Accidental data breach at work: what to do in the first 72 hours

If you cause an accidental data breach at work, report it internally straight away, usually to your manager, the IT team or the data protection officer. Do not try to fix it quietly and do not wait until you know how bad it is. In the UK and the EU, an organisation has 72 hours from the moment it becomes aware of a breach to notify the data protection authority when people are at risk. In the US, deadlines depend on the state and the sector, but the clock also starts when the organisation finds out. Every hour an employee hesitates comes off that time.

Most data breaches are not the work of hackers. They start with an ordinary mistake: an email sent to the wrong person, a spreadsheet attached by accident, a laptop left on a train. This article explains what counts as a data breach, shows common examples, walks through the first 72 hours step by step, sets out the reporting rules in the UK, the EU and the US, and explains how to make sure people report mistakes instead of hiding them.

What counts as a data breach?

A personal data breach is any security incident that leads to personal data being lost, destroyed, altered, disclosed or accessed without authorisation. It does not matter whether it was deliberate or an accident, and it does not have to involve a cyber attack. If the wrong person could see, change or lose data about someone, it is a breach.

A breach is also not only about leaks. Deleting a client file without a backup or losing access to data through ransomware counts as well, because the data is no longer available to the people who need it. Many of the largest incidents, like those in our overview of the biggest cyber attacks in the Netherlands, started with exactly that kind of availability breach.

Common examples of accidental data breaches at work

• Email to the wrong recipient. Autocomplete picks the wrong “Sarah”, and a payroll overview lands outside the organisation. Data protection authorities on both sides of the Atlantic list misdirected email among the most common causes of reported breaches.
• CC instead of BCC. A newsletter or client update goes out with every recipient’s email address visible to all the others.
• The wrong attachment. Someone means to send a template and sends the filled-in version with names, addresses or medical details.
• A sharing link that is too open. A document is shared with “anyone with the link”, and the link ends up in a forwarded email or a public channel.
• Lost or stolen devices. An unencrypted laptop, phone or USB stick disappears on the way home.
• Paper and screens. Printouts left on the printer, files in a bin bag, a screen with client data visible to visitors.
• Falling for a phishing email. An employee enters their login details on a fake page, and an attacker gets access to a mailbox full of personal data.

What to do in the first 72 hours after a data breach

1. Report it internally, immediately. The employee who noticed the mistake tells their manager, IT or the data protection officer. Legal deadlines run from the moment the organisation becomes aware, so a day of silence inside the team is a day lost.
2. Contain the damage. Recall the email if possible, ask the recipient to delete it and confirm in writing, revoke the sharing link, wipe the lost device remotely or reset the compromised password.
3. Establish what happened. Which data was involved, how many people are affected, how sensitive is it and who could have seen it? Health, financial and children’s data weigh heavier.
4. Assess the risk to the people involved. Could this lead to identity fraud, discrimination, financial loss or distress? That assessment decides whether you have to notify a regulator and the affected individuals, under the rules explained below.
5. Notify where required. File the notification on time, even if not every detail is known yet; you can usually add information later. Tell affected people what happened and what they can do to protect themselves.
6. Record it, even if you do not report it. Keep an internal log of every breach, with the facts, the effects and what you did about it. Under GDPR this is mandatory, including for breaches you decided not to report.
7. Learn from it. Find the cause and fix the process: an autocomplete setting, a sharing policy, phishing simulations for the team that fell for the fake login page.

Data breach reporting rules in the UK, the EU and the US

The steps above apply everywhere, but the legal deadlines and who you report to depend on where you operate and which sector you are in.

