Sent an Email to the Wrong Person? A UK GDPR Guide

TL;DR: If you have just emailed personal data to the wrong person, act now. Ask the recipient to delete it and confirm, tell whoever handles data protection, and write down what happened. A misdirected email is a personal data breach if it contained personal data. Not every breach has to be reported. You must tell the ICO within 72 hours only if the breach is likely to put people at risk. You must tell the people affected only if the risk is high. You must record every breach either way, including the reason you did not report it. Message Recall in Outlook cannot reach anyone outside your organisation, so do not rely on it.

---

Almost everyone who works with email has done it. You type the first letters of a name, Outlook fills in the rest, and you press Send before you notice it picked the wrong Sarah. Or you attach last month’s payroll file instead of the meeting notes.

This guide covers UK organisations. It explains what to do straight away and how to decide whether you must report the mistake. Then it covers what to record, and how to make it less likely to happen again.

What to do in the next hour

Speed matters more than getting the wording perfect. Do these things in this order.

1. Try to stop or recall it, but do not wait on that. If you use Undo send, select Undo now. Message Recall only works for recipients inside your own organisation, so it will not help with an external address.
2. Contact the recipient. Phone them if you can. Ask them to delete the email and any attachment without opening or forwarding it, and to confirm in writing that they have done so. Suggested wording is further down this page.
3. Tell the right person. That is your data protection officer if you have one, or whoever your organisation names for data protection. Do it the same day, even if the mistake seems small.
4. Write down the facts. Note when you sent it and who received it. Then note what personal data it held, about how many people, and what the recipient said.
5. Do not send it again, forward it or delete your own copy. Your Sent Items copy is the record of exactly what went out.

Is it a personal data breach?

UK GDPR defines a personal data breach as a breach of security leading to the “unauthorised disclosure of, or access to, personal data”. Sending personal data to someone who should not have it fits that definition, even when it was an honest mistake.

So the question is whether the email contained personal data. That means any information about an identifiable living person. Examples include:

• a client’s name, address or account details
• an employee’s salary, sickness record or disciplinary notes
• a spreadsheet with names and phone numbers in it
• a list of email addresses in the To or Cc line that should have been in Bcc

If the email held no personal data, such as a price list or a draft press release, it is not a personal data breach. It may still be a confidentiality problem with a client or partner, so handle it in the same calm way.

Do you have to report it to the ICO?

Not always. Article 33 of UK GDPR sets the deadline. You must report a breach to the regulator “without undue delay and, where feasible, not later than 72 hours” after you become aware of it. The exception is a breach that is “unlikely to result in a risk to the rights and freedoms” of the people involved.

The regulator is still known as the ICO and still uses the ico.org.uk website. Since 30 September 2026, its legal name has been the Information Commission, after the Data (Use and Access) Act 2025. You report to it in the same way as before.

How to judge the risk

Ask what could happen to the people whose data went astray. These things make the risk higher:

• The kind of data. Health, financial, identity, criminal or children’s data is more serious than a work phone number.
• How many people it covers. One name is different from a spreadsheet of 500 customers.
• Who received it. A colleague in another team or a known, trusted client is lower risk than an unknown external address.
• Whether it was protected. An attachment that was encrypted or password-protected, with the password sent separately, is much lower risk.
• What the recipient did. The ICO’s guidance treats it as lower risk when the recipient tells you about the error. Deleting the data and confirming it lowers the risk too.

The examples below show how these factors often come out. They are illustrations, not rules. Your own facts decide the answer.

What happened	Likely outcome
A colleague in another team received a routine contact list, deleted it and confirmed by reply	Usually record it, do not report
A known client received another client’s invoice with a name and address, and confirmed deletion	Often record it only, but judge the risk
An unknown external address received an HR file with health or bank details, and did not reply	Likely to need reporting, and you may need to tell the person

If you are unsure, use the self-assessment tool on the ICO’s data breach reporting page. It asks about each of these factors and tells you whether the breach is likely to need reporting.

The 72 hours

The 72 hours start when your organisation becomes aware of the breach, not when you finish investigating. The law says 72 hours, so plan for weekends and bank holidays.

You do not need every detail before you report. Article 33 allows you to give the information in stages. If you report after 72 hours, you must explain the reasons for the delay.

Do you have to tell the people affected?

Sometimes. Article 34 of UK GDPR covers this. If the breach is likely to result in a high risk to people, you must tell them “without undue delay”. You must explain what happened in clear and plain language. You must also say what you are doing about it and who they can contact.

You do not need to tell them if the data was protected, for example by encryption. You also do not need to if your later steps mean the high risk is no longer likely. A recipient who has confirmed deletion can be one of those steps, depending on the data and who they are.

A high risk is a higher bar than the risk that triggers a report to the ICO. Many misdirected emails need neither. Some need a report to the ICO but not a message to the people affected.

