{"id":6252,"date":"2026-11-07T16:47:25","date_gmt":"2026-11-07T15:47:25","guid":{"rendered":"https:\/\/www.lablogic.pl\/?p=6252"},"modified":"2026-11-07T16:55:27","modified_gmt":"2026-11-07T15:55:27","slug":"e-mail-sent-to-the-wrong-person","status":"publish","type":"post","link":"https:\/\/www.lablogic.pl\/en\/e-mail-sent-to-the-wrong-person\/","title":{"rendered":"What should you do when an e-mail containing personal data reaches the wrong person?"},"content":{"rendered":"\n

Micha\u0142 Rutkowski<\/strong><\/a> \u2022 for DPOs and breach response teams \u2022 published November 7, 2026 \u2022 13 min read<\/p>\n\n\n\n

\n
\n
\n\n\n\n<\/div>\n<\/div>\n\n\n\n
\n
\n

Short answer<\/h2>\n\n\n\n

An e-mail sent to the wrong person is a personal data breach if the recipient was not authorised to receive the data. The exception is proof that the message was not delivered. The employee should report the mistake at once to the data protection officer or to the person named in the procedure. It is worth asking the recipient to delete the message and confirm this in writing, and keeping a copy of the message that was sent. The risk to individuals depends on the type and scope of the data and on the number of people concerned. It also matters who the recipient is, whether the attachment was encrypted and how the recipient reacted. Where the breach is unlikely to result in a risk to individuals, documenting the breach is enough. In all other cases the controller notifies the breach to the President of UODO without undue delay and, where feasible, within 72 hours of becoming aware of it. A processor notifies every breach to the controller without undue delay. Where the risk is high, the controller also communicates the breach to data subjects. It does not have to do so if protection measures applied earlier (for example encryption) made the data unintelligible. Nor does it have to do so if subsequent measures ensured that the high risk is no longer likely to materialise. Where communication would involve disproportionate effort, the controller replaces it with an equally effective public communication or similar measure. Every breach is documented.<\/p>\n<\/div>\n\n\n\n

Why this question arises at all<\/h2>\n\n\n\n

According to the UODO guide, one of the most common causes of breaches is actions or omissions of employees such as a simple mistake. A typical example of such a mistake is a misdirected e-mail in organisations that correspond daily with clients, patients or employees. It is usually caused by a wrong address or by autocomplete. Often it is also the wrong attachment or a list of recipients entered in the \u201cTo\u201d field instead of \u201cBcc\u201d. The European Data Protection Board (EDPB) notes that little can be done by the controller after such an error. Prevention is therefore even more important than for other breach types (Guidelines 01\/2021, paragraph 106).<\/p>\n\n\n\n

In practice organisations make two opposite mistakes. The first is the belief that a message to one person means \u201cnothing happened\u201d. The second is the automatic notification of every mistake without a risk assessment. Both come from skipping the questions on which the decision depends.<\/p>\n\n\n\n

What has to be established before a decision<\/h2>\n\n\n\n

Is an e-mail sent to the wrong person a breach<\/h3>\n\n\n\n

A personal data breach is a breach of security leading among other things to the unauthorised disclosure of or access to personal data (Article 4(12) GDPR). When an e-mail sent to the wrong person contains personal data, what is at stake is precisely unauthorised disclosure. The definition also covers accidental events, so the absence of bad intent changes nothing. The guide of the President of UODO lists the mistaken sending of an e-mail containing personal data to a wrong and unauthorised recipient as an example of a possible confidentiality breach. The exception is a situation in which the controller has proof that the message was not delivered.<\/p>\n\n\n\n

The line therefore runs through the recipient\u2019s authorisation, not through whether the recipient is outside the organisation. According to the guide, the mistaken sending of an e-mail to a wrong but authorised recipient within the organisation is not a breach. At the same time the guide reminds readers that working within one organisation does not make every person authorised to process all the data. A message containing salary data sent to an employee without access to such data is therefore a confidentiality breach. A company in the same group is a separate entity. If it is not a joint controller of the data and does not process them on behalf of the controller, a message to its employee discloses them to a third party (Article 4(10) GDPR).<\/p>\n\n\n\n

Classifying an event as a breach does not yet decide on notification, because the risk assessment decides that. According to the UODO guide, the controller should also document an incident classified as not being a breach, together with the reason for that decision.<\/p>\n\n\n\n

What to do in the first hours<\/h3>\n\n\n\n

Time is what matters most. The employee should report the mistake at once to the data protection officer or to the person named in the procedure. Handling the matter alone delays the assessment. The first actions should limit the effects and preserve the material for the risk assessment. The data protection officer advises on the risk assessment, and the controller decides on notification through an authorised person. It is worth checking now who that person is and who stands in for them.<\/p>\n\n\n\n

