Payroll files on a personal email account

Do not answer from the facts you have - identify the facts you don't have.

The structure of the assessment:

• Is there a breach? Yes, on the face of it: personal information was disclosed to a recipient outside the practice's control, and the former employee's access to the files is now unauthorised. The employee's intent is irrelevant to whether a breach occurred.
• Is there a likely risk of serious harm? This is the pivot. The content is the highest-risk combination in a small practice: TFN plus bank account plus date of birth is sufficient for identity fraud and for tax-refund diversion. The unprotected spreadsheet removes any argument that encryption mitigates the risk.
• What is genuinely unknown? (a) whether the email and attachments still exist - if the account has been deleted remotely and deletion is confirmed in writing, the risk calculus changes materially; (b) whether the files were forwarded, downloaded, or synced to a device; (c) whether this was a one-off or a pattern; (d) what the practice's email and file-access logs show for the preceding weeks.

The judgement: the default on these facts leans strongly towards notifiable, because 210 people at high-harm risk is not a marginal call. But the first action is not to notify - it is to establish whether containment can be verified, because verifiable containment is the one thing that can legitimately change the answer.

Sequence matters because the clock is running and each step is cheap now and expensive later.

1. Preserve evidence before it disappears. Export email logs, file-access records, and the device history. Do not wipe anything. If the matter later becomes an employment or police issue, this is the only copy.
2. Contain. Contact the former employee today, in writing, instructing deletion of the email and all copies, confirmation of whether anything was forwarded or downloaded, and written confirmation of deletion. Ask the webmail provider to disable the account if cooperation is doubtful. Change any shared credentials the employee knew.
3. Establish the scope. How many individuals, which clients, which data fields. You cannot notify accurately until you can describe the population.
4. Then notify, within the applicable timeframe under the regime that applies to the practice. Notify the regulator where the assessment supports it, and notify affected individuals directly with plain-language advice: what was disclosed, what the practice has done, what the person should watch for, and who to contact.
5. Tell the four client businesses promptly and separately from the individuals. They are entitled to know before they hear it elsewhere - especially the clinic.
6. Notify the practice's professional indemnity insurer and take legal advice on the notification obligations, which are time-bound and fact-dependent.

The order is not negotiable at steps 1–2: containment before communication, because a notification that turns out to be premature or under-informed damages trust twice.

Answer honestly, promptly, and with the limit of your knowledge stated - this is a legal allocation question, not a goodwill question.

What drives the answer: whether the practice was handling the payroll data as a contracted service provider to the clinic, or under its own arrangements. That turns on the services agreement, and the practice should read it before answering. Advise the clinic of that, and give them a date by which you will confirm.

What to do regardless of the allocation:

• Give the clinic the full facts: the data fields involved, the number of their staff affected, what containment has been achieved and what remains unverified. They cannot make their own assessment on a summary.
• Offer to do the mechanics - draft the notification, prepare the contact list, run the call line - so that whoever carries the obligation, the affected people hear one consistent message.
• Avoid the tempting answer: 'it's our breach, we'll handle it'. If the clinic carries the notification obligation and relies on that reassurance, the failure compounds.

The judgement being tested is recognising that protecting the client relationship means giving them the information to make an unwelcome decision, not making it quietly for them.