Email to the wrong recipient: when is it a data breach?

An email sent to the wrong recipient can be a personal data breach even if only one message is affected. The relevant questions are which personal data were disclosed, who received them and whether prompt action can contain the risk. Article 4(12) GDPR also covers an accidental disclosure. Organisations should therefore not start with a blanket “72-hour rule”, but secure, assess and document the incident.

This article explains the practical steps after a misdirected email in Austria. It distinguishes a breach that must be documented from one that must be notified, explains the relevant risk factors and addresses communication with data subjects under Article 34 GDPR.

Article 4(12) GDPR defines a personal data breach as a security breach leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of or access to personal data. Intent is not required. An email containing names, contact details, contract documents, health information or internal comments can therefore be a confidentiality breach simply because it was addressed incorrectly.

Whether the supervisory authority must also be notified does not depend on the technical mistake alone. The key question is whether the breach is likely to result in a risk to the rights and freedoms of natural persons. An accidental disclosure remains an incident to document even if the recipient deletes the message after a request.

Secure the facts first. Record the time of sending, the time of discovery, the address used, the message content and all attachments. Check whether the email was opened, downloaded or copied to other recipients. A technical recall may help, but it does not replace the risk assessment.

Contact the wrong recipient in a controlled way and request that the message and attachments are not used, forwarded or retained. Ask for a clear confirmation. Recovery and evidence preservation are more difficult with an unknown recipient. Responsibility for the assessment should therefore be clear without delay. The data breach initial check helps structure the first review.

Several circumstances matter in the risk assessment. Consider how sensitive the data are, how many people and records are affected, whether children or vulnerable individuals may be involved and whether the data could be used for identity fraud, extortion, discrimination or another disadvantage. The duration of possible access also matters.

The recipient is a separate risk factor. A known processor or another contract-bound organisation may be able to delete the data reliably and refrain from further use. An unknown recipient, a private mailbox or a person with an interest in the data must be assessed differently. The EDPB refers to data sent to a wrong department or trusted service provider as a situation in which the relationship may lower the risk. It does not remove the obligation to document the breach.

Article 33 GDPR requires notification to the competent supervisory authority when the breach is likely to result in a risk to the rights and freedoms of natural persons. Notification must be made without undue delay and, where feasible, within 72 hours after awareness. In Austria, the Data Protection Authority provides an online form. If all information is not immediately available, Article 33(4) GDPR allows the notification to be supplemented in stages where necessary.

The notification should include the nature of the breach, where possible the categories and approximate number of affected individuals and records, a contact point, likely consequences and measures taken or proposed. If the assessment shows that a risk is unlikely, notification to the authority is not required. That decision should be recorded with its facts and reasoning. The overview of data breaches and notification duties places this assessment in context.

Article 34 GDPR sets a higher threshold. Individuals must be informed without undue delay if the breach is likely to result in a high risk to their rights and freedoms. Communication is therefore not automatically necessary after every misdirected email. An email to one trusted organisation followed by prompt deletion may not meet the high-risk threshold. Health data, access credentials, a large recipient group or an unknown recipient may lead to a different result.

The communication should explain the nature of the breach in clear language and describe likely consequences and measures already taken or planned. It should not be diluted by a general message or a regular newsletter. Also assess whether an exception under Article 34(3) GDPR applies, for example because effective technical measures such as encryption have removed the high risk.

Article 33(5) GDPR requires controllers to document every personal data breach. The record should describe the facts, effects and remedial measures so that the authority can verify compliance. It should also include the reasoned decision not to notify the authority or the affected individuals. A short note without a risk analysis is often insufficient when an incident is disputed.

Future incidents can be reduced through technical and organisational measures: separate recipient and copy fields, warnings for external addresses, a second check for sensitive attachments, encryption and clear rules for recall and deletion. The data breach documentation checklist supports the first record. The page on privacy governance and compliance addresses the organisational framework.

If a processor sent the email or discovers the incident first, it must inform the controller without undue delay. The controller generally decides whether notification under Article 33 GDPR and communication under Article 34 GDPR are required. Internal responsibility must not delay the assessment.

An error by one employee is not resolved merely because that employee is bound by confidentiality. The organisation must assess whether personal data reached an unauthorised recipient and whether its technical and organisational measures were adequate. A factual review is more useful than an immediate allocation of blame.