    \n
  1. Contact with the recipient.<\/strong> The EDPB recommends sending the unintended recipients a message in \u201cBcc\u201d with an apology and an instruction to delete the misdirected e-mail (Guidelines 01\/2021, paragraph 117). The message should also advise them that they do not have the right to further use the e-mail addresses disclosed to them. It is worth saying the same about any other information disclosed. The UODO guide also mentions obtaining the recipient\u2019s assurance that the information received will not be used. The message might read as follows.<\/li>\n<\/ol>\n\n\n\n
    \n

    The message of [date] reached you by mistake, for which we apologise. You are not authorised to use the information it contains. Please delete it permanently together with its attachments and do not pass it on. Please also confirm by replying to this e-mail that the message and its attachments have been deleted and have not reached anyone else and that the content of the message and its attachments will not be used or passed on.<\/p>\n<\/div>\n\n\n\n

      \n
    1. Confirmation of deletion.<\/strong> It is worth asking the recipient for a short written confirmation that the message and the attachments have been deleted. The recipient also confirms that they have not passed them on to anyone and will not use the information they contain. In a case described by the EDPB, an insurance agent confirmed the deletion of the data in a written statement (Guidelines 01\/2021, case no. 9).<\/li>\n\n\n\n
    2. Stopping further sending and access.<\/strong> Where the error arose in automated sending, the UODO guide lists stopping it as a way of containing the breach. Where the recipient is in the same organisation, the mail administrator can remove the message from their mailbox. Where a link to a file was sent instead of an attachment, sharing has to be revoked at once.<\/li>\n\n\n\n
    3. Securing the material.<\/strong> A copy of the sent message with its headers shows whose data went out and to what extent. The IT team also secures the mail server log entry, which shows the actual recipients and whether the recipient\u2019s server accepted the message. The sent message should not be deleted from the Sent folder before the assessment.<\/li>\n<\/ol>\n\n\n\n

      A request to delete reduces the risk but does not exclude it. The EDPB points out that the controller cannot force the recipients to delete the message. Nor, therefore, can it be certain that they did so (Guidelines 01\/2021, paragraph 112). In practice, recalling a message in the mail client usually does not work for an external recipient. It is therefore no substitute for contacting the recipient.<\/p>\n\n\n\n

      When the 72 hours start<\/h3>\n\n\n\n

      Notification to the President of UODO must be made without undue delay and, where feasible, not later than 72 hours after becoming aware of the breach (Article 33(1) GDPR). With a misdirected e-mail, becoming aware usually does not require a long investigation. The EDPB gives the example of a third party who informs the controller that it has accidentally received the data of one of the controller\u2019s customers and provides evidence. In such a situation there can be no doubt that the controller has become aware of the breach (Guidelines 9\/2022, paragraph 33, example 2). A copy in the Sent folder usually gives similar certainty when the sender notices the mistake. According to the EDPB, the GDPR obliges the controller to ensure that it becomes aware of breaches in a timely manner (Guidelines 9\/2022, paragraph 32). I therefore recommend stating in the procedure that the deadline runs from the moment the sender noticed the mistake. Establishing the scope of the data does not stop the deadline. Information that cannot be provided at once may be provided in phases without undue further delay (Article 33(4) GDPR).<\/p>\n\n\n\n

      The position is different when an e-mail sent to the wrong person came from a processor, for example an accounting firm or a payroll service provider. After becoming aware of a breach, the processor notifies it to the controller without undue delay (Article 33(2) GDPR). The risk assessment and the decision on notifying the authority are for the controller. In principle the controller becomes aware of the breach when the processor informs it (Guidelines 9\/2022, paragraph 44). Where a mistake by a shared service centre acting as a processor affects the data of several companies, the centre notifies the breach to each of them (Guidelines 9\/2022, paragraph 47). The rules for counting the deadline over a weekend are described in How to count the 72 hours for notifying a personal data breach?<\/a>.<\/p>\n\n\n\n

      How to assess the risk when an e-mail sent to the wrong person contained data<\/h3>\n\n\n\n

      The assessment concerns the risk to the individuals whose data are involved, not to the organisation (UODO guide, section 7.1). The controller should consider the severity of the potential impact on the rights and freedoms of individuals in combination with its likelihood (Guidelines 9\/2022, paragraph 119). According to the UODO guide, what is assessed is the risk of effects occurring, not the damage actually caused. The result usually depends on six circumstances.<\/p>\n\n\n\n