In this guide 6 sections
Often yes. A personal data breach covers personal data reaching someone who should not have it, by accident as well as by attack. An email to the wrong customer or a lost laptop can qualify. Record the facts at once, then let your lawyer decide on reporting.
What counts as a personal data breach
The word breach sounds like a hacker. In practice the definition is wider. If personal data was disclosed, lost, altered or made unreachable without authority, the event is a candidate. Intent does not matter. A mailing list sent with every address visible, a payslip attached to the wrong thread and a spreadsheet pasted into a public chat group all fit that wording exactly.
That means an honest slip counts. A salary sheet sent to the wrong colleague is a case. So is a customer list on a stolen laptop. Whether it is serious is a second question.
Treat each slip as an incident first. Judge the seriousness after you know what the file held and who saw it. Sort the facts first and the label second, because a calm record taken in the first hour is worth more than a long debate held a week later.
Four everyday slips and what each one needs
Take the wrong-recipient email. Ask what was attached, how many people are named in it and whether the recipient is a customer, a stranger or a competitor. Ask them to delete it and to confirm in writing. A file with a few names and phone numbers carries a different risk from a sheet holding addresses, ID numbers and loan details for the whole customer base.
A lost laptop turns on one fact. Was the disk encrypted and was a password needed? An encrypted disk with a strong login is a very different story from an open one with a synced mailbox.
A shared drive link left open to anyone is a quiet breach. Check the access log if there is one. A leaver still logged in to the CRM needs their session cut and their last actions reviewed. Pull the sharing log from the drive, note every viewer outside the company, and remove the link before you start asking who created it and why.
- Wrong-recipient email: attachment, names, recipient
- Lost laptop: encryption, login, synced accounts
- Open share link: who opened it and when
- Leaver still logged in: last activity and exports
Write it down while memory is fresh
Details fade within a day. Whoever finds the slip should note the time, the file name, the people involved and what they did next. Use a form, not a chat thread, so every incident has the same fields. Even one line, such as recall failed and the recipient replied at five, can save hours when the lawyer starts asking questions.
Keep the facts apart from the opinions. The log says the file held eighty names and addresses. It does not say it was probably fine. Judgement comes later and from someone other than the sender. Attach screenshots of the sent item, the bounce message and any reply, and store them in a folder that only the incident owner and the lawyer can open.
Add a line for what you did to contain it. Recall attempt, link disabled, password reset, recipient’s written confirmation.
- Date and time found, and who found it
- What data the file held and how many people
- Who received it and how they were reached
- Containment steps taken, with times
Who decides whether to report
Whether to tell the Data Protection Board and the people affected is a legal decision. It is not the office manager’s call and it is not mine. Pass the log to your lawyer the same day. The lawyer will weigh the kind of data, the number of people, how likely harm is and what you have already done, then decide who must be told.
Your job is to give the lawyer a clean record. They will ask for the data types, the volume, the likelihood of harm and the containment status. A complete log answers all four.
Do not delete the evidence while tidying up. Keep the sent email, the access log and the recipient’s reply. Keep staff from sending apologies or explanations to the affected person until that decision comes back, because early messages can be quoted later.
Cut the odds of the next slip
Most wrong-recipient incidents come from autocomplete. Turn off the contact suggestions for external domains, or add a hold-for-ten-seconds rule on mail with attachments. Small friction prevents most of them. Add a warning banner on any outgoing email with an attachment, since that small prompt makes people read the recipient line once more before they press send.
Prefer links with expiry to attachments, and review shared drive links monthly. Disable accounts on the leaver’s last day, not the following week. Review who still holds access to the CRM, the shared drive and the mail system every month, and compare the list against the current staff register.
Pick one slip type from your own history and fix it this month. Then brief the team on that single change.
Incident record sheet
A single page with six blocks. They cover when and who found it, what was exposed, who received it, containment steps with times, evidence kept and the hand-off to the lawyer. Tick boxes cover the four common slips, so staff fill it in under two minutes.
Open a blank worksheet to printQuestions owners ask
Is every misdirected email a reportable breach?
No. Many are low risk, especially when the recipient deletes the message and confirms. But each should be logged, and your lawyer decides whether a given one must be reported.
What if the laptop was encrypted?
Encryption lowers the risk a great deal, provided a strong login was needed. Still log the loss, disable the synced accounts and record how the encryption was confirmed.
Should we tell the customer ourselves?
Wait for your lawyer’s view. A well-meant message can create legal problems if it is vague or wrong. Prepare the facts so the notice can go quickly once approved.
How long should the incident log be kept?
Keep it as long as your lawyer advises. Add it to your retention schedule with its own period, start event and owner.