Scope: Personal data processing subject to EU GDPR; other jurisdictions require separate review
A support employee sends a spreadsheet to the wrong logistics contact. It contains customer names, addresses and purchase details. The recipient says it has deleted the file. Your team wonders whether that closes the matter.
An ecommerce data breach response should begin with the facts, affected people and applicable responsibilities. An accidental disclosure can raise privacy issues even when there is no hacker or public leak.
Establish a reliable incident timeline
Record when the file was sent, when the issue was discovered and what information was involved. Identify who could access it, whether onward sharing is known and what containment steps were taken. Distinguish confirmed facts from unanswered questions.
Preserve relevant records while technical staff address continuing exposure. Keep the incident file access-controlled; circulating the customer spreadsheet widely to investigate it can create another unnecessary disclosure.
Identify the GDPR role before choosing the notification route
Under GDPR, a processor must notify the controller without undue delay after becoming aware of a personal data breach. A controller generally must notify the competent authority without undue delay and, where feasible, within 72 hours of awareness, unless the breach is unlikely to create a risk to individuals’ rights and freedoms. The assessment concerns harm to people, not only commercial loss. European Commission guidance.
For a controller, high-risk breaches can also require communication to affected people without undue delay, subject to applicable exceptions. Breaches and the response must be documented even when authority notification is not required. Incomplete information may be supplied in stages where appropriate; do not treat the need for further investigation as automatic permission to postpone a required initial notification. EDPB breach guidance.
Make the risk assessment specific
Compare a basic delivery list with information revealing sensitive purchases or exposing someone to fraud or physical harm. Review the recipient, access evidence and containment measures. A deletion assurance is relevant information, but it should be evaluated rather than treated as a universal answer.
Assign one person to maintain the facts and another to coordinate legal and technical decisions. Record the reasons for the chosen notification position and revisit them if new information changes the assessment.
Coordinate countries, vendors and customer communications
Check where affected individuals and relevant organizations are located, and which other laws or contractual notice duties may apply. GDPR analysis does not resolve every UK, US or China obligation. Keep communications accurate and consistent with what is known.
Need help organizing a cross-border privacy incident? Contact Jinyuan Law Firm with a non-sensitive incident summary, affected jurisdictions and provider roles. Request coordination of the China-side facts and identification of the specialist privacy advice required. Do not email the exposed customer database as part of an initial inquiry or wait for a consultation before necessary containment.
Related reading: Your Customer Data Crosses Borders Every Day. Does Your Compliance Plan?.
General information only. Advice depends on the facts and applicable jurisdiction. Contact does not by itself create a lawyer-client relationship. Local-law advice may be needed outside mainland China.
