What to do if personal information was emailed to the wrong person

Outlook's message recall only works in limited circumstances: generally when the recipient is in the same Microsoft 365 organization and hasn't opened the message yet. Recall to an external address, or to someone who has already read it, won't work, and may draw attention to the message. Try it if the recipient is internal, but don't rely on it.

If you use Microsoft Purview Message Encryption or sensitivity labels with access controls, an admin may be able to revoke access to an encrypted message. That's worth checking quickly when it applies.

1. 01

   Reach the recipient promptly

   Call if you have a number; otherwise send a short, polite email.

2. 02

   Ask them not to open, forward or keep it

   If already opened, ask them to delete it, empty their deleted items, and delete any downloaded attachments.

3. 03

   Ask for written confirmation

   A one-line email confirming deletion and that the information wasn't shared is valuable evidence for your assessment.

4. 04

   Note their response

   Who they are, whether they're another business or an individual, how they responded and when.

Under PIPEDA, an organization must report a breach of security safeguards to the Office of the Privacy Commissioner of Canada and notify the affected individuals if it is reasonable to believe the breach creates a real risk of significant harm (RROSH). The two main factors are how sensitive the information is (for example, health, financial, government ID numbers) and the probability it has been, is being or will be misused. The OPC publishes an online RROSH assessment tool.

A misdirected email to a known professional who confirms deletion is often low risk. The same file sent to an unknown personal address, or to a mailing list, is not. Write down your reasoning either way.

The Breach of Security Safeguards Regulations require organizations to keep a record of every breach of security safeguards for 24 months after determining it occurred, whether or not it met the reporting threshold. The record should contain enough to show the OPC how you assessed it. A short entry is enough for low-risk misdirected email: what was sent, to whom, when, the recipient's response and your conclusion.

If you conclude there's a real risk of significant harm, the report to the OPC and notice to individuals must be given as soon as feasible. The notice to individuals should describe what happened, what information was involved, what you've done, and what they can do to protect themselves.

Other laws may apply. Health information custodians in Ontario have notification duties under PHIPA and must report certain breaches to the Information and Privacy Commissioner of Ontario as well as file annual breach statistics. Quebec, Alberta and BC have their own regimes, and public bodies follow separate legislation.

• Clear stale entries from Outlook's autocomplete list for staff who handle sensitive data.
• Turn on external-recipient warnings (MailTips) so senders see when a message leaves the organization.
• Use Microsoft Purview data loss prevention policies to warn or block when sensitive information types, such as SIN or credit card numbers, are sent externally.
• Send sensitive documents through secure sharing links that can be revoked, not attachments.
• Consider a short send delay rule so people can catch mistakes.