When confidential information has been entered into generative AI

1. Stopping further entry and sharing, establishing the facts, and securing records

Stopping the spread and keeping records proceed in parallel

Existing sharing links are revoked, public access to public bots and shared conversations is stopped, and external integrations are suspended in parallel with the preservation of necessary records. Merely stopping the creation of new sharing links is not sufficient. Where continued public access causes harm to spread, access is blocked without waiting for complete records to be secured, and a record is kept of the measures taken and the time they were taken.

Whether to delete histories or files is assessed in light of both the effect on evidence and the need to prevent further harm. Records showing what was sent, when, and from which account form the basis for subsequent assessments, so proceeding with deletion first may make it impossible to formulate the content of reports or notifications.

Where the information entered included authentication information such as passwords or API keys, the need for revocation or changes is examined with the information systems department, separately from deletion of the history.

Where isolating devices or investigating an intrusion by a third party is also necessary, please refer to Cyber Incident and Data Breach Response.

What to secure as records

A record is kept of the content and versions of the text and files entered, the date and time of entry, the service and account used, the settings at the time, the scope of sharing of conversations or projects, and whether there were external integrations. In addition to what is displayed on screen, preservation of usage logs is also examined where such logs can be obtained by an administrator.

Recording who knew what and when

Where the information entered includes personal data and it becomes known that a reportable leak or other incident has occurred or may have occurred, reporting deadlines need to be managed. For a corporation, the time when an employee within a department becomes aware of the incident may be the reference point; the start of the period cannot be postponed until the investigation is complete or the legal department has made its assessment. A record is kept of who became aware of which facts and when, and contact with the responsible internal department and management of deadlines proceed in parallel.

2. Checking the scope of use through the recipient's contract and settings

Three matters are checked

The first is what the information entered is used for. Its handling differs according to the purpose, such as model training, service improvement, or monitoring for misuse. The second is where and to what extent it remains. Conversations, uploaded files, logs, recipients of shared information, and storage locations are checked separately. The third is the point in time to which the conditions relate. The terms and settings that applied when the information was entered may differ from the current settings, and changes to settings may apply only to future entries, so the change history is checked.

Labels such as "for businesses" or "not used for training" alone do not establish these matters. In its alert of June 2, 2023, the Personal Information Protection Commission also calls for sufficient checks that entering a prompt containing personal information into a generative AI service is within the scope necessary to achieve the specified purpose of use.

Personal data is checked in three stages

Where the information entered includes personal data, the checks follow this order.

The first question is whether there has been "provision" within the meaning of Article 27 of the Act on the Protection of Personal Information. The Personal Information Protection Commission's Q&A on the Guidelines states that, when using a cloud service, the criterion is not whether the electronic data stored includes personal data, but whether the service provider is to handle the personal data.

However, statements such as "no human viewing" or "not used for training" do not automatically establish that the provider does not handle the data. In addition to the terms and settings, the processing involved in generating responses, the scope of storage, and the management of access on the provider's side need to be checked. The analysis of cloud services in general cannot be applied unchanged to generative AI services.

The second question, assuming there is provision, is whether it can be said to accompany entrustment. Where personal data is provided in connection with entrusting all or part of its handling within the scope necessary to achieve the purpose of use, the recipient does not constitute a third party (Article 27, paragraph (5), item (i) of the Act on the Protection of Personal Information). However, in that case, the recipient cannot handle the personal data for tasks other than those entrusted to it.

The third question is whether there is a lawful basis for any use that falls outside the scope of entrustment. Where the provider also uses the data entered for another purpose, such as training its own models, whether that use falls within the scope of entrustment or requires a response as provision to a third party is examined.

The same Q&A states that an entrusted person may use the personal data provided to improve its own analytical techniques, as long as this is within the scope necessary to achieve the entrusting business's purpose of use. However, this is subject to the limitation that the use be within the scope necessary to achieve the entrusting business's purpose of use; it does not give blanket permission to train general-purpose models made available to the public.

Matters remain to be examined in cases of entrustment and where the provider is in a foreign country

Where there is entrustment, necessary and adequate supervision of the entrusted person is required (Article 25 of the Act). Also, even where the situation is assessed as not constituting provision, the need to take the security control measures for which the company itself is responsible remains unchanged.

Where there is provision, whether the recipient constitutes a third party in a foreign country and what action is required under Article 28 of the Act are checked. The assessment concerns the provider receiving the data, not the location of the server on which the data is stored. Even where data is stored on a server in Japan, if a provider in a foreign country handles that data, this may constitute provision to a third party in a foreign country. On the other hand, even a provider established under foreign law does not fall within that category where it is recognized as using a personal information database or the equivalent for business in Japan. The existence of an office in Japan alone does not determine the position; the actual business activities in Japan are checked.

