In short
According to the EDPB, exposing contact details such as emails exposes people to fraud attempts, including phishing.
Informing customers is mandatory where there is a high risk (GDPR Art. 34); notifying the authority