You sent an unredacted document by mistake: what to do now

Act in this order: contain, assess, decide, document. Stop the spread first: recall the message, cut the sharing link, ask the recipient to delete the file and confirm it in writing. Then tell your data protection contact. If the file shows personal data, your organisation may have to notify the data protection authority within 72 hours.

These are EU GDPR rules, which the UK GDPR mirrors on these points. Practical guidance, not legal advice. Sources checked in September 2026.

What should you do in the first hour?

Take Jane Example, a payroll officer. She emails an outside accountant, then sees it: she attached the original, not the redacted copy. Forty names, salaries and bank details are out.

1. Try to pull the message back: Undo in Gmail, a recall in Outlook.
2. Shared a link? In OneDrive or SharePoint, open Manage access, then Stop sharing.
3. Ask the recipient to delete the file, not forward it, and confirm in writing.
4. Tell your data protection officer (DPO) or manager now, before you know everything.
5. Start a log: what was sent, to whom, when, and each step you took.
6. Keep the evidence. Do not delete the sent message.

Do not count on the recall. Microsoft's documentation says it works only if you and the recipient both have a Microsoft 365 work or school account in the same organisation, and the message is still unopened. So it will not reach Jane's outside accountant. Gmail's help says Undo Send lasts 30 seconds at most. Cutting a link blocks new access, but it does not take back a downloaded copy.

Is it a personal data breach?

Often, yes. Article 4(12) of the GDPR covers any breach of security leading to, among other things, the unauthorised disclosure of, or access to, personal data, whether accidental or unlawful. The ICO lists sending personal data to an incorrect recipient among its examples. If the file shows an identifiable person and the wrong person received it, treat it as a breach. A failed redaction counts too, if names can be copied from under the bars.

How do you assess the risk?

The duty to notify depends on the risk to the people in the document, not on your embarrassment. EDPB Guidelines 9/2022 list what to weigh.

• The data: health details, identity documents, bank or card numbers weigh more.
• The possible harm: identity theft, fraud, distress, damage to reputation.
• The people: how many, and whether children or vulnerable people are among them.
• The recipient, and what they may do with the file.

The EDPB says a recipient can count as trusted when you have an ongoing relationship, such as a regular supplier. You can then reasonably expect them not to read the file and to follow your instructions. In its Case No. 9, an insurance agent bound by professional secrecy got two dozen customers' details by mistake, reported it himself and confirmed deletion in writing. The EDPB found no risk.

Do you have to notify the authority within 72 hours?

Under Article 33(1), the controller, meaning the organisation that answers for the data, notifies the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware. One exception: a breach unlikely to result in a risk to people's rights and freedoms. A late notification must explain the delay. Details can follow in phases.

When unsure, the EDPB says: err on the side of caution and notify. Under Article 83(4), failing to notify when you should can cost up to €10 million or, for a company, 2% of worldwide annual turnover, whichever is higher.

When must you tell the people concerned?

Only when the breach is likely to result in a high risk for them. That is Article 34(1), a higher bar than for the authority. Use clear and plain language: a contact point, the likely consequences, the measures taken or planned. The EDPB recommends a dedicated message, not a line in a newsletter. Article 34(3) lifts this duty in three cases, for example when the data was encrypted, or when later measures mean the high risk is no longer likely to materialise.

What do you have to write down?

Everything, even when you notify nobody. Article 33(5) requires the controller to document any personal data breach: the facts, its effects and the remedial action taken. The EDPB also recommends noting your reasoning, above all a decision not to notify.

• The facts: date, time, file, sender, recipient, how it was found.
• The categories of data and the approximate number of people.
• The likely consequences and your risk assessment.
• Containment steps, with times, and the decisions taken.

How do you stop it from happening again?

The EDPB is frank about misdirected mail: little can be done once it has happened, so prevention matters even more than for other breaches. Its Guidelines 01/2021 list simple measures. Add a check of the file itself.

1. Set a send delay of a minute or two.
2. Turn off address autocomplete, or read the full address first.
3. Four-eyes principle: a second person checks the recipient and the attachment.
4. Redact on a copy, and write REDACTED in the file name.
5. Test the final file: select all, copy, paste into a text editor, search for a masked name.
6. Prefer a link with an expiry date: a link can be cut, an attachment cannot.

A redaction tool helps with steps four and five. Pick one that truly removes the text instead of drawing a shape over it. ONYRI Sanitize, for example, works inside your browser and always exports a flattened PDF or PNG made of images, so nothing stays under the masks. Its detection is not exhaustive: review the preview and keep your original.

Frequently asked questions

Sources & references