You sent an email to the wrong address. Now what?

Autocomplete fills in the wrong name, your finger presses "Send", and your pulse jumps when you realize a confidential document from a client file has gone to a stranger.

The first instinct is to try to recall the message and make sure the file was not opened. Under the law, however, a data security incident does not begin only at the moment of exposure. The very act of delivering the data and giving access to it already counts as "processing" and calls for an immediate response.

To assess the scope of the incident and consider reporting to the Authority, establish:

• What was in the body of the email, and was a document attached?
• What type of data is involved, and how many people does it concern?
• Who received it? A stranger, another client, a supplier or a colleague?
• Was the file or link protected by authentication, encryption or a password?
• Was the recipient actually able to open, download or forward the information?

Note: transport encryption alone protects the data in transit. It does not protect against a wrong recipient who received the message. By contrast, a revocable link, a secure portal or an encrypted file whose key was not shared may limit the actual exposure.

Not every mistake is a reportable incident

Following Amendment 13, processing or use of data also includes disclosure, exposure, transfer, delivery and granting access. Delivery to an unauthorized recipient may therefore amount to unauthorized use of data, even if the file was never opened. Even so, not every misdirected email is a "severe security incident" that must be reported to the Authority.

In a database at the high security level, use of data beyond or without authorization, or harm to its integrity, is a severe security incident. At the medium security level, the incident must affect a substantial part of the database.

What to do now

• Do everything possible to limit the exposure and, where possible, ask the recipient to delete the information and not pass it on.
• Document what was sent, to whom and when, what is known about opening, downloading or further forwarding, and every action taken in the matter.
• Classify the incident and assess the duty to report to the Authority and, where you are a processor, to the database controller as well.