Panasonic HR data on 334,000 uploaded to banned AI

Panasonic says HR data went into a banned AI service

On October 23, 2026, Panasonic Operational Excellence announced that part of the group's HR data had been uploaded to an outside generative AI service that the company prohibits. The data came from its HR information system as it stood in April 2026. Panasonic has not said which AI service was used.

A generative AI service, such as ChatGPT, is an online tool that writes answers or summaries from the text and files you give it. For other breaches Japanese companies have disclosed, see Japan data breach list: cases by date and cause.

A member of an HR system project broke the company's rules

The upload was made by a member of a project to roll out a new HR information system, which Panasonic Operational Excellence runs with its subsidiary Panasonic Digital. The company stresses that nobody broke in from outside. The cause was a project member going against internal rules.

The notice replaces letters, and no action is needed

Panasonic published the notice in place of contacting each affected person. Under Japan's privacy law, the Act on the Protection of Personal Information, a company that leaks personal data must normally tell each person involved. When that is hard to do, the law lets it take other steps that protect those people instead.

Panasonic Operational Excellence says there is nothing affected people need to do. The notice does not explain why the company chose a public notice over individual contact.

About 334,000 employees, ex-staff and relatives affected

The people affected are current and former employees of Panasonic Group companies in Japan that use the group-wide HR system, and their family members. Former employees include people who moved to companies that bought Panasonic businesses. The notice gives a count for each of four groups, which add up to about 334,000.

Who is affected and what data was uploaded (from Panasonic's notice)

Group	People	Data uploaded
Employees	About 75,000	Employee number, address, phone number, email address
Former employees (left between 1978 and fiscal 2026)	About 178,000	Employee number, address, phone number, email address
Employees' family members	About 55,000	Name, address, phone number, email address
Former employees' family members (people who left in 2016 or later)	About 26,000	Name, address, phone number, email address

The 334,000 figure is the sum of the four groups. Panasonic's notice does not state a total.

Employee records include addresses but not names

For current and former employees, the uploaded data covers employee number, address, phone number and email address, but no names. The former employees are about 178,000 people who left the company between 1978 and fiscal 2026.

Family records come from emergency contact details

The family data is the emergency contact information employees filed with the company, so it includes each relative's name, address, phone number and email address. Only relatives whom employees entered in the HR system themselves are affected. For former employees, only the families of people who left in 2016 or later are included.

No misuse found, and the AI provider says training was off

Panasonic Operational Excellence says it has found no case of the data being posted publicly or misused. After checking internally and with the AI provider, it also confirmed the data will not be put to any other use.

To keep this from happening again, the company will review its rules for handling personal data and how it controls staff use of generative AI. It will also give the staff involved more training. Former employees and their families can reach the company through an inquiry form on the notice page.

Panasonic told the privacy regulator on September 29

Panasonic Operational Excellence reported the upload to Japan's Personal Information Protection Commission on September 29, 2026, 24 days before the public notice. Right after the upload came to light, the project member deleted the AI chat history and the data saved on their work computer.

The provider kept deleted data for 30 days, until October 25

The company that runs the AI service told Panasonic that the setting for using uploaded data in AI training was switched off at the time. That means the data was not used to improve the AI and will not appear in answers to other users.

Even after a user deletes data, the provider keeps it for 30 days for security and legal reasons. During that time, access is tightly controlled and happens only for audits or similar requests. The 30 days ran out on October 25, and the provider no longer holds the data.

How companies and staff can keep personal data out of AI

In Panasonic's case, a ban on the AI service was already in place, and a project member still uploaded personal data to it. A company that uses generative AI needs both clear company rules and employees who are careful with data.

On June 2, 2023, Japan's Personal Information Protection Commission published an alert on generative AI for both businesses and individual users. The two steps below are based on that alert.

Decide which AI tools staff may use and what data can go in

The Commission says a business that enters personal information into a generative AI tool must first check that doing so fits the purpose it collected the data for. Putting personal data into a prompt without consent may break Japan's privacy law if the data is then used for anything beyond producing the answer. A company that does so should confirm the provider will not use the data for machine learning.

On top of that, list the AI services staff may use and spell out which information can and cannot go into them. When an approved tool is available, employees have less reason to reach for a banned one.

Check company rules and the tool's terms before uploading

Before using a generative AI service for work, employees should check that their employer's rules allow it. Even with an approved tool, the Commission warns that personal information you enter may be used for machine learning and later appear in the tool's output, accurate or not.

Read the service's terms of use and privacy policy, and decide based on what you plan to enter. Never upload a file that still contains customers' or colleagues' personal details. For another company that restricted an AI tool through internal rules, see Alibaba bans Claude Code over hidden tracking code.