適合性評価

Exact syllabus hierarchy and page mapping (PDF and printed page numbers are deliberately separate):

• 大分類 9：企業と法務 / 中分類23：法務
• 1. 知的財産権 — PDF p.133 / printed p.129
  • （2）著作権法
  • （3）産業財産権法
  • （4）その他関連する法律など
• 2. セキュリティ関連法規 — PDF pp.134–135 / printed pp.130–131
  • （2）不正アクセス禁止法
  • （4）個人情報保護法，マイナンバー法
• 3. 労働関連・取引関連法規 — PDF pp.135–136 / printed pp.131–132
  • （1）労働関連の法規 / ② 労働者派遣法
  • （2）取引関連の法規 / ② 民法
  • （3）企業間の取引に関わる契約
• 5. 標準化関連 — PDF pp.138–140 / printed pp.134–136
  • （1）標準・規格と標準化団体
  • （2）デファクトスタンダード
  • （3）開発と取引の標準
  • （6）国際認証の枠組み

1. Intellectual property

Copyright (著作権) is a bundle of rights, including reproduction, public transmission, and adaptation. Under the no-formality principle (無方式主義), it generally arises upon creation rather than registration. A program may be protected as creative expression; a database may be protected where the selection or systematic arrangement of information is creative. An abstract idea, algorithm, or function must be distinguished from its concrete expression.

A patent (特許権) concerns an invention (発明), a technical idea using laws of nature. Rights arise through filing, examination, and registration, subject to requirements such as novelty and inventive step. It is false that every software idea is patentable. The exam contrast is automatic protection of expression versus procedural protection of a qualifying technical invention.

A trade secret (営業秘密) under the Unfair Competition Prevention Act requires secrecy management (秘密管理性), usefulness (有用性), and non-public availability (非公知性)—all three. A useful customer list freely visible without access controls or secrecy indications cannot be assumed to qualify.

	Copyright	Patent	Trade secret
Focus	Creative expression	Technical invention	Managed, useful, non-public information
Protection	Generally automatic on creation	Filing, examination, registration	Factual satisfaction of all three elements
Trap	Treating an idea as protected expression	Calling every software idea patentable	Treating usefulness alone as sufficient

2. Personal information and unauthorized access

Personal information (個人情報) concerns a living individual and can identify that person through a name or other description, or contains an individual identification code. Special-care-required personal information (要配慮個人情報) includes matters such as race, creed, and medical history that require special care to avoid unfair discrimination or prejudice. Personal data (個人データ) is personal information constituting a personal-information database.

Pseudonymously processed information (仮名加工情報) is processed so that a person cannot be identified unless collated with other information. Anonymously processed information (匿名加工情報) is processed so that the person cannot be identified and the original personal information cannot be restored. Merely deleting a name does not automatically establish either category. At exam level, distinguish specification and purpose-bound handling, security-control measures, and the rules and exceptions for third-party provision. Real legality depends on the facts and current rules.

The Unauthorized Computer Access Act (不正アクセス禁止法) starts with an access-control function and a connected computer. Typical unauthorized access includes using another person’s identification code without authorization or bypassing access control to use a restricted function. Supplying another person’s ID/password may be an act that facilitates unauthorized access. Do not claim that mere vulnerability scanning is always the statutory offense without checking the actual conduct and elements.

3. Contracts and worker dispatch

Form	Exam focus	Direction/control
Contract for work (請負)	Completion and responsibility for a result	Contractor ordinarily directs its staff
Mandate/quasi-mandate (委任・準委任)	Due-care performance of entrusted affairs	No automatic promise of a completed result
Worker dispatch (労働者派遣)	Dispatching employer employs; client directs work	Client gives direct operational commands

Substance matters more than the contract label. If a document says “contract for work” but the client directly dictates each contractor employee’s daily hours, sequence, and method, disguised contracting (偽装請負) risk should be considered. Actual classification requires the full facts and qualified advice.

4. Standards

• JIS is a body of Japanese Industrial Standards documents; JISC is Japan’s industrial-standardization council. Do not call them the same organization.
• ISO works broadly on international standards; IEC on international electrotechnical standards; ITU is an international organization for information and communication technologies. IETF is associated with the Internet standards process and RFC ecosystem; IEEE has standards activities in electrical, electronics, and computing fields. Fields may overlap, so avoid false “only this body” claims.
• A de jure standard (デジュールスタンダード) results from a recognized standards process. A de facto standard (デファクトスタンダード) becomes standard through market adoption or competition.
• JIS X 0160 addresses software life-cycle processes (SLCP). It is a standards document, distinct from JISC as an organization.
• ISO/IEC 15408 is the Common Criteria family for IT security evaluation. Conformity assessment (適合性評価) determines whether a product, process, or service meets specified requirements; it is not itself the act of writing the standard.

