Short answer: you do not prevent a data breach with training alone. Most data breaches start with a human action, such as a file sent to the wrong recipient or a sharing link that is too open, but the cause often lies in the process around it. Combine three layers: employees who recognise risks, processes with safe default settings and technology that catches mistakes or limits their impact. Think of sharing less data, verifying recipients, setting an expiry date, revocable access and an audit trail.
Updated on 5 November 2026
A file sent to the wrong recipient, a sharing link open to everyone or an employee who responds to a convincing phishing email: the moment a data breach becomes visible is often human. According to the 2025 annual report of the Dutch Data Protection Authority (Dutch), almost three quarters of reported breaches involved letters and emails that reached the wrong recipient.
Yet “human error” is rarely the full explanation. If one mistake immediately leads to uncontrolled spread, safeguards are missing. In this article you will read when something counts as a data breach, which actions often lead to one and which eight measures help prevent data breaches.
When is something a data breach?
A personal data breach is a breach of security that leads to the destruction, loss, alteration, unauthorised disclosure of or access to personal data. It can happen accidentally or deliberately. Examples of accidental actions are a misaddressed message, uploading the wrong document, a public link or access that is revoked too late.
The GDPR requires appropriate technical and organisational measures. Not every mistake is a violation, but you must be able to explain which measures were appropriate and how you assessed the incident. You report a breach with risk to data subjects to the supervisory authority within 72 hours.
A mistake is not the same as malicious behaviour
In your risk assessment, distinguish between an accidental error, negligence and a malicious insider. Four-eyes checks and safe defaults help with mistakes. Monitoring and segregation of duties matter more for misuse.
The final action is not always the root cause
If an employee shares a public link, the action is human. The underlying questions are organisational: why was “anyone with the link” allowed, why was there no expiry date and why was there no warning? A good incident analysis looks at those conditions, not only at who clicked the button.
Which human actions often lead to a data breach?
- Wrong recipient or wrong file. Autocomplete, similar names and time pressure make mistakes likely. Sometimes the recipient is right, but the attachment contains hidden tabs, metadata or another client’s file.
- Access that is too broad or lasts too long. A link for everyone, a folder with more than needed or access without an end date increases the risk, even if the recipient is right.
- Phishing and social engineering. Attackers use urgency and authority to obtain credentials or files. Training helps, but strong authentication and an easy report button remain necessary.
- Misconfiguration and shadow IT. If the approved route does not work for large files or external recipients, employees switch to private cloud storage or a free transfer service.
- Lost devices and local copies. Downloaded files end up on laptops, phones or USB sticks. Encryption helps, but sharing less and controlling access before download remain important.
For email specifically, you will find a detailed checklist in our article on emailing sensitive documents. This article covers all forms of data sharing more broadly.
Why training alone does not prevent data breaches
Awareness is necessary, but knowledge does not guarantee flawless behaviour. People work under time pressure and choose the fastest route that gets the job done. If the secure route takes ten steps and a free service takes two, shadow use is predictable.
Training works better when it matches real tasks, such as a recruiter sharing CVs or a project manager exchanging drawings with suppliers. Repeat the desired action at the moment of decision, with a warning or a preset expiry date. Employees also report near misses sooner when they are not afraid of being blamed, as the UK NCSC also stresses. Also read how security awareness training and secure file sharing reinforce each other.
How to prevent data breaches: 8 measures
1. Map high-risk data flows
Record which sensitive information you share externally, with whom, through which channels and for what purpose. Start with special categories of personal data, financial information and intellectual property.
2. Minimise and classify before sharing
The safest data is data you do not share. Remove unnecessary columns, old versions and metadata. Link information classes to permitted channels, so employees do not have to decide each time what is sensitive.
3. Use safe defaults and least privilege
Only grant access to the file that is needed, for the period that is needed. Do not make public links the default and review external accounts regularly. This fits the risk approach of the NIST Cybersecurity Framework.
