An employee accidentally sends an email with personal data to the wrong person. Which of the following should the employee do FIRST upon becoming aware of the issue?

Question

Options

• ANotify the privacy regulator and the impacted data subjects.
• BSend the recipient another email requesting deletion of the email that was accidentally sent.
• CDocument and file the details of what happened in anticipation of further questioning.
• DReport the situation to the data privacy officer as it could be a privacy breach.

• A
  3% (1)
• B
  12% (4)
• C
  82% (27)
• D
  3% (1)

Explanation

The first step after discovering a potential breach is to document all available facts - what data was sent, to whom, at what time, and how - while the details are fresh and accurate. This contemporaneous record is essential for any subsequent privacy breach assessment, DPO review, or regulatory notification. Notifying the regulator and data subjects (A) is premature before an assessment determines whether a reportable breach occurred. Emailing the recipient to delete the message (B) is inadequate as a sole response and may not be effective. Reporting to the DPO (D) is the correct next step but requires accurate documentation first so the DPO has complete information to assess the incident.

No community discussion yet for this question.