Data sent to the wrong person or exposed: incident response playbook

First 15 minutes

1. Ask the recipient to delete it and confirm in writing.
2. Remove the public link or change the sharing setting.
3. Record exactly what data, whose, how many records and for how long it was exposed.
4. Tell legal and privacy straight away: notification deadlines can be short.

Set the severity and download a first-response checklist

What the full playbook covers

• Contain (2 steps)
• Eradicate (1)
• Recover (1)
• Who to notify
• Evidence to keep

The full playbook is in the Incident Response & Business Continuity Kit with 8 more, the IR plan, a BCP/DR plan and 6 tabletop exercises.

Other playbooks

• Phishing and business email compromise
• Ransomware
• Lost or stolen device
• Compromised account or cloud admin access
• Malware on a device
• Major outage or denial of service
• Supplier or third-party breach
• AI tool data leak or misuse