Receiving Someone Else's Data by Mistake

It happens more often than we would like. Someone fills in the "To" field wrong and an email with a list of employees lands in your inbox. A supplier sends you, attached, another client's file. You pick up a sheet full of personal data from the shared printer that isn't yours. Or you open an envelope that bore someone else's name. In all these cases you are a decent person who, suddenly, is holding information about someone you don't know and who should never have seen it.

The good news is that, if you react well, it all resolves quickly and without consequences. The part many people overlook is that the wrong reaction — even a well-meaning one — can turn someone else's slip into a problem of your own. This guide explains, in plain terms, what it means to receive data you should never have received, and how to behave decently and lawfully.

You have become, in fact, the holder of data you may not use

The GDPR is built around the idea of a legal basis: to process personal data, you need a ground from Art. 6 (consent, contract, legal obligation, legitimate interest, and so on). When data reaches you by mistake, you have none of those grounds. There is simply no legitimate reason for you to work with that information.

In practice, you are a temporary and involuntary holder. The fact that the information landed on your screen or your desk gives you no right over it. And "processing" in the GDPR sense covers almost anything you do with it: reading, copying, saving, printing, forwarding, looking the person up online. That is why the first and most important rule is to stop: what you haven't yet seen, don't rush to see.

If special categories of data are involved — health, trade-union membership, sexual orientation, beliefs (Art. 9 GDPR) — the sensitivity is even higher and caution all the more necessary. We wrote about how easily such data leaks through ordinary channels in our piece on a GDPR incident with medical data in an Excel file.

What NOT to do: the mistakes that make it your problem

The list below seems obvious, but each point matches a common mistake, made out of curiosity or a wish to "help":

• Don't read more than you have already seen. Don't open the attachments, don't scroll through the document, don't "check" who it is about.
• Don't use the information for any purpose — professional or personal. Don't put it in a file, don't save it "so it isn't lost".
• Don't forward and don't share. Don't send it to a colleague, don't post it on social media, don't show it around "as something funny". Sharing aggravates the disclosure.
• Don't contact the data subject. Tracking down and notifying the person whose data it is constitutes additional, unauthorised processing — and it is not your role.
• Don't keep "a copy as evidence" without the sender's agreement. Unauthorised retention is, in itself, processing without a basis.

The golden rule: the only processing allowed is the minimum strictly needed to notify the sender and fix the mistake. Anything beyond that minimum takes you out of the comfortable position of "a third party who received it by mistake".

What to do, step by step: notify, then delete or return

The right path is short and has only a few steps:

• Identify the sender. Use the email address, the letterhead of the document, or the contact details of the organisation's data protection officer (DPO).
• Notify them, soberly and factually. Tell them you received, by mistake, something not meant for you, without describing the content more than is needed for them to understand what happened. Ask for instructions on deletion or return.
• Resolve it as agreed. As a rule, you delete the email (including from the trash and from sent items, if you moved it) or you return or destroy the document by shredding. Leave the choice between return and destruction to the sender.
• Confirm briefly that you have complied — a confirmation of deletion helps the controller document their incident.

Tone matters. There is no need for drama or reproach: a polite, prompt notification is exactly what a responsible controller expects. Your correct reaction protects everyone — you, the person whose data it is, and the organisation that made the mistake.

Is this a data breach? Yes — but for the sender

From the perspective of the organisation that sent it to the wrong place, the situation is a personal data breach: an unauthorised disclosure of data to a person who should not have received it. That is the definition of a confidentiality breach, and its handling is governed by Art. 33 and 34 GDPR.

In short, the controller who made the mistake must assess the risk of the incident. If the breach is likely to result in a risk to the rights and freedoms of individuals, it notifies the ANSPDCP within 72 hours of becoming aware of it (Art. 33). If the risk is high, it must also inform the data subjects (Art. 34). The fact that you, as the accidental recipient, confirmed deletion matters: it can lower the assessed risk and sometimes justify a milder conclusion. We set out what such a notification looks like in our guide on notifying a breach to the ANSPDCP — when, how and what to expect.

An important point: it is not "your breach". You are not the controller who lost control of the data; you are the third party who received it without wanting to. The notification duty rests with the one who made the mistake. Your role is not to make the situation worse and to help limit it — exactly what you do when you notify and delete.

How good processes prevent these slips

The same logic applies to the other side of the coin: if you are the organisation that never wants to send someone's data to the wrong person, the problem is not solved with calls for vigilance, but with processes. A few simple measures cut the risk dramatically: disabling email autocomplete or adding a confirmation step for external recipients, separating attachments per client, a short send-delay that allows recall, clear rules for the shared printer (pull-printing with a code, no forgotten stacks), and envelopes double-checked by a second person for sensitive mail.

Just as important is preparing your people: an employee who knows in advance what to do when they receive data by mistake reacts calmly and correctly, instead of improvising. A mature GDPR programme includes both these controls and a clear channel through which any accidental recipient can quickly flag the slip to you. If you want someone to handle such processes and incident management on an ongoing basis, an outsourced DPO gives you the expertise you need without the cost of a dedicated employee.

In conclusion

Receiving someone else's data by mistake does not make you guilty of anything — but it gives you a small responsibility, easily honoured. Stop, don't use or spread the information, notify the sender, and delete or return what you received. That's all. For the organisation that made the mistake, the incident is a breach it manages under Art. 33–34; for you, it is an opportunity to behave decently. A calm, correct reaction turns a potentially serious slip into a situation resolved in a few minutes.

Frequently asked questions