Even where the situation is assessed as not constituting provision, the checks do not end there. If the provider or server is in a foreign country, the personal information protection system and related matters in that country are ascertained, and the company's security control measures are checked for deficiencies. It is also checked whether the information made accessible to the individuals concerned about the security control measures taken for personal data the business holds is consistent with the actual use discovered in this case. This is separate from individually notifying the individuals concerned of an incident (Article 26, paragraph (2) of the Act).

Where the recipient or settings are unknown

Where the recipient is unknown, further entry and external integrations are stopped, and the actual transmission route is checked through screens, applications, accounts, and communications records. Inquiries are made to the information systems department and the person responsible for contracts about the connection destination, the provider performing the processing, and the scope of sharing.

Where the settings are unknown, the terms, administrative settings, and change history at the time of entry are checked without assuming that the settings were on the safe side. Items that cannot be confirmed are recorded as "unknown", and inquiries are made to the provider about use for training, retention periods, third-party access, and the handling of deletion.

In either case, the person responsible for the checks and the deadline for a response are determined, while reporting and notification that should proceed without waiting for the facts to become clear are examined in parallel.

3. Assessing reporting, notification, and contractual responses according to the type of information

The laws to examine and the deadlines differ according to what information was entered. One piece of information may fall within more than one category, so all applicable categories are checked.

Type of information	Checks that determine the conclusion	Actions taken first	Reporting, notification, and deadlines
Personal data	Actual handling, the scope of transmission and viewing, the content of the data and number of individuals, the possibility of a leak or other incident, and whether statutory reporting applies	The individuals concerned, information, and scope of transmission are identified, and the department responsible for personal information is contacted	The assessment of provision to third parties and related matters, and reporting of leaks or other incidents, are examined separately. If the incident is reportable, the statutory starting point and deadline apply
The company's trade secrets	Secrecy management arrangements, the possibility of external use or onward provision, and the scope of access	Records of secrecy management arrangements and transmission routes are preserved, and the scope of access and sharing is narrowed	There is no uniform statutory reporting deadline based solely on the information being a trade secret. Contractual obligations and obligations under laws governing the industry are checked separately
Confidential information entrusted by third parties	The purpose of use under the confidentiality agreement, permitted recipients and whether further entrustment is permitted, and notification clauses concerning incidents or the possibility of them	The contract and the scope of information entered are checked, and the recipients, content, and deadlines for notification are identified	The contract's triggers, starting points, and deadlines for notification apply. Notification may be required even where a leak has not been confirmed
Others' works	The manner of entry, storage, and sharing, the scope of permission, the application of limitations on rights, and whether the work is reproduced in the output	Further use and publication of the materials and output in question are stopped, and a record is kept of how they have been used	Entry alone does not give rise to a notification obligation in every case. Contractual obligations and responses to rights holders are assessed separately

The initial response and reporting where information has leaked through an external attack, such as unauthorized access or ransomware, are addressed in Cyber Incident and Data Breach Response. This section assumes that information has been sent by the company to an external service.

Personal data: checking whether a leak has occurred or may have occurred and whether reporting is required

The General Rules Guidelines state that a "leak" of personal data means that personal data flows outside the business. They also give, as an example of a leak, a case in which personal data has become viewable on the internet because of a system configuration error or similar problem. Proof that a third party has actually viewed the data is therefore not required in every case.

On the other hand, the same guidelines give, as examples that do not constitute a leak, cases in which all the data has been recovered before a third party has viewed it and cases in which a business handling personal information provides personal data to a third party based on its own intent.

Care is needed here: the fact that an employee entered information of their own volition does not, by itself, make the provision intentional on the company's part. Where entry violates internal rules, the authority of the person who entered the information is checked, together with whether instructions or approval extended to that information, service, and scope of use; whether there are discrepancies between the rules and actual practice; and whether the wrong recipient or data was selected. The fact that the entry violated the rules does not, by itself, determine the conclusion either. Even where the situation is assessed as not constituting a leak, restrictions based on the purpose of use (Article 18 of the Act), restrictions on provision to third parties (Article 27 of the Act), and restrictions on provision to a third party in a foreign country (Article 28 of the Act) are checked separately.

