Like it or not, sending an email to the wrong recipient constitutes a personal data breach under the GDPR. This obviously applies if the email contains personal data or if personal information can otherwise be inferred from the message. As with any data breach, assessments are necessary. In any case, the event must be recorded and documented, even if notification to the supervisory authority is not mandatory and the breach has been deemed unlikely to pose a risk to the rights and freedoms of natural persons. This is both due to the express provision of Article 33, paragraph 5 of the GDPR,