Is an email sent to the wrong recipient a data breach?

A misdirected email can be a personal data breach

An email sent to the wrong recipient falls under the definition of a personal data breach as defined by the GDPR: there is then a violation of security that leads to unwanted access to personal data by someone who has no right to it. Whether it concerns a CV, an invoice with an address, or an internal memo with names — as soon as personal data reaches the wrong person, the qualification "personal data breach" is in principle at issue.

The fact that something is a personal data breach does not automatically mean it must be reported. Article 33 of the GDPR links the notification obligation to the supervisory authority to the risk that the breach poses to the rights and freedoms of the data subject: how sensitive is the data, how many people are affected, and has the email been recalled or remain unopened. A misdirected email with only a name and an appointment time carries different weight than an email with financial data or health information sent to a large group of wrong recipients. The organisation that made the mistake makes this assessment itself, and it also decides whether to report it.

This follows from Article 33 of the GDPR

The definition of a personal data breach and the link to the 72-hour notification obligation are set out in Article 33 of the GDPR; the Dutch Data Protection Authority explains on its page about reporting personal data breaches how that risk assessment is made in practice. The GDPR applies as a regulation directly in each Member State, so this core is the same everywhere — what differs is where to report. In the Netherlands, that is the Dutch Data Protection Authority, as the sole national supervisory authority. In Germany it is different: there, an organisation reports to the supervisory authority of the state where the establishment is located, and there are sixteen state supervisory authorities alongside the federal BfDI.