Customer data sent to wrong person

Hello there. I am Gemma from Lawyer Destroyer. Dealing with a data mix-up can be stressful, but try not to panic. Sending customer data to the wrong person is a personal data breach under the UK GDPR. Handling it quickly and calmly is the best approach. Here is what you should do.

Immediate containment steps:

1. Recall the message if possible. If you sent the data by email, see if your system allows you to recall the message before it is opened.

2. Contact the incorrect recipient immediately. Explain politely that the data was sent in error. Ask them to delete the email or return the physical documents straight away. Crucially, ask them to reply confirming they have done this and have not saved, copied, or shared the information.

3. Stop any further mistakes. Double-check your systems to make sure no automated follow-up messages or letters are scheduled to go to the wrong address.

Assessing the risk:

Once you have tried to contain the data, you need to work out the level of risk to the customer whose information was exposed. This assessment dictates your legal obligations. Consider what type of data was sent. Basic contact details might be low risk, but financial information, identity documents, or sensitive personal details like health records are high risk. You should also consider who received the data. A trusted business partner who deletes it immediately poses less risk than an unknown member of the public.

The legal position on reporting:

Depending on your risk assessment, you have strict duties under data protection law regarding who you must inform.

1. Informing the Information Commissioner's Office. The ICO is the data regulator for England and Wales. If the breach is likely to result in a risk to the affected customer, you are legally required to report it to the ICO within 72 hours of becoming aware of the mistake. If you decide the risk is practically non-existent because the data was completely harmless and quickly deleted, you do not have to report it.

2. Informing the customer. If the breach poses a high risk to the customer, you must tell them without undue delay. This is to allow them to take practical steps to protect themselves, for instance by changing passwords or monitoring their bank account. When contacting them, be clear and honest about what happened, outline what you are doing about it, and offer a sincere apology.

Keeping an internal record:

Even if you decide the breach is minor and does not need to be reported to the ICO or the customer, the law requires you to keep an internal written log of every data incident. In your company records, write down a summary of the facts, exactly what data was involved, your reasoning for the risk level, and the steps you took to resolve it.

Improving for the future:

Finally, look at how the mistake happened so you can prevent it. If an email auto-fill feature caused the problem, you might want to switch that setting off or set up a delay on your outbox. If it was simple human error, it might be time for a short training refresher with your team on checking attachments and addresses before hitting send.