What should you do when an e-mail containing personal data reaches the wrong person?

Why this question arises at all

According to the UODO guide, one of the most common causes of breaches is actions or omissions of employees such as a simple mistake. A typical example of such a mistake is a misdirected e-mail in organisations that correspond daily with clients, patients or employees. It is usually caused by a wrong address or by autocomplete. Often it is also the wrong attachment or a list of recipients entered in the “To” field instead of “Bcc”. The European Data Protection Board (EDPB) notes that little can be done by the controller after such an error. Prevention is therefore even more important than for other breach types (Guidelines 01/2021, paragraph 106).

In practice organisations make two opposite mistakes. The first is the belief that a message to one person means “nothing happened”. The second is the automatic notification of every mistake without a risk assessment. Both come from skipping the questions on which the decision depends.

What has to be established before a decision

Is an e-mail sent to the wrong person a breach

A personal data breach is a breach of security leading among other things to the unauthorised disclosure of or access to personal data (Article 4(12) GDPR). When an e-mail sent to the wrong person contains personal data, what is at stake is precisely unauthorised disclosure. The definition also covers accidental events, so the absence of bad intent changes nothing. The guide of the President of UODO lists the mistaken sending of an e-mail containing personal data to a wrong and unauthorised recipient as an example of a possible confidentiality breach. The exception is a situation in which the controller has proof that the message was not delivered.

The line therefore runs through the recipient’s authorisation, not through whether the recipient is outside the organisation. According to the guide, the mistaken sending of an e-mail to a wrong but authorised recipient within the organisation is not a breach. At the same time the guide reminds readers that working within one organisation does not make every person authorised to process all the data. A message containing salary data sent to an employee without access to such data is therefore a confidentiality breach. A company in the same group is a separate entity. If it is not a joint controller of the data and does not process them on behalf of the controller, a message to its employee discloses them to a third party (Article 4(10) GDPR).

Classifying an event as a breach does not yet decide on notification, because the risk assessment decides that. According to the UODO guide, the controller should also document an incident classified as not being a breach, together with the reason for that decision.

What to do in the first hours

Time is what matters most. The employee should report the mistake at once to the data protection officer or to the person named in the procedure. Handling the matter alone delays the assessment. The first actions should limit the effects and preserve the material for the risk assessment. The data protection officer advises on the risk assessment, and the controller decides on notification through an authorised person. It is worth checking now who that person is and who stands in for them.

1. Contact with the recipient. The EDPB recommends sending the unintended recipients a message in “Bcc” with an apology and an instruction to delete the misdirected e-mail (Guidelines 01/2021, paragraph 117). The message should also advise them that they do not have the right to further use the e-mail addresses disclosed to them. It is worth saying the same about any other information disclosed. The UODO guide also mentions obtaining the recipient’s assurance that the information received will not be used. The message might read as follows.

2. Confirmation of deletion. It is worth asking the recipient for a short written confirmation that the message and the attachments have been deleted. The recipient also confirms that they have not passed them on to anyone and will not use the information they contain. In a case described by the EDPB, an insurance agent confirmed the deletion of the data in a written statement (Guidelines 01/2021, case no. 9).
3. Stopping further sending and access. Where the error arose in automated sending, the UODO guide lists stopping it as a way of containing the breach. Where the recipient is in the same organisation, the mail administrator can remove the message from their mailbox. Where a link to a file was sent instead of an attachment, sharing has to be revoked at once.
4. Securing the material. A copy of the sent message with its headers shows whose data went out and to what extent. The IT team also secures the mail server log entry, which shows the actual recipients and whether the recipient’s server accepted the message. The sent message should not be deleted from the Sent folder before the assessment.

A request to delete reduces the risk but does not exclude it. The EDPB points out that the controller cannot force the recipients to delete the message. Nor, therefore, can it be certain that they did so (Guidelines 01/2021, paragraph 112). In practice, recalling a message in the mail client usually does not work for an external recipient. It is therefore no substitute for contacting the recipient.

When the 72 hours start

Notification to the President of UODO must be made without undue delay and, where feasible, not later than 72 hours after becoming aware of the breach (Article 33(1) GDPR). With a misdirected e-mail, becoming aware usually does not require a long investigation. The EDPB gives the example of a third party who informs the controller that it has accidentally received the data of one of the controller’s customers and provides evidence. In such a situation there can be no doubt that the controller has become aware of the breach (Guidelines 9/2022, paragraph 33, example 2). A copy in the Sent folder usually gives similar certainty when the sender notices the mistake. According to the EDPB, the GDPR obliges the controller to ensure that it becomes aware of breaches in a timely manner (Guidelines 9/2022, paragraph 32). I therefore recommend stating in the procedure that the deadline runs from the moment the sender noticed the mistake. Establishing the scope of the data does not stop the deadline. Information that cannot be provided at once may be provided in phases without undue further delay (Article 33(4) GDPR).

