An e-mail with personal data went to the wrong person: is it a breach?
By Advisorn · updated on 25 October 2026 · Art. 5 let. h and 24 FADP, Art. 15 Data Protection Ordinance, Art. 33-34 GDPR
In short
Yes. Disclosing personal data to an unauthorised person, even by mistake, is a breach of data security (Art. 5 let. h FADP). It must be notified to the FDPIC only if it is likely to result in a high risk for the data subjects (Art. 24 FADP), for example when it contains health data or the data of many customers; it must be documented in any case (Art. 15 para. 4 Data Protection Ordinance).
What to do at once
- ask the recipient to delete the e-mail and to confirm it in writing;
- if possible, recall the message and block shared links;
- assess what data it contained, how many people it concerns and who the recipient is;
- decide whether the risk is high and whether to inform the data subjects;
- write down the facts, the assessment and the measures.
So that it does not happen again
Recipient autocomplete is the most frequent cause. A sending delay of a few seconds, a warning for external recipients and sending sensitive documents through a protected link instead of as an attachment all help.
Related questions
Useful templates
General information, not advice on your case: for your case the text of the law prevails. For a question about your case there is Advisorn's consulting.