Your fax ended up with a third party
What to handle within an hour, how to categorize the unauthorized data disclosure, and how to keep it from recurring.
Lost fax: first call the number reached, request destruction of the pages, and confirm this request in writing. Did the document contain personal data? Then assess the risk: in Belgium, any breach likely to harm individuals must be reported to the Data Protection Authority within 72 hours.
Four key points
Time is working against you: every hour leaves the page in other people's sight.
Personal details transmitted to an unintended party: a GDPR violation, even when the recipient never opens or reads the pages.
Every breach goes into the internal register, whether notified or not.
Prevention requires little effort: verify the number, enter it twice, review it while cancellation is still possible.
First hour: containing the breach
Start by confirming the actual number dialed. With Faxeroo, this information is visible on the tracking screen and, optionally, on the PDF delivery report. On a fax machine, the transmit confirmation or internal call log provides the same details.
Then dial it. Many fax lines belong to a company or practice reachable by phone, with details listed in the professional directory. Report the mistaken arrival of a confidential document — without revealing its contents — and request destruction without copying or forwarding.
Confirm in writing — email or letter — requesting confirmation of destruction. This response, however brief, will demonstrate the reduced risk. If there's no answer by phone, record every attempt, with date and time.
Finally, notify your data protection officer — the DPO or designated person: the assessment will be their responsibility.
Classifying: Data Breach or Not?
An unauthorized disclosure of personal information qualifies as a GDPR incident: the regulation deems any unlawful release of data to be such (Article 4, paragraph 12). Sending a client's name, an employee file, or a medical report to an outsider counts. An invoice exchanged between businesses that does not identify any individual does not.
Under Article 33, the supervisory authority must be informed within 72 hours of discovery — unless there is clearly no risk to individuals. The evaluation depends on the type of information (health, finances, identity papers), the number of people affected, the identity of the unintended recipient, and what they did with the sheets.
In Belgium, the supervisory authority is called the Data Protection Authority; its website hosts the notification form. High risk — a diagnosis landing with a silent stranger, for example — Article 34 adds the obligation to inform the individuals concerned, in plain language, about what happened and what steps to take.
These obligations fall on the organization that initiated the sending. Faxeroo transmits to the number entered: nothing indicates to it the sensitivity of the content, and no one can take back a fax once delivered.
The Internal Register, Section by Section
Under paragraph 5 of GDPR Article 33, every breach must be documented, even those that were never notified. A concise record will do, provided it includes the following sections.
| Section | Illustration with a misdirected fax | What It's For |
|---|---|---|
| Facts | A three-page hospital report, dispatched to a number with two digits transposed on a Tuesday morning | Rebuild what took place from records and logs, not from anyone's memory. |
| Data and Individuals Concerned | Patient: full name, date of birth, diagnosis | Gauge the severity |
| Time of Discovery | Call, one hour later, from the intended recipient: nothing received | Mark the start of the 72-hour clock |
| Response and Measures | Recipient called, destruction of the document confirmed via email | Demonstrate the risk was contained |
| Decision and Reasoning | Whether the DPA was notified or not, with supporting reasons | So you can defend the reasoning behind that decision if an audit takes place. |
| Corrective measures | Abbreviated number corrected, double entry adopted | To prevent recurrence |
Preventing a Repeat
The typical error comes down to three causes: a transposed digit, a number copied from an outdated source, a speed-dial key never reviewed. The safeguards cost little.
Check the format upfront. The Faxeroo number checker detects a doubled area code, abnormal length, a mobile number — beyond the reach of any fax machine. It can't reveal the line's subscriber: only a reliable source can answer that.
Delicate numbers should be entered twice or read back. For your regular contacts, jot down each verified number along with the date you confirmed it, then review this log at set intervals.
Use the time you're given. With Faxeroo, nothing goes out without clicking the confirmation email, then without a countdown of about 55 seconds, which can be cancelled. Re-reading the number takes a few seconds at that point; fixing things afterwards costs infinitely more.
Your questions
- Must the recipient destroy the document they received?
- Generally, they are under no obligation to do so: no contractual relationship binds you. But most professionals will gladly comply. A courteous request confirmed in writing, a response attesting to the destruction — that is enough to limit the risk and prove it.
- Does the DPA always need to be notified?
- No: notification is only required if the breach is likely to harm the individuals concerned. The internal register, on the other hand, is kept in every case, with the reasons for the decision.
- A fax already sent: can it be cancelled?
- No. Pages already handed over to the fax machine: no provider takes them back. Cancellation is only possible during the roughly 55-second countdown before dispatch.
Data and security
This topic
- A fax, from screen to paper: security
- Fill in a few fields, download the PDF, and put it on the first page of your send.
- Faxing pages that identify real people, without falling foul of EU data protection rules.
- Belgium: the points to check before sending a medical document, and the situations that call for a secure channel.
Keep reading
Pages chosen to help you prepare a send, track it, or keep proof of it.