Record every breach, even if you do not report it

This is the step most organisations miss. Article 33 also says you must document every personal data breach, including the ones you decide not to report. Record:

• what happened, when, and who was involved
• what personal data it held, and about how many people
• what the effects were or could be
• what you did about it, including the recipient’s confirmation
• whether you reported it, and the reason for your decision

The ICO’s self-assessment tool says the same: if you do not need to report, keep an internal record and the reason for that decision. A simple log kept by your data protection lead is enough for most organisations of 50 to 250 people.

If the ICO later asks why you did not report a breach, a written reason made at the time is your answer.

Wording to send the wrong recipient

Phone first if you can, then follow up in writing so you have a record. Keep the email short and polite. Do not repeat the personal data in it.

Subject: Email sent to you in error

Hello [name],

At [time] today I sent you an email with the subject “[subject]”. It was meant for someone else and contains personal information about other people.

Please could you delete the email and any attachments from your inbox and your deleted items, without opening the attachments or forwarding it. Please also reply to confirm that you have done so.

Thank you for your help, and sorry for the trouble.

[Your name and contact details]

If the recipient does not reply, try again by phone. Record each attempt. A recipient who will not confirm deletion is one of the factors that can raise the risk.

Why it happens

Most misdirected emails come from a few everyday causes:

• Autocomplete. Outlook suggests a name after a few letters, and the top suggestion is the wrong person with a similar name.
• Similar names and addresses. Two people called Sam Patel, or a client contact and a supplier with almost the same domain.
• Reply all. A reply meant for one person goes to a whole distribution list.
• Long threads. Someone forwards a thread without noticing a sensitive message further down.
• The wrong attachment. The file name looked right, but it was last month’s version or a different client’s.
• To instead of Bcc. A message to a group of clients or patients shows every address to everyone.

Notice that these are failures of the tools and the process as much as of the person. That matters for how you respond. If people fear blame, they report mistakes late or not at all, and the 72 hours run out.

How to make it less likely in Microsoft 365

You cannot stop every mistake, but Microsoft 365 already has settings that catch many of them. None needs an extra licence.

Warn people before an email leaves the organisation

The External Recipients MailTip shows a warning while someone writes, when an email is addressed to someone outside the organisation. Microsoft’s MailTips documentation says it works in Outlook, Outlook on the web and the Outlook mobile app, and that it is turned off by default.

An Exchange admin turns it on for everyone with one command in Exchange Online PowerShell: Set-OrganizationConfig -MailTipsExternalRecipientsTipsEnabled $true. It is the single most useful setting on this page, because it catches the autocomplete mistake at the moment it happens.

Give people a few seconds to change their mind

• New Outlook and Outlook on the web have an Undo send setting under Settings > Mail > Compose and reply. Microsoft raised the longest delay in new Outlook from 10 to 30 seconds in January 2026.
• Classic Outlook for Windows has no Undo send button. A rule that defers delivery of every message by a minute or two does the same job.

Both are personal settings, so ask people to turn them on, especially in teams that handle sensitive data.

Do not rely on Message Recall

Microsoft’s guide to cloud-based message recall says recall works only within your organisation. You cannot recall a message sent over the internet to another organisation. The one exception is another Microsoft 365 organisation whose admin has chosen to allow your recalls. Messages the recipient has already forwarded by hand cannot be recalled either.

So recall can help with an internal mistake. For an external one, contact the recipient instead.

Clear out bad autocomplete entries

When someone has emailed the wrong person, remove that address from their autocomplete suggestions so it does not happen twice. Microsoft’s AutoComplete guidance for classic Outlook explains how. Start typing the name, point at the wrong suggestion and select the X. Or empty the whole list from File > Options > Mail. New Outlook and Outlook on the web manage suggestions in their own settings, under Settings > General > Privacy and data.

Protect what you attach

For attachments that hold sensitive personal data, use a password or encryption, and send the password by a different route. If the email does go to the wrong person, the data stays unreadable. That is one of the things that can lower the risk to the point where you do not need to tell the people affected.

Does an email disclaimer help?

Many organisations end every email with a line asking anyone who received it in error to delete it and tell the sender. It does no harm, and it may prompt an honest recipient to get in touch. But it does not stop a misdirected email being a breach, and it does not replace the steps above. Email disclaimer examples gives wording for that line and explains what it can and cannot do. UK email footer legal requirements covers what the law does require at the foot of a business email.

If you use a signature or disclaimer tool, it handles your personal data too. Email signature tools and GDPR covers what to check in that contract.

Frequently asked questions

Is sending an email to the wrong colleague a breach?

It can be. Disclosure inside your own organisation still counts if the colleague had no reason to see the data, such as another employee’s sickness record. These cases are usually low risk, especially when the colleague deletes it at once. Record them like any other breach.

We put every recipient in the To line instead of Bcc. Does that count?

Yes, if the recipients are individuals. Their email addresses are personal data, and everyone on the list can now see them. The risk depends on what the list reveals. A list of a clinic’s patients or a support group’s members says something sensitive about every person on it, which makes the risk much higher.

What if the person who received it will not reply?

Keep trying by phone and email, and record each attempt. You cannot force a stranger to delete an email. Without their confirmation, treat the data as still exposed when you judge the risk. That may mean the breach needs reporting when it otherwise would not.