We sent data to the wrong person — do we need to report it?
Short answer
Yes, this is a security breach, even if it was just one wrong line in an email. The only question is who to tell, and how fast.
On this page
1.This is a breach
The wrong recipient is unlawful disclosure. A breach is not only a hacking incident: a lost document, an open recipient list, or an email to the wrong person all fall into the same category.
In practice, this is the most common type of incident in small and medium organisations. It's worth having a written procedure for it in advance, rather than working it out from scratch every time.
2.Three separate decisions, and they don't line up
You always need to log it in the internal breach register. You need to notify the State Data Protection Inspectorate when there is a risk to the person's rights. You need to notify the person themselves when the risk is high.
These three decisions are made separately and recorded separately. A common mistake is concluding, from the fact that the authority didn't need to be notified, that it doesn't need to be logged in the register either.
| What to do | When | Deadline |
|---|---|---|
| Log it in the internal breach register | Always | Immediately, the same day |
| Notify VDAI (the State Data Protection Inspectorate) | If there is a risk to the person's rights | Within 72 hours of becoming aware |
| Notify the person themselves | If the risk is high | Without delay |
3.What to do in the first hour
Ask the recipient to delete the email and confirm it in writing. Record who sent it, to whom, when, and what data was in the email.
Then assess whether the data is sensitive. This answer determines the other two decisions, so get it in the first hour, not next week.
4.When you almost always need to notify the person
Health data, salary, a personal ID number, a copy of an identity document. When at least one of these ends up in the wrong hands, the risk is considered high.
The notice to the person is written in plain language: what happened, which of their data was affected, what you have already done, and what you advise them to do. No legal wording is needed here.
5.Confirmation of deletion does not undo the breach
The recipient's confirmation that they deleted the email reduces the risk and often leads to a decision not to notify. But the breach itself remains — it still gets logged in the register.
Also write down one change that reduces the chance of it happening again: checking recipients before sending, delaying sending by a minute, using the BCC field for mass emails.
For the broader incident procedure, see the separate answer on data security breaches.
Official legal text
We do not paraphrase the regulation's provisions here. The official Lithuanian text of the GDPR is available in one place and is more precise than any summary.
GDPR text in Lithuanian (EUR-Lex)