• United Kingdom. Under UK GDPR, a breach that is likely to put people at risk has to be reported to the Information Commissioner’s Office (ICO) within 72 hours of becoming aware of it. If the risk to individuals is high, you also have to inform them without undue delay.
• European Union. The GDPR sets the same 72-hour deadline, with the notification going to the national data protection authority. Organisations that fall under NIS2 may also have to report significant incidents to their national CSIRT or authority: an early warning within 24 hours, a notification within 72 hours and a final report within a month.
• United States. There is no single federal breach law. Every state has its own notification law, with deadlines that range from “without unreasonable delay” to a fixed number of days. Sector rules come on top, such as HIPAA for healthcare, which requires notification within 60 days, and the SEC rule that requires listed companies to disclose material incidents within four business days.
• Every region. Contracts matter too. Clients and partners often require notification within a set number of hours, sometimes shorter than the legal deadline.

Working across borders? In the EU, organisations with a main establishment usually deal with one lead authority. In the US, the state where affected people live determines the rules, so a single breach can trigger several notifications.

Why employees hide mistakes, and how to change that

The biggest risk in data breach management is not the mistake itself but the silence afterwards. An employee who sent a file to the wrong address often hopes nobody will notice, especially if they fear a reprimand. By the time the breach surfaces, the deadline has passed and the damage has spread.

Organisations that handle breaches well make reporting easy and safe. People know exactly who to tell, the first reaction is “thank you for telling us”, and mistakes are discussed as process problems rather than personal failures. Training helps in two ways: it shows employees what a breach looks like, so they recognise one, and it turns reporting into a practised habit instead of an awkward confession.

The tip: prevent breaches with short weekly training

Guardey helps employees avoid the everyday mistakes behind most breaches. Every week they get a challenge of about three minutes, on their laptop or in the mobile app for iOS and Android, on topics like sending data securely, sharing files, recognising phishing and reporting incidents. Gamification with leaderboards and streaks keeps people involved, phishing simulations test what they learned and audit-ready reporting shows your progress for GDPR, NIS2 and ISO 27001. More than 500 organisations, including the European Parliament, already use Guardey. Read more about our security awareness training or see how we approach privacy awareness.

Working with an IT partner? How MSPs help before and after a breach

Many small and mid-sized organisations do not run IT themselves but rely on a managed service provider (MSP): an IT company that looks after their systems, security and support for a monthly fee. When a breach happens, that is usually the first call: can the email be recalled, can the laptop be wiped, which mailboxes were accessed? If you work with an MSP, ask whether breach prevention and security awareness training are part of your package. For MSPs, adding that prevention is a logical step for clients who have just learned how expensive one wrong email can be.

Guardey is available through several routes, including e92plus, a value-added distributor that specialises in cybersecurity for MSPs and resellers across the UK, Ireland, the Benelux and the Nordics. MSPs get consumption-based monthly billing and one partner portal to manage licences for all their customers, backed by dedicated MSP partner managers and marketing support to bring a new service to market. That lets an MSP combine data protection tools and training into one managed offer.

Frequently asked questions about accidental data breaches

Can you be sacked for an accidental data breach at work?

An honest mistake that is reported straight away is rarely grounds for dismissal, although it depends on the circumstances, local employment law and your employer’s policies. Hiding a breach, ignoring clear procedures or repeating the same mistake is viewed much more seriously. Reporting quickly is almost always the best thing you can do, for the organisation and for yourself.

Does every data breach have to be reported?

No. Under GDPR and UK GDPR, a breach only has to be reported to the authority if it is likely to result in a risk to people. In the US, state laws usually define which types of data trigger a notification. Every breach should still be recorded internally, including the reasons for not reporting it.

What are examples of GDPR breaches?

Typical examples are sending personal data to the wrong recipient, using CC instead of BCC, sharing a file with an open link, losing an unencrypted laptop, leaving printed files unattended and giving an attacker access to a mailbox through phishing. Most start with a human mistake rather than a technical failure.

How do you prevent accidental data breaches?

Combine a few technical safeguards, such as delayed sending, encryption and restricted sharing links, with regular training. Employees who practise recognising risky moments make fewer mistakes and report the ones that do happen much faster.

No organisation will ever reach zero mistakes. The difference lies in what happens in the minutes after one: whether the employee picks up the phone or closes the laptop and hopes for the best. That reflex is something you can train.