Worked fictional decisions

Case 1 — source code and a patent

• Fact: Mina wrote original source code without registration. A rival independently implemented the same business idea without copying her expression.
• Rule/concept: Copyright arises automatically in expression; an idea differs from expression. A patent requires filing, examination, registration, and substantive requirements.
• Conclusion: Mina’s code expression may be copyrighted despite no registration, but independent implementation of the same idea is not automatically copyright infringement. No patent arises automatically.
• Caveat: Real infringement or patentability depends on code similarity, claims, prior art, and other facts.

Case 2 — “contract for work” in name only

• Fact: The document says 請負, but the client manager directly assigns each outside worker’s hours and task sequence every day.
• Rule/concept: 請負 emphasizes an independently delivered result; client direction is characteristic of dispatch. Substance controls over labels.
• Conclusion: In an exam question, the best choice flags potential disguised contracting.
• Caveat: Actual classification requires the whole agreement, command structure, allocation of responsibility, and professional review.

Case 3 — customer list

• Fact: A valuable non-public customer list sits in an access-controlled folder and is supported by secrecy markings and staff training.
• Rule/concept: 秘密管理性, 有用性, and 非公知性 are all required.
• Conclusion: These facts support, but do not finally prove, all three elements.
• Caveat: One safeguard alone never settles a real legal dispute.

Exam traps and quick sheet

• “No registration means no copyright” ×; “every software idea is patentable” ×.
• Trade secret = all three: managed as secret + useful + non-public.
• 個人情報 and 個人データ are not always synonyms; pseudonymous and anonymous are not synonyms.
• Check access control and actual conduct; the word “scan” alone does not settle the offense.
• completed result = 請負 / due-care affairs = 準委任 / client command = 派遣.
• Separate documents (JIS, ISO/IEC 15408) from organizations (JISC, ISO, IEC, etc.).
• recognized procedure = de jure / market reality = de facto / checking requirements = conformity assessment.

Original questions

Q1

A useful internal manufacturing formula is publicly available on the Internet. Which statement about the three trade-secret requirements is best?

A. Because non-public availability is difficult to satisfy, it cannot be said to meet all three requirements.

B. Usefulness alone makes it a trade secret.

C. Lack of registration means there is no copyright.

D. Legal protection is always impossible because it is not software.

• A: Correct. Public availability defeats the non-public element on these facts.
• B: Incorrect. All three requirements are necessary.
• C: Incorrect. It confuses the issue with copyright’s no-formality principle.
• D: Incorrect. Protection cannot be categorically denied on that ground.

Q2

Under a quasi-mandate, a provider performed the agreed affairs with due care but did not reach a target metric. Which is best?

A. Every quasi-mandate automatically breaches if the target is missed.

B. Proper performance of affairs is central; responsibility for a completed result does not arise automatically.

C. It is always dispatch because the customer directly commands the staff.

D. The contract title alone conclusively determines every relationship.

• A: Incorrect. It confuses quasi-mandate with completion responsibility.
• B: Correct, though the specific agreement still matters.
• C: Incorrect. No direct command is stated.
• D: Incorrect. Actual substance also matters.

Q3

On an access-controlled server, a person enters someone else’s ID and password without permission and uses a restricted function. Which is best?

A. Calling it a scan always makes it irrelevant.

B. Entering a password makes it authorized.

C. This is the typical description of unauthorized use of another’s identification code under an access-control premise.

D. It concerns only privacy law, never the Unauthorized Computer Access Act.

• A: Incorrect. The actual conduct and elements control.
• B: Incorrect. The identification code was used without authority.
• C: Correct. The stated elements match the core exam concept.
• D: Incorrect. The facts directly implicate the unauthorized-access framework.

Q4

Which pairing is most appropriate?

A. JISC is itself the software-life-cycle standards document.

B. IETF is the name of the Japanese Industrial Standards.

C. ISO/IEC 15408 classifies worker dispatch.

D. JIS X 0160 concerns SLCP and must be distinguished from JISC as an organization.

• A: Incorrect. JISC is an organization, not that document.
• B: Incorrect. IETF is an Internet standards community.
• C: Incorrect. It is an IT security evaluation criterion.
• D: Correct. It correctly separates the document and organization.

Official sources and next learning

Checked 2026-10-21. Only rules effective by this date are treated as current; 2027 proposals and not-yet-effective revisions are excluded. These official materials support exam concepts, not individual legal advice.

• IPA AP Syllabus Ver.7.2
• e-Gov: Copyright Act, Patent Act, Unfair Competition Prevention Act
• PPC laws and guidelines — identifies the 2026-10-01 effective version as current on the check date
• e-Gov: Personal Information Protection Act, Unauthorized Computer Access Act, Worker Dispatch Act, Civil Code
• JISC, ISO, IEC, ITU, IETF, IEEE SA

The next core installment is the AP32 mixed diagnostic, which closes the AP1–32 core study map. AP32 is not the last installment of the series: the fixed AP33–38 completion plan (supplements and mixed diagnostics) follows it, and the series ends at AP38. Alongside the full range, AP32 diagnoses the remaining database topics: indexes, performance design/measurement, and access control (GRANT/REVOKE and least privilege). Every installment is listed in the public series index.