Methods and apparatus, including computer program products, implementing and using techniques for causing an application program containing personal information to operate on an operating system. It is detected whether the application program outputs, transfers or generates data to the outside of a storage region of the application program. A real-time determination is made as to whether or not the data is subject to personal information management. Processing of the application program is continued, interrupted or corrected based the determination. Personal information is detected by scanning contents of the data when the data is subject to personal information management. Detected personal information is displayed to a user. A result of the determination is input according to a level of risk against the data for the user. Contents of the determination result is stored as a history. A risk indicator for the data is computed and displayed to the user.