Your fax ended up with a third party
What to do within the hour, how to classify the data breach, and how to prevent it from happening again.
Lost fax: first call the number reached, request destruction of the pages, and confirm this request in writing. Did the document contain personal data? Then assess the risk: in Belgium, any breach likely to harm individuals must be reported to the Data Protection Authority within 72 hours.
Four key points
Time is working against you: every hour leaves the page in other people's sight.
Personal data sent to the wrong recipient: a data breach under the GDPR, even if no one reads it.
Every breach goes into the internal register, whether notified or not.
Prevention requires little effort: verify the number, enter it twice, review it while cancellation is still possible.
First hour: containing the breach
Start by identifying the number actually called. With Faxeroo, it appears on the tracking page and, as an option, on the PDF transmission report. On a fax machine, the send report or internal call log shows the same.
Then dial it. Many fax lines belong to a company or practice reachable by phone, with details listed in the professional directory. Report the mistaken arrival of a confidential document — without revealing its contents — and request destruction without copying or forwarding.
Confirm in writing — email or letter — requesting confirmation of destruction. This response, however brief, will demonstrate the reduced risk. If there's no answer by phone, record every attempt, with date and time.
Finally, notify your data protection officer — the DPO or designated person: the assessment will be their responsibility.
Classifying: Data Breach or Not?
A personal data breach, within the meaning of the GDPR: the regulation classifies as such any unauthorized disclosure of data (Article 4, point 12). A fax delivering a client's name, a personnel file, or a medical report to a third party qualifies. An invoice between companies, with no identifiable individual, does not.
Under Article 33, the notification to the supervisory authority must be sent no later than 72 hours after discovery — unless there is clearly no risk to individuals. The assessment depends on the nature of the information (health, finances, identity documents), the number of people affected, the identity of the unintended recipient, and what they did with the pages.
In Belgium, the supervisory authority is called the Data Protection Authority; its website hosts the notification form. High risk — a diagnosis landing with a silent stranger, for example — Article 34 adds the obligation to inform the individuals concerned, in plain language, about what happened and what steps to take.
These obligations fall on the organization that initiated the sending. Faxeroo transmits to the number entered: nothing indicates to it the sensitivity of the content, and no one can take back a fax once delivered.
The Internal Register, Section by Section
Paragraph 5 of Article 33 of the GDPR requires documenting every breach, even those not notified. A brief record suffices, provided it covers these sections.
| Section | Illustration with a misdirected fax | What It's For |
|---|---|---|
| Facts | A three-page hospital report, dispatched to a number with two digits transposed on a Tuesday morning | Reconstruct the incident without relying on memory |
| Data and Individuals Concerned | A patient: name, date of birth, diagnosis | Gauge the severity |
| Time of Discovery | Call, one hour later, from the intended recipient: nothing received | Mark the start of the 72-hour clock |
| Response and Measures | Recipient called, destruction of the document confirmed via email | Demonstrate the risk was contained |
| Decision and Reasoning | Whether the DPA was notified or not, with supporting reasons | To justify the decision in the event of an audit |
| Corrective measures | Abbreviated number corrected, double entry adopted | To prevent recurrence |
Preventing a Repeat
The typical error comes down to three causes: a transposed digit, a number copied from an outdated source, a speed-dial key never reviewed. The safeguards cost little.
Check the format upfront. The Faxeroo number checker detects a doubled area code, abnormal length, a mobile number — beyond the reach of any fax machine. It can't reveal the line's subscriber: only a reliable source can answer that.
Delicate numbers should be entered twice, or read back. For your regular contacts, keep a dated list of verified numbers, reviewed at fixed intervals.
Use the time you're given. With Faxeroo, nothing goes out without clicking the confirmation email, then without a countdown of about 55 seconds, which can be cancelled. Re-reading the number takes a few seconds at that point; fixing things afterwards costs infinitely more.
Your questions
- Must the recipient destroy the document they received?
- Generally, they are under no obligation to do so: no contractual relationship binds you. But most professionals will gladly comply. A courteous request confirmed in writing, a response attesting to the destruction — that is enough to limit the risk and prove it.
- Does the DPA always need to be notified?
- No: notification is only required if the breach is likely to harm the individuals concerned. The internal register, on the other hand, is kept in every case, with the reasons for the decision.
- A fax already sent: can it be cancelled?
- No. Pages already handed over to the fax machine: no provider takes them back. Cancellation is only possible during the roughly 55-second countdown before dispatch.
Data and security
This topic
- A fax, from screen to paper: security
- Fill in a few fields, download the PDF, and put it on the first page of your send.
- Sending a fax containing personal data without breaching European regulations.
- Belgium: the points to check before sending a medical document, and the situations that call for a secure channel.
Keep reading
Pages chosen to help you prepare a send, track it, or keep proof of it.