I, as the admin of a small mailing group, used "to" field instead of "bcc" while sending an email to 10 people.

One out of the 10 emails turned out to wrong, and of a lawyer, who pointed out that we have breached GDPR. Apparently, the person has given a wrong emaid ID and it went to this lawyer who is demanding to file a report to the data protection authorities.

While I totally agree that it is a breach under GDPR, what I am interested is to know the consequences and next steps.

P.S: We know all the 10 people personally whose emails are exposed under this breach.


The only PII breached is all 10 of them knows the email address of each other. The content of the email had nothing sensitive.

  • 1
    If you have a lawyer threatening you with action, find your own lawyer to help. Commented Feb 10, 2020 at 15:55
  • 1
    Was this done by a natural person in the course of a purely personal or household activity?
    – Lag
    Commented Feb 10, 2020 at 19:10

1 Answer 1


If the lawyer has legitimate concerns, his first port of call would be the ICO https://ico.org.uk/.

Before the ICO will take his complaint further he'll have had write to you expressing his concerns and received a written response that presumably he is unhappy with, and wants to take the issue further.

Most companies have a data compliance team who will have policies and procedures to log breaches like this and decide what course of action to take in response.

Not every breach needs to be brought to the attention of the ICO, and they have a handy self assessment tool to see if you should report the breach.


In your situation, I don't think this constitutes a serious breach which will require investigating. It's simply an admin error. If it is unlikely to pose a risk to any of the individuals they will say something like:

You should keep an internal record of the breach as detailed in Article 33 (5) of the GDPR, including what happened, the effects of the breach and remedial actions taken.

The definition of risk according to the ICO is:

"This risk exists when the breach may lead to physical, material or non-material damage for the individuals whose data have been breached".

So in this case I'd assume a simple apology (Bcc'd :) ) and a record of what happened, how it happened, and the action taken to prevent it happening again should suffice.

  • 2
    Thanks a lot. This helped and resolved the issue. Commented Feb 10, 2020 at 20:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .