4.4Data breach: what to do?
The essentials in 30 seconds
- Breach ≠ hacking: the email to the wrong recipient is one too.
- Your role = report fast: DPO/IT immediately, with the facts (what, who, when, which data).
- Never conceal: a reported error is managed, a hidden one becomes misconduct.
Running mini-case — Karim sends to the wrong recipient
Friday 16h12: Karim sends a file of 200 clients to the wrong external contact. His heart skips a beat — then his reflexes speak: he tries to recall the message, asks in writing for the file to be deleted, and at 16h25 he reports to the data contact with the facts (what, who, when, which data), without minimising or dramatising. His fast report leaves the organisation time to analyse and notify according to the rules. Final episode of the thread: Karim has moved from inventory to reflex.
Final episode of case 4.1-4.3 — Karim closes the loop: see, forward, prevent, report.
1. What a breach is
A data breach (leak, theft, accidental disclosure, ransomware) affects personal data — including an email to the wrong recipient, a lost USB stick or a file shared too widely.
So it is not necessarily hacking: Karim's ordinary mistake is one too. Recognising it as such is already treating it.
2. The countdown
Under the European framework, the organisation must notify the authority within 72 hours if the breach poses a risk to individuals, and sometimes inform the individuals concerned (high risk: sensitive data, credentials…).
Every hour of internal silence counts: Karim's immediate report gives the organisation time to analyse, document and notify according to the rules.
3. Report, never conceal
Your role: report immediately any doubt (email to the wrong recipient, lost device, intrusion) to IT/DPO. A false alert is better than a hidden incident.
Analysis and notification are their job; speed is yours. Reporting your own mistake is not self-incrimination: it protects individuals and the organisation — concealment is misconduct.
🔎 Concrete example — 🔎 Concrete example — The email sent to the wrong recipient
Karim's ideal reaction, minute by minute:
Min 0-5: recall the message + deletion confirmed in writing requested
Min 5-15: report to the DPO (what: 200-client file, who: external contact,
when: 16h12, which data: names, phones)
Rule: reporting fast = leaving time to analyse and notify
→ an error reported in time is managed; hidden, it becomes a scandalReading: act then report, with precise facts, without delay.
Lesson: a reported error is managed; concealed, it makes everything worse.
Section vocabulary
- Data breach
- Any incident affecting personal data: leak, unauthorised access, loss, destruction — including the email to the wrong recipient.
Simple example: The 200-client file Karim sent to the wrong contact is a breach, not a blunder.
What it is not: only a spectacular hack by hackers.
Reflex: if in doubt (wrong recipient, lost device): treat as a breach.
- Notification to the authority
- Under the European framework, the organisation must notify the authority within 72 hours if the breach poses a risk to individuals.
Simple example: Karim's 16h25 report gives the organisation time to analyse and notify.
What it is not: an apology email sent alone to the recipient, saying nothing internally.
Reflex: report in minutes, not days: every hour counts.
- Informing individuals
- If the risk is high (sensitive data, credentials…), the individuals concerned must also be warned.
Simple example: If Karim's file held sensitive data, the 200 clients should be informed.
What it is not: warning everyone for every incident, even with no risk.
Reflex: let the contact assess the risk before informing.
- Breach register
- Every breach, even minor, is documented internally: it is an obligation and a useful record.
Simple example: Karim's mistake is logged with facts and measures, even once fixed.
What it is not: closing the case with no trace because 'it worked out'.
Reflex: write the facts the same day, while they are fresh.
- Immediate internal reporting
- YOUR role: alert DPO/IT as soon as discovered — analysis and notification are their job, speed is yours.
Simple example: Karim reports at 16h25 with what, who, when and which data.
What it is not: waiting until Monday or investigating alone before speaking up.
Reflex: keep the DPO/IT contact as accessible as the emergency one.
In practice — In practice — Simulation: the email sent to the wrong recipient
- Scenario: you have just sent a 200-client file to the wrong external contact. Mentally time your ideal reaction.
- Minute 0-5: try to recall the message (the mail client sometimes allows it), ask the recipient for deletion confirmed in writing.
- Minute 5-15: report to the DPO/contact with the facts: what, who, when, which data — without minimising or dramatising.
- Note the countdown rule: your immediate report gives the organisation time to analyse and notify according to the rules. Delaying = aggravating.
Ready-to-say script — alerting the DPO after a mistake (30 s)
'This is Karim: at 16h12 I mistakenly sent a 200-client file (names, phones) to an external contact. I tried recalling it and asked for deletion in writing. I am sending you the original message and the recipient's details for analysis.'
Say or write within minutes; precise facts, without minimising or dramatising.
Copy-paste template — breach reflex sheet
OBSERVED ON (date + time): _______________
WHAT (file, incident): _______________
WHO (recipient / people concerned): _______________
WHICH DATA (personal? sensitive?): _______________
ACTIONS ALREADY TAKEN (recall, deletion requested): _______________
REPORTED TO DPO / IT ON (time): _______________Lost USB stick
Same reflex with no recipient: report with the presumed content — encrypted, it is a lost object; in the clear, it is a leak.
Likely false alert
Report anyway: a false alert costs nothing, a hidden incident costs everything — triage is the experts' job.
Incident on Friday evening
Do not wait until Monday: call the on-call contact — the countdown does not know weekends.
Silent colleague at fault
Encourage them to report themselves at once, otherwise alert: covering up concealment also engages your responsibility.
✓ Best practices
- Report immediately, even if in doubt.
- Precise facts: what, who, when, which data.
- Never conceal a send error.
✗ Common pitfalls
- Hiding the incident (guaranteed aggravation).
- 'Just a blunder', with no report.
- Waiting: the countdown is ticking.
Key takeaways
- A breach is not necessarily hacking: a send error is one too.
- Immediate internal reporting is vital: it gives the organisation time to analyse and notify.
- Reporting a mistake is not self-incrimination: it protects individuals and the organisation — concealment is misconduct.
- Your role stops at fast factual reporting: analysis and notification belong to the DPO.
48h challenge — apply tomorrow
Fill in the breach reflex sheet with your real DPO/IT contacts, keep it at hand, and mentally replay the simulation of the stray email.
- I can define a breach with a non-hacker example.
- I can explain why reporting must be immediate.
- I have my reflex sheet with the real contacts.
Frequently asked questions
Do I risk a sanction if I report my own mistake?
Healthy organisations value fast reporting (it is what limits damage) and punish concealment. An error reported in time is managed; discovered weeks later, it becomes a scandal.
Are all breaches notified to the authority?
No: the organisation assesses the risk to individuals. With no risk, simple internal documentation; with risk, notification within the time limits; high risk, informing individuals as well. That is the DPO's business — fed by your report.
Karim sent the client file to the wrong recipient. First reflex?