Definition
In Japan, the amended Act on the Protection of Personal Information (in force April 2022) made it mandatory to report to the Personal Information Protection Commission and notify the individuals affected when a breach involves special-care personal information, could cause financial harm, was (or may have been) done for a wrongful purpose, or affects more than 1,000 people, among other cases. The EU's GDPR requires notifying the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it.
Leaked data can't be taken back. As with the more than 153 million scanned driver's licenses — handed over at counters for identity checks — that were being sold on the dark web (Critical Brief 141), the check ends in a moment, but the stored raw data stays a breach candidate. Awa Bank's case, where customer and shareholder data sat in what was still labeled a test environment and leaked through unauthorized access (Critical Brief 142), is another example of a storage location's label drifting from what it actually held.
The first question after a breach is "how many records, whose, and which fields?" If access records don't exist or can be rewritten, the impact can't be narrowed, and reports and notifications have to be cast wide.
Lemma implementation
The damage of a breach is set by the amount of raw data held. Lemma has the issuer sign the raw data, and the receiving side checks only attributes such as "over 18" or "KYC passed" through selective disclosure. Because raw data never reaches the receiving server, a leak there carries out only commitments and proofs.
Where raw data must be stored, it stays encrypted under AES-GCM, and only the docHash and attribute commitments enter the circuit. Processing systems and AI inference without the decryption key use only the facts they need, never touching the original.
Checks made through Lemma leave a tamper-evident audit trail of who verified which attribute, and when. After a breach, what was read through that path can at least be shown as fact.