Whether the personal data entered is subject to reporting, and reporting deadlines

Reporting to the Personal Information Protection Commission is required where a leak or other incident has occurred or may have occurred in any of the following categories: (1) personal data containing sensitive personal information; (2) personal data whose improper use may cause financial damage; (3) personal data in a leak or other incident caused by an act against the business handling personal information concerned, where that act may have been carried out for a wrongful purpose; or (4) cases in which the number of individuals concerned exceeds 1,000 (Article 26, paragraph (1) of the Act and Article 7 of the Enforcement Rules for the Act on the Protection of Personal Information).

Category (3) also includes personal information that the business concerned has acquired or is seeking to acquire and that is scheduled to be handled as personal data. Reporting is not uniformly required for all personal information acquired.

Also, in all four categories, personal data for which advanced encryption or other measures necessary to protect individuals' rights and interests have been taken is excluded. However, information entered so that AI can read it cannot be assessed as excluded solely because it is labeled as encrypted.

For category (3), the General Rules Guidelines state that those who carry out acts that may have been carried out for a wrongful purpose include employees as well as third parties. They also state that the "business handling personal information concerned", against which the act is directed, includes a third party whose service the business uses to handle personal data. Accordingly, where information entered has leaked through unauthorized access to a generative AI service provider, whether category (3) applies is also examined.

On the other hand, merely entering information through an operational error in the course of work normally does not constitute an act carried out for a wrongful purpose under category (3). However, a case in which information was entered with the intention of taking it outside the company, in the knowledge that doing so violated the rules, is examined separately. The General Rules Guidelines give, as an example requiring reporting under category (3), a case in which an employee improperly takes customers' personal data and provides it to a third party.

Also, the fact that category (3) does not apply does not mean there is no reporting obligation. Whether categories (1), (2), or (4) apply needs to be checked separately.

Reporting consists of a preliminary report and a final report. The preliminary report is made promptly after becoming aware of a reportable incident. The General Rules Guidelines state that the guideline for "promptly" is within approximately 3 to 5 days from the time the incident becomes known. The final report is made within 30 days, counting the day on which the incident becomes known as day 1. For an incident in category (3), the period is within 60 days. This 60-day period is also stated to apply where the incident falls within category (3) and also within any of categories (1), (2), or (4). Saturdays, Sundays, and public holidays are included when calculating these 30-day and 60-day periods, but if the deadline falls on a Saturday, Sunday, public holiday, or a day when government offices are closed for the year-end and New Year holidays, the reporting deadline is the next day those offices are open.

The individuals concerned are notified promptly according to the circumstances of the incident (Article 26, paragraph (2) of the Act). The 30-day and 60-day deadlines for the final report do not apply unchanged to notification of the individuals concerned.

Where personal data entrusted to the company has been entered

Where the handling of personal data has been entrusted by another business handling personal information, the entrusted person is exempt from the obligation to report to the Commission and from the obligation to notify the individuals concerned if it notifies the entrusting business that bears the reporting obligation of the matters required for a preliminary report that are known at that time (the proviso to Article 26, paragraph (1) of the Act, Article 26, paragraph (2) of the Act, and Article 9 of the Enforcement Rules for the Act on the Protection of Personal Information). The guideline for this notification is also stated to be within approximately 3 to 5 days from the time the occurrence of the incident becomes known.

However, the entrusting business's reporting, notification of the individuals concerned, and other responses remain to be addressed, so the allocation of investigation and response tasks is also checked. In addition to whether the content and method of notification meet the statutory requirements, please check contractual obligations to make contact and the deadlines for doing so.

Where information has been entered with names removed

Even where names were removed before entry or only part of a customer list was entered, the information does not automatically cease to be personal data. Whether a specific individual can be identified by cross-checking it against other information remaining at the company is checked. The assessment cannot be based solely on whether the AI receiving the information can identify an individual.

The company's trade secrets, confidential information entrusted to it, and others' works

Where the company's trade secrets are included, entry alone does not establish that the requirements of secrecy management or non-public status are no longer met. However, the possibility of external use or onward provision and the scope of internal access affect subsequent arguments, so a record is kept of the management arrangements.

Where confidential information entrusted by a business partner is included, the purpose of use, provisions on recipients and further entrustment, and notification clauses concerning incidents or the possibility of them in the confidentiality agreement are checked. Notification clauses may require notification even where a leak has not been confirmed. For others' works, the manner and purpose of entry, storage, and sharing, the scope of permission, and the application of provisions on limitations on rights are checked. Whether expression from existing works is reproduced in generated content is checked before publication.

The approach where actual external use is suspected and injunctive relief or damages are being considered is addressed in Responding to the misuse of trade secrets by a competitor.