The position is different when an e-mail sent to the wrong person came from a processor, for example an accounting firm or a payroll service provider. After becoming aware of a breach, the processor notifies it to the controller without undue delay (Article 33(2) GDPR). The risk assessment and the decision on notifying the authority are for the controller. In principle the controller becomes aware of the breach when the processor informs it (Guidelines 9/2022, paragraph 44). Where a mistake by a shared service centre acting as a processor affects the data of several companies, the centre notifies the breach to each of them (Guidelines 9/2022, paragraph 47). The rules for counting the deadline over a weekend are described in How to count the 72 hours for notifying a personal data breach?.

How to assess the risk when an e-mail sent to the wrong person contained data

The assessment concerns the risk to the individuals whose data are involved, not to the organisation (UODO guide, section 7.1). The controller should consider the severity of the potential impact on the rights and freedoms of individuals in combination with its likelihood (Guidelines 9/2022, paragraph 119). According to the UODO guide, what is assessed is the risk of effects occurring, not the damage actually caused. The result usually depends on six circumstances.

• Type of data. According to the UODO guide, a high risk may be indicated among other things by sensitive data, including financial and health data. The guide also lists the PESEL number (the Polish national identification number) and the series and number of an identity card. According to the EDPB, damage should be considered likely to occur where health data are involved (Guidelines 9/2022, paragraph 102). Data related to the provision of health care services are also health data if they reveal information about a person’s health status (Article 4(15) GDPR). An example is the name of a specialist clinic in a referral. The EDPB treats initial passwords in a message as a high-risk factor (Guidelines 9/2022, Annex B, example x).
• Scope and number of people. The wider the scope of the data and the more people, the higher the risk. Even a single person may suffer serious effects, depending on the type of data.
• People and possible effects. The UODO guide indicates that the data of children and older people and of people in need or in a difficult life situation increase the risk. The severity of possible effects, such as identity theft or financial loss, also increases it.
• Who the recipient is. A known and trusted recipient lowers the likelihood that the data will be used. An unknown or random recipient does not.
• Encryption. Strong encryption of an attachment makes it unintelligible if the password cannot be guessed and has not reached the wrong recipient. A password sent in a follow-up e-mail to the same address does not meet this condition.
• The recipient’s reaction. Quick confirmation of deletion lowers the likelihood of misuse. It does not, however, remove the risk arising from the type of data if the controller cannot show that the recipient did not read the data.

When a recipient is trusted

The EDPB allows the risk assessment to take into account that the data reached a “trusted” recipient (Guidelines 9/2022, paragraph 114). Examples are another department of the organisation or a supplier the controller commonly uses. The controller has an ongoing relationship with such a recipient and may be aware of its procedures. It can therefore reasonably expect the recipient not to read the data and to comply with an instruction to return it. Even if the data have been read, it may trust the recipient not to take any further action with them. The EDPB stresses that a breach has nevertheless occurred and has to be documented. Trust in the recipient may, however, remove the likelihood of risk to individuals. Notification to the authority and communication to data subjects may then no longer be required, but this depends on the assessment of the specific case.

The UODO guide sets two minimum conditions for this. The controller has an ongoing relationship with the recipient and knows the relevant details of how it operates. These include, for example, its security procedures and a history of positive cooperation.

The controller must also be ready to show that it applied this concept correctly. A colleague from another department or a group company can therefore be a trusted recipient only after both conditions have been checked.

The line is well illustrated by a case in which the Supreme Administrative Court (NSA) gave judgment on 1 October 2025 (III OSK 1830/22). An insurer sent a former client an e-mail with an unencrypted attachment containing among other things the first name, surname and PESEL number of another person and an insurance offer. The President of UODO fined the controller for not notifying the breach and not communicating it to that person. The court of first instance held that the former client could not be treated as a trusted recipient. It nevertheless set aside the decision, because in its view the authority had not sufficiently explained why it assumed a high risk. The NSA held that the mere disclosure of the PESEL number together with the first name and surname resulted in a high risk, although it concerned one person and one recipient. It also held that the controller was obliged to communicate the breach to that person. The NSA set aside the judgment and referred the case back to the court of first instance for reconsideration.

