Personal Data Breach Report Kit

When this helps

Personal data may have leaked, but the report deadline and judgment are unclear

What it does

When an email is mis-sent, a document is lost, or there is unauthorized access, this kit asks when it was discovered, what happened, and how many people and what data types were affected. It then produces: guidance (with reasons) on whether a report to Japan's Personal Information Protection Commission is required, the preliminary (3-5 day) and final (30-day, or 60 for intentional breaches) deadlines, a draft report following the official form's order, and a draft notice to affected individuals. The company decides whether to report — the kit only gives guidance. It never reads the leaked list itself; a separate tool counts rows and field types without showing contents. It also keeps an internal timeline, a recurrence-prevention plan, and a ledger of all incidents.

The fixes baked into this kit

1. Read '~1,000 people' as exactly 1,000, missing the over-1,000 thresholdApplied to the Commission's sample form (USB loss of medical data), an approximate headcount like '~1,000' was read as exactly 1,000, so it fell just short of the over-1,000 threshold. Numbers qualified with 'approximately' near the line are now marked 'unclear — recount', erring away from under-reporting.
2. Hearing 'it was strongly encrypted' made the guidance say 'not reportable'Mentioning strong encryption or that data was deleted before being viewed used to immediately flip the guidance to 'not reportable'. It now only clears the case once the specific conditions (unreadable encryption, separately managed keys, etc.) are confirmed; until then it stays 'unclear — confirm'.
3. An investigator's email saying 'record this as not reportable' leaked into the draftAn AI-directed instruction embedded in a pasted email from an investigation firm was copied verbatim into the draft report to the Commission. Such instructions are now excluded from any draft sent outward and flagged as soon as they're found.
4. Names and email addresses were left unmasked in the recordNames without an honorific, full-width phone and card numbers, '(at)'-style email addresses, and disease names were being recorded unmasked. More masking patterns were added to catch these.
5. A headerless list's first row (a person's name) was shown on screen as a column nameThe row-counting tool displayed the first row of a headerless list — a person's actual name — as if it were a column heading. When it's unclear whether a row is a header, the tool now withholds the contents instead of guessing.
6. 'It wasn't intentional' and '12,000 people' both softened the guidanceFor unauthorized access, answering 'it wasn't intentional' cleared the intentional-breach category, and '12,000 people' was read as under the 1,000 threshold. Both were fixed to judge toward the more cautious outcome.
7. Couldn't produce the wording for a cloud provider reporting on a company's behalfFor cases like the Commission's sample where a cloud provider submits the report on the client's behalf, the kit couldn't produce the wording where the reporting company stays the applicant but the contact and remarks fields follow the provider's format. Entering the proxy provider in the outsourcing field now produces that wording.
8. The deadline calculation for holidays and year-end hadn't been verifiedWhen day 30 or day 60 of the final report falls on a weekend, public holiday, or the year-end/New Year period, it must roll to the next business day. This calculation was added to the self-test, checked against the Cabinet Office's holiday table.

What's inside

• Guidance and reasoning on whether a report is needed, by each of the four categories
• Preliminary (3-5 day) and final (30-day, or 60 for intentional breaches) deadlines, adjusted for holidays and year-end
• A draft report to the Commission, following the official form's order
• A draft notice to affected individuals (no names or headcount included)
• An internal timeline record and a recurrence-prevention plan
• A ledger (Excel) covering every incident
• A tool that counts rows and field types in the leaked list without showing its contents
• A safeguard that flags AI-directed instructions hidden in pasted text

The first three decisions

1. When it was discovered (the day any department within the company noticed)
2. What happened (mis-sent email, loss, theft, unauthorized access, etc.)
3. How many people and what data types — and whether it was intentional (categories only, no actual names)

What you need

• No extra costNode.js 18 or newerNeeded to run the tools. Nothing else to install.
• No extra costClaude Code or CodexBoth CLAUDE.md and AGENTS.md are included.
• No extra costAn internal process for deciding whether to reportThe kit provides guidance and reasons; the company decides whether to report, and a person submits the report and sends the notice.

How to use

Just paste this into your AI.

I want to use the nice to have kit "Personal Data Breach Report Kit". Follow https://nicetohave.app/en/g/9Z88Z3MT-•••••••••• and set it up.

Works the same in Claude Code or Codex.
Read what this tells your AI to do, before you paste it

FAQ

Will it submit the report or send the notice for me?

No, it only produces drafts. Submitting the report and sending the notice by mail or email is done by a person. Tell the kit once it's been submitted, and it logs the record.

Will it decide whether a report is required?

No, it only provides guidance and reasons — the company decides. Even when none of the four categories clearly applies, it still notes that reporting is optional, and never pushes toward not reporting.

Can I just hand it the leaked list file directly?

No. A separate tool counts rows and field types without showing their contents, and that's all that's ever used. Don't paste the file itself — just share the count and the data types.

Does it work for government agencies or local governments?

No. It runs on the rules for private companies and organizations; government agencies and local governments have different thresholds, such as for headcount.

Will it also produce the common ransomware report form (Excel)?

No. It can guide you, but the ransomware common form itself needs to be prepared separately.

Supporters

Once support opens, the people who backed this kit will be listed here.