4. Requesting deletion and cessation of use and preventing recurrence

Requests to the provider

Inquiries are made to the provider about the identification of the conversations, files, and logs concerned, retention periods, whether backups exist, recipients of shared information, and how the information is handled if it has been used for training. There is no need to wait for a response. To the extent that the information concerned can be identified, a parallel request for use and sharing to stop for the time being is considered.

When requesting deletion and cessation of use, claims under the contract or terms, statutory claims, and voluntary requests for cooperation regardless of whether an obligation exists are distinguished, and the party making the request and its basis are checked. The right to request cessation of use and related measures under the Act on the Protection of Personal Information belongs to the individual concerned, so the company that entered the information cannot automatically exercise that right in its own capacity.

When making inquiries, care is taken to avoid sending confidential information again through the inquiry itself. The information concerned is first identified using conversation IDs, dates and times, or similar details. Where materials need to be resent, the recipient and scope of transmission are checked before doing so.

Who within the company will make the request is also checked. Where an employee's personal account was used, the company may be unable to make inquiries or request deletion in its own name because it is not the contracting party. The contracting party, administrator, and authority to make requests are checked, and, where necessary, the procedure is carried out through the user concerned.

Deletion has limits

Even after the history has been deleted, information may remain in backups or logs. Information obtained by third parties through sharing links or passed to recipients through external integrations cannot be recovered solely by making a request to the provider. Where information has already been used for training, the extent to which its effects can be reversed also depends on the provider's systems. A separate record is kept of the scope for which completion of deletion can be confirmed and the scope for which it cannot. Reports, notifications, and explanations to business partners are formulated on the basis that deletion cannot be confirmed for the latter.

Internal responses

In responding to the employee who entered the information, interim measures and decisions on disciplinary action are considered separately. Suspending use of the service and restricting access rights in parallel can be considered to the extent necessary to prevent further harm. On the other hand, whether disciplinary action is needed and what it should involve are assessed in light of the necessary fact-finding and the employee's explanation. The assessment also varies according to the content of internal rules, how they were communicated, and whether approved means of use had been provided.

This does not mean that no measures can be taken until all investigations are complete, nor that disciplinary action can be taken immediately whenever there is a violation of the rules.

Where the number of individuals concerned is large and public announcements, press conferences, and responses to victims also need to be considered, please refer to Cyber Incident and Data Breach Response.

Preventing recurrence

Options include limiting the services and accounts used for work to those approved, specifically defining the scope of information that must not be entered, establishing a system that keeps records of use, and regularly checking contracts and settings. In training, it is effective to show what can be done through approved means, as well as what is prohibited.

How we assist

• We set out the types of information entered and the recipients, and separately examine the assessment under the Act on the Protection of Personal Information, protection as trade secrets, and contractual obligations
• We check contracts, terms, and settings, and set out the matters on which inquiries should be made to the provider and the content of requests for deletion and cessation of use
• We examine whether reporting to the Personal Information Protection Commission and notification of the individuals concerned are needed, the deadlines, and what should be included, and support the preparation of written documents
• Where notification to business partners is needed, we check the contractual triggers and deadlines for notification and draft notices
• We examine whether measures against employees are needed and their extent in light of the results of fact-finding
• We review rules on use, the definition of information prohibited from entry, approval procedures, and methods of keeping records to prevent recurrence

Note: The amendments to the Act on the Protection of Personal Information promulgated on July 17, 2026 include revisions concerning provision to third parties and the obligations of entrusted persons, among other matters. The amended provisions relevant to the matters addressed in this guide are not yet in force, and the explanations in the body of this guide are based on legislation already in force. For the commencement dates and details of the system, please check the materials published by the Personal Information Protection Commission.

Frequently asked questions

Contact

Making an inquiry

Please tell us the outline of the situation, any notice you have received and its date, and any deadline you are working to.

Contact Form

Related information

Related explainers and practice areas

When a customer requests copyright assignment for custom SaaS development: preserving updates to shared functions and services for other customers

Intellectual Property, IT and Data

When support for electronic medical records or other systems is ending: securing the conditions for continued use and data migration

Intellectual Property, IT and Data

Before agreeing to joint ownership in a joint development agreement: setting the terms needed for commercialization

Intellectual Property, IT and Data

Alleged OSS license violations in shipped products or ongoing services: remediation of past deliveries and decisions on future supply

Intellectual Property, IT and Data

This article is provided for general informational purposes only and does not constitute legal advice on any specific matter. Please consult us regarding your specific situation. The content is based on the laws and regulations in effect as of the date of the last update.