What typical outcomes look like

The EDPB guidelines and the NSA judgment show how the same circumstances translate into a decision. Each outcome depends on the full facts and does not transfer directly to another event. Internal documentation is mandatory in each of the cases listed in the table.

Situation	Outcome	Basis	Decisive circumstances, exceptions and limits
A spreadsheet e-mailed to an insurance agent contains contact and insurance details of two dozen clients outside his remit. The agent is bound by professional secrecy, reports the error and confirms deletion in writing	documentation only	Guidelines 01/2021, case no. 9	trusted recipient; few people and no special categories of data; immediate report and confirmed deletion
A list of 15 course participants with names, e-mail addresses and the lactose intolerance of two people is sent to 15 former participants instead of the hotel	documentation only	Guidelines 01/2021, case no. 15	with health data a high risk is usually assumed; the EDPB saw no possible damage in this case because of the nature of this particular information; very little data and very few people; the controller contacted the recipients immediately
A marketing e-mail with recipients’ addresses visible in the “To” or “Cc” field	notification may be mandatory with a large number of people, sensitive data or other high-risk factors such as initial passwords; communication depending on the data and consequences	Guidelines 9/2022, Annex B, example x	notification may not be necessary where no sensitive data and only a small number of e-mail addresses are revealed
Personal data of a large number of students mistakenly sent to the wrong mailing list with over 1,000 recipients	notification, communication depending on the data and consequences	Guidelines 9/2022, Annex B, example ix	the EDPB makes communication depend on the scope and type of data and the severity of consequences; it does not state the type of data
An attachment with among other things the first name, surname and PESEL number of one person sent to a former client	notification and communication according to the NSA; the case went back for reconsideration	NSA judgment III OSK 1830/22	the PESEL number with the first name and surname decided the high risk (NSA); an untrusted recipient, no encryption and directly identifying data decided the duty to notify (court of first instance)
An attachment with the data of over 60,000 jobseekers, including social security numbers, attached to a message sent to those people	notification and communication	Guidelines 01/2021, case no. 14	a large number of people and the social security number; the controller could not enforce the request to delete

A low risk usually results from several circumstances at once. A limited scope of data is then combined with a small number of people and a quick reaction, and often also with a trusted recipient. A single circumstance that increases the risk, for example a PESEL number in the attachment, may decide that the risk is high. If in doubt, the EDPB indicates that the controller should notify the breach (Guidelines 9/2022, paragraph 119).

When data subjects have to be informed

Communication to data subjects is a decision separate from notification to the authority and has a higher threshold. The controller communicates the breach to the data subject without undue delay if the breach is likely to result in a high risk to the rights and freedoms of natural persons (Article 34(1) GDPR). With a misdirected e-mail, such a risk usually arises with data that allow someone to impersonate the person or that concern their health or finances. A recipient who cannot be regarded as trusted increases it.

The GDPR provides for three situations in which communication is not required (Article 34(3)). The first concerns data protected beforehand, in particular by encryption that renders them unintelligible to unauthorised persons (point (a)). The second concerns measures taken after the breach which ensure that the high risk is no longer likely to materialise (point (b)). The third concerns disproportionate effort and requires communication to be replaced by an equally effective public communication or similar measure (point (c)). If the controller has not already communicated the breach to the data subjects, the supervisory authority may require it to do so or decide that one of these three conditions is met (Article 34(4) GDPR). The authority takes either decision having considered the likelihood of a high risk.

In my assessment, a mere statement by an unknown recipient that the message has been deleted is not enough to rely on the second exception. The controller cannot verify such a statement. In case no. 14 the controller asked the recipients to delete the message, but according to the EDPB it could not be certain that they did so (Guidelines 01/2021, paragraph 112). Given the high risk, the EDPB regarded communication to data subjects as self-evident in that case (Guidelines 01/2021, paragraphs 111 and 113). The position may be different with a trusted recipient whose procedures the controller knows.

The communication describes in clear and plain language the nature of the breach. It also gives at least the name and contact details of the data protection officer or another contact point. In addition it describes the likely consequences and the measures taken or proposed by the controller (Article 34(2) read with Article 33(3)(b) to (d) GDPR). The channel and language of the communication are described in How do you notify data subjects of a breach and what must the communication contain?.

What to record in the documentation

The controller documents any personal data breaches, comprising the facts relating to the breach, its effects and the remedial action taken (Article 33(5) GDPR). The documentation must enable the authority to verify compliance with Article 33. With an unnotified misdirected e-mail, it is the main evidence that the decision followed from a risk assessment.

The entry on a misdirected e-mail is worth dividing into four groups of information. The first is the facts, that is the time of sending and of becoming aware, the type of recipient and the cause of the mistake. The facts also include the number of people and the scope of the data in the body and in the attachments. The second is the actions, that is the message to the recipient and the date of the confirmation of deletion. The third is the risk assessment with the possible effects on individuals. It includes the arguments for treating the recipient as trusted, if the controller relies on this. The fourth is the decision together with the function of the person who took it. The EDPB recommends documenting the reasoning for the decision, in particular where a breach is not notified (Guidelines 9/2022, paragraph 125). Where an exception under Article 34(3) applies, the controller should have evidence that it is met. A notification made after 72 hours must be accompanied by reasons for the delay (Article 33(1) GDPR). According to the UODO guide, the controller should keep information on breaches for as long as possible, because the GDPR sets no period after which it may be deleted. For that reason the guide indicates that entering any personal data in the internal breach register is neither required nor recommended. It also reminds readers that the risk assessment may need updating as new information comes in. The assessment and the decision may change if the recipient does not reply or passes the data on.

How to limit a repeat

According to the EDPB, a combination of organisational and technical measures chosen for the specifics of the case should help reduce the likelihood of a repeat (Guidelines 01/2021, paragraphs 122 and 123). The list of recommended measures is by no means exclusive or comprehensive. It includes among other things listing recipients in the “Bcc” field by default when there are several and extra confirmation when sending to several addresses outside that field. It goes on to name the “four eyes” principle and a delay in sending that allows a message to be recalled. Disabling autocomplete of addresses is also among the recommended measures. The UODO guide adds encryption of e-mails and attachments with a unique password available only to the recipient. It also points to checking that an attachment contains only the data meant to be sent.

Choosing these measures serves the duty to ensure a level of security appropriate to the risk. That duty covers the risk of unauthorised disclosure of personal data transmitted (Article 32(1) and (2) GDPR). It is worth starting with the processes that send personal data most often, for example HR, billing and customer service. Analysing the cause of each misdirected e-mail shows whether the error was a one-off or results from a faulty process.

Common mistakes

• Waiting for the recipient’s reply before the assessment. The 72 hours run from becoming aware of the breach, not from the confirmation of deletion.
• Treating a recipient as trusted only because the recipient is known. A former client is not a trusted recipient merely because they once worked with the controller.
• Assessing only the body of the message without the attachment. Where the message had an attachment, the content of the file usually decides the risk.

Conclusions and next steps

An e-mail sent to the wrong person calls for a reaction that is both quick and orderly. A message template prepared in advance speeds up contact with the recipient, and assessment criteria allow the event to be assessed in time.

1. Prepare a template message to the unintended recipient with an instruction to delete and a request for confirmation.
2. Set out in the procedure to whom an employee reports a mistake and how you establish the moment of becoming aware of the breach.
3. Name the person who decides on notification and their deputy.
4. Set the criteria for a trusted recipient and the way they are documented.
5. Introduce technical measures such as the “Bcc” field and a sending delay in the processes that send personal data most often.

Related materials

• Does every data breach need to be reported? — the notification threshold and the general rules of risk assessment.
• How to count the 72 hours for notifying a personal data breach? — the moment of becoming aware and counting the deadline.
• How do you notify data subjects of a breach and what must the communication contain? — the content, channel and language of the communication.
• What should a personal data breach register contain? — the entry on a breach, including a breach that was not notified.

Sources

• Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR), consolidated version — Article 4(10), (12) and (15), Article 32(1) and (2), Article 33(1), (2), (3)(b) to (d), (4) and (5) and Article 34 — eur-lex.europa.eu.
• European Data Protection Board, Guidelines 01/2021 on Examples regarding Personal Data Breach Notification, version 2.0 adopted on 14 December 2021 — case no. 9 (section 4.2) and cases no. 14 and 15, paragraphs 106, 111 to 113, 117, 122 and 123 (section 6) — edpb.europa.eu.
• European Data Protection Board, Guidelines 9/2022 on personal data breach notification under GDPR, version 2.0 adopted on 28 March 2023 — paragraphs 32, 33, 44, 47, 102, 114, 119 and 125 and Annex B — edpb.europa.eu.
• Personal Data Protection Office (UODO), Guide on personal data breaches, version of 20 February 2025 — sections 2.1, 2.3, 2.4, 4.2, 6.1, 7 and 8.1 (in Polish) — uodo.gov.pl.
• Judgment of the Supreme Administrative Court of 1 October 2025, case no. III OSK 1830/22, Central Database of Administrative Court Judgments (in Polish) — orzeczenia.nsa.gov.pl.