A Prospect Data-Access Export Included Another Person's Records: Contain and Reissue

A prospect's access-response export contained records belonging to another person. Stop the response from spreading, retain the evidence needed to establish scope, and create a corrected export from a verified subject set.

The immediate job is to establish facts. Which requester received the file? Which subject IDs were intended? Which IDs were included? What fields were exposed? Was the delivered file opened, downloaded, forwarded, recalled or replaced? Do not overwrite the original export while answering those questions.

• Pause any queued resend, portal delivery or automated follow-up tied to the response.
• Restrict access to the affected export and preserve the original file, export job details, query and delivery logs.
• Open an incident register with a named owner, timestamps and evidence locations.
• Escalate the incident through the organization's privacy, security and legal process.

Whose records were incorrectly included in the export?

Build the answer from identifiers, not display names. Put the requester ID, intended subject IDs and included subject IDs in the same incident record. Compare the original query result with the delivered file and mark each record as intended or unintended.

Check every exported field that can identify or describe a person. A record may be wrongly included even when a name looks similar or when the recipient had a legitimate relationship with someone else in the export. Keep the review scoped to the evidence from this incident.

Was the response opened, downloaded or forwarded before containment?

Separate delivery evidence from access evidence. A sent timestamp establishes delivery, not that the recipient viewed the file. Preserve the available portal, email, download, sharing and forwarding logs without changing them.

If access evidence is incomplete, record that as unknown. Do not fill the gap with an assumption. The incident owner can then assess the actual scope using the delivery channel, exposed fields, recipient relationship and the evidence that exists.

• Capture the delivery event and recipient address or portal account.
• Capture available open, download, link-access, sharing and forwarding events.
• Record when containment began and which access paths were disabled.
• Keep the original evidence separate from the working incident notes.

How should the team contain the incident without losing evidence?

Containment should stop additional loss while preserving the material needed to understand what happened. The FTC advises organizations to move quickly to secure operations, stop additional data loss, document the investigation and avoid destroying forensic evidence.

The NCSC describes incident response as part of the wider security life cycle and calls preparation important for minimizing damage. Use the existing incident process where one exists, including the people who own privacy, security, operations and communications decisions.

• Remove or disable the affected download, share link or portal response where technically possible.
• Do not delete the original export, job configuration, relevant logs or incident communications.
• Restrict investigation access to people who need it.
• Create a dated timeline of discovery, containment, evidence collection, review and reissue decisions.

When does a cross-subject disclosure need notification review?

Notification is a legal and risk decision, not a copy-and-paste step. The correct path depends on the people affected, the data involved, the jurisdiction, contractual duties and the likely impact. Bring the organization's privacy lead and appropriate legal counsel into the incident review.

For UK GDPR reporting, the ICO says organizations should assess the likely risk to people's rights and freedoms. It says that if risk is likely, notification to the ICO should happen as soon as possible and, where feasible, within 72 hours. The ICO also says a high risk requires notifying affected people without undue delay.

The FTC says breach response should account for the type of information involved, the people affected and applicable legal requirements. It also advises organizations to document their investigation and avoid misleading communications.

How do you verify the corrected export before reissue?

Do not let the person who built the original export be the only check. A second reviewer should independently reconstruct the requester-to-subject join from the approved identity evidence, then compare the result with the corrected manifest and file contents.

Test the export at two levels. First, validate that every included subject ID is approved. Second, validate that the fields in the file are allowed for that response. Record the reviewer, test method, result and any exception in the incident register.

Reissue only after an approver accepts the corrected manifest and the independent test. Send the recipient a clear correction through the appropriate approved channel. Keep the old export's incident record linked to the corrected response.

What should the incident record preserve after reissue?

Keep the original evidence, the scope decision, the containment timeline, the notification decision and the corrected reissue evidence together. This creates a record that can be reviewed later without reconstructing the incident from memory.

NIST describes its Privacy Framework as a voluntary tool for identifying and managing privacy risk through enterprise risk management. A complete incident register supports that kind of repeatable risk review without turning an individual incident into a claim about compliance.