4. Verify the recipient in line with the risk
Show recipients clearly, warn about external domains and have recipients of sensitive files confirm their identity, for example with a one-time code. Do not add the same friction everywhere: heavy controls for low risk lead to workarounds.
5. Limit validity and make revocation possible
Match expiry dates to the purpose and revoke access immediately after a mistake. Keep in mind that a copy that has already been downloaded does not disappear. Combine this with minimal data sharing and agreements.
6. Make the secure route the easiest
Support large files, external recipients without an account and sign-in with the existing work account. Test the process with real users. A secure solution that blocks the work moves the risk to another channel.
7. Train in context and encourage fast reporting
Practise with recognisable scenarios and give one clear recovery action: stop, revoke access and report immediately. Reward early reporting and analyse near misses too.
8. Log, review and learn
Log events per file and recipient, and protect those logs. Use the data not only after an incident, but also to spot long-running access and unusual sharing patterns.
What do you record when things go wrong?
Prevention never rules out incidents completely. Make sure employees know where to report a possible breach, and record at least:
- which data and data subjects may be affected;
- how, when and by whom the incident was discovered;
- who had access and whether the file was opened or downloaded;
- which access was revoked immediately;
- whether notification to the authority or data subjects is required, and why;
- which structural improvement follows, with an owner and deadline.
The EDPB guidelines provide a framework for assessment and documentation. How to make that reconstruction within the reporting deadline is explained in our article on Cybersecurity Act evidence.
A plan for the first 90 days
- Choose three high-risk processes, for example HR files, financial documents and files for external advisers.
- Analyse real mistakes and near misses. Look for recurring causes such as time pressure, unclear recipients or missing expiry dates.
- Define per information class which route, verification, validity and logging are needed.
- Set up safe defaults and test them with employees and external recipients.
- Rehearse an incident: deliberately share a file wrongly, revoke access and reconstruct the timeline.
Want to get your wider GDPR programme in order? Use our 8-step plan to become GDPR compliant.
How Msafe helps prevent data breaches in file sharing
Msafe Secure File Transfer is built for sharing sensitive files securely with external parties. Email stays for the message, the file goes through a controlled route:
- Recipient verification, for example with a one-time code by phone, also for recipients without an account.
- An expiry date per share and access you can revoke as long as a file has not been downloaded.
- AES-256 encryption and an audit trail per transfer, so after an incident you can quickly see who received what.
- Sign-in with Microsoft Entra ID and user management through SCIM, so the secure route is also the easy one.
- Files up to 1 TB as standard, so nobody needs to switch to a free transfer service.
Msafe is certified to ISO/IEC 27001:2022 and hosting takes place in the Netherlands. A tool does not make you compliant automatically: lawful basis, data minimisation, agreements and correct use remain your own responsibility.
Frequently asked questions about preventing data breaches
A personal data breach is a breach of security that leads to the destruction, loss, alteration, unauthorised disclosure of or access to personal data. An email or file sent to the wrong recipient can therefore already be a data breach.
Combine three layers: employees who recognise risks, processes with safe defaults and technology that catches mistakes. In practice: share less data, verify recipients, set expiry dates, be able to revoke access and log everything.
Human actions play a role in many breaches, but the cause often also lies in unsafe defaults, overly broad permissions or unclear processes. Analyse both behaviour and circumstances.
Not always a reportable breach. You assess which data was shared, with whom, what the possible consequences are and which measures you took immediately. Record that assessment, even if you do not have to report.
Limit the damage: revoke access, contact the unintended recipient where appropriate, keep the logs and report the incident immediately through the internal process. Privacy and security then assess whether notification is required.
MFA limits the impact of stolen credentials, but does not prevent a wrong file or wrong recipient. It is one layer alongside least privilege, safe sharing processes and logging.
Want to see what happens when a file reaches the wrong recipient? Book a no-obligation demo and test it with your own scenario.
