Japan HR Data Incident: Salary Information Sent to the Wrong Recipients

An accidental email containing employee salaries should trigger a controlled privacy and security assessment, not an immediate conclusion that the employer has violated the law or that no action is needed. First stop further circulation, preserve the original message and delivery facts, identify who received what, then assess the event against Japan’s Act on the Protection of Personal Information (APPI) and current Personal Information Protection Commission (PPC) guidance.

Salary and rank information tied to identifiable employees can be personal information and, depending on the company’s records and handling, personal data regulated by the APPI. Whether the event triggers mandatory PPC reporting and notice to affected people depends on the statutory categories, implementing rules and circumstances. The PPC’s leak response page describes the reporting categories and process. Its overview of mandatory reporting and notification identifies incidents such as those involving special care-required personal information, likely property damage, malicious intent, or more than 1,000 affected people. Review the current Japanese APPI text, relevant regulations and current PPC general guidelines; do not rely on an old checklist alone.

An internal mistake can still have privacy and employment consequences even if it does not meet a mandatory reporting trigger. Conversely, a broad internal audience does not automatically prove that each recipient was unauthorized for every purpose or that the data was externally disclosed. Determine facts rather than infer them from the email’s subject line or the sender’s explanation.

First contain, then preserve

Ask recipients not to forward, download, print or discuss the file further, and use technical controls to restrict access where possible. If it was sent to a mailing list, distribution may already have occurred; do not assume that a “delete this email” message removes copies, mailbox retention or attachments. Work with IT/security to identify whether the file was opened, downloaded, forwarded, synced or copied into other systems.

At the same time, preserve a controlled incident copy. Save the original email with headers, attachment, sent time, recipient list, distribution group membership and delivery status. Keep system logs and relevant access/audit events under the organization’s retention and legal-hold rules. Create a restricted incident folder with access limited to those who need it. Do not ask employees to destroy evidence before the incident team has recorded what was sent and to whom.

Avoid creating an uncontrolled collection of employees’ copies. Ask the incident lead to specify who may preserve evidence, where to place it and how to report accidental onward sharing. If the company uses an external mail or HR provider, check the controller/processor roles, contract and incident notification route.

Assess the legal trigger and affected people

The APPI’s breach provisions and rules focus on whether there has been a leakage, loss or damage involving personal data and whether the event falls into a reportable category. The PPC’s current guidance describes categories for mandatory reporting and affected-person notification. These can include special care-required information, risk of property damage, malicious conduct and large-scale incidents; the exact application depends on the law and incident facts. Check any applicable exception and whether a delegated sector regulator is the correct reporting destination.

Record who made the assessment, what source materials were reviewed, what was known at that time, what remained uncertain, and why the organization concluded that reporting or notice was or was not required. If facts change (for example, logs later show external forwarding), reassess. Do not treat a preliminary “internal-only” label as permanent.

If mandatory notification applies, the PPC says the organization should report promptly, with an initial report generally within around three to five days and a final report within 30 days, or 60 days for an incident involving malicious intent, as described on its current page. Verify the deadline and receiving authority from the current official instructions at the time of the event. The PPC also explains that the notice to affected individuals should be made promptly in a clear way and cover relevant information such as the incident, affected data and cause as known.

Public announcement is a separate question. The PPC’s FAQ explains that public announcement is not generally mandatory merely because a leak occurred, except where used as an alternative notice or otherwise appropriate. A carefully targeted direct notice may be more useful. If notice could increase harm or expose more data, have counsel assess the method.

Communicate without making unsupported promises

Employees may want to know what happened, whether the file was deleted, who could view it, what the employer is doing and where to raise concerns. Give accurate, scoped information. If the organization is still investigating, say what is confirmed and when an update will follow. Avoid saying “no risk” before access and onward sharing have been checked, or promising that every copy has been erased when retention systems may hold copies.

The company can ask the sender and recipients to cooperate with containment while avoiding blame before fact-finding. Preserve messages that document the response. Do not circulate the spreadsheet again merely to show employees what was disclosed; use controlled descriptions or individual communication where appropriate.

Example: a payroll list sent to all staff

Suppose a Japanese subsidiary is being reorganized and an executive accidentally emails all staff a spreadsheet containing names, employee ranks and salaries. The sender then asks everyone to delete it. The privacy team should preserve one controlled original, restrict the incident record, confirm the recipient list, check access and forwarding, and identify whether the file included other sensitive fields or more than the visible rows.

The team should assess the event under the APPI and current PPC guidance, including whether the data is personal data and whether a reportable category applies. It should record its decision, consult counsel, and determine any PPC report or individual notice required. It should separately decide how to communicate internally, correct the mailing-list or approval control, and respond to employees’ concerns. The example does not establish that reporting is required or that a particular employee has a damages claim.

Common response errors

• Assuming an internal email is automatically harmless because no public website was involved.
• Concluding that every salary disclosure is mandatorily reportable without checking the statutory categories.
• Treating “please delete” as proof that every copy disappeared.
• Destroying the original email before preserving the incident evidence.
• Re-sending the file to a larger group to explain what happened.
• Making an absolute “no one opened it” claim without access logs.
• Using a generic public announcement without assessing direct notice or secondary harm.
• Blaming one sender before reviewing mailing-list design, permissions and approval controls.

HR and privacy response checklist

1. Assign an incident lead and restrict access to the response record.
2. Stop forwarding and use appropriate quarantine or access controls.
3. Preserve the original message, attachment, headers, recipient list and audit logs.
4. Identify data fields, data subjects, volume, recipients and any external exposure.
5. Check access, downloads, forwarding, retention copies and provider involvement.
6. Assess the current APPI and PPC reporting/notice categories with Japanese counsel.
7. Record the decision, uncertainties, source versions and reassessment triggers.
8. Communicate confirmed facts and next update timing without overpromising.
9. Correct the process, permissions and training issue, then verify the change.

Questions about accidental HR disclosure in Japan

Is salary information personal data under the APPI?

Identifiable salary information can be personal information. Whether it is “personal data” and which APPI obligations apply depends on how the business holds and processes the information. Confirm the record context and the current statutory definitions.

Must an employer notify every employee after a salary email is misdirected?

Not automatically. Mandatory individual notice is tied to reportable incidents and applicable rules. Even where no mandatory notice is triggered, a carefully considered communication may be appropriate to explain containment and answer employee concerns.

Does an internal disclosure count as a data breach?

The factual question is whether personal data was leaked, lost, damaged or made accessible to unauthorized people under the APPI framework. “Internal” alone does not answer who was authorized or the purpose and circumstances of access.

Should the company publicly announce the incident?

Not automatically. PPC guidance says public announcement is generally not required except as an alternative to individual notice or where otherwise appropriate. Consider whether notice to affected employees is clearer and less likely to create additional exposure.

What information should be preserved?

Preserve the original message and attachment, headers, recipients, list membership, logs, access history, containment actions, relevant policy, and communication timeline. Keep the evidence in a restricted location and follow the organization’s legal-hold and retention rules.

Do employees have a right to delete the email?

The response should balance containment with investigation and any applicable retention duties. A recipient may be instructed not to use or forward the file, while the incident team preserves a controlled copy. Do not ask staff to destroy the only record of what happened.

Can an employee sue solely because colleagues saw their salary?

That conclusion cannot be drawn from disclosure alone. Any civil claim, damages or employment remedy depends on facts, harm, applicable law and evidence. Employees should receive a clear route to raise concerns, and the employer should obtain Japanese legal advice.

Is the company’s email provider responsible for reporting?

Responsibility depends on the parties’ roles and the specific APPI provision. A processor may have contractual and statutory duties to notify the business operator; the controller’s reporting responsibility should be assessed under current law and guidance.

For related Japan-specific records questions, see the guides to retirement certificates and 離職票 and electronic document evidence. For broader process design, explore Gotham workflows or contact the team. These resources do not replace Japan’s APPI analysis.

After containment, confirm the minimum facts with the incident owner: when the message was sent, whether delivery succeeded, whether the recipient opened or forwarded it, which attachment version was involved, whether anyone downloaded it, and what deletion or return steps were completed. Record facts separately from assumptions, and give the privacy lead a timeline rather than a conclusion. If the recipient is an employee, ask for confirmation through an approved channel and avoid requesting that they forward the sensitive file again. The organization should preserve the incident record according to its own retention and investigation controls.

Questions about an employee salary-data email incident in Japan

Is accidentally emailing salary data automatically an APPI violation?

Not automatically. Assess the data, recipient, access, purpose, safeguards, circumstances and resulting risk under the APPI and current PPC guidance.

Must every internal misdirected email be reported to the PPC?

No. Reporting and individual-notice duties are tied to specified reportable incidents and rules. Document the assessment and confirm the current trigger.

Should recipients be told to delete the email?

Contain further access and forwarding, but preserve a controlled incident copy and evidence. Coordinate deletion or quarantine instructions with the incident team.

Does APPI require a public announcement?

Public disclosure is not generally a separate automatic requirement; a public notice can be an alternative in some cases or may be appropriate depending on the incident.

Can employees pursue a claim after the disclosure?

A disclosure does not by itself establish a specific claim or damages. Individual remedies depend on facts and applicable law; route questions to Japanese counsel.

This article is general operational information, not Japanese legal advice. Whether an event is reportable under the APPI depends on current law, implementing rules, facts and any sector-specific reporting route. Obtain Japanese privacy counsel for an incident.
How Gotham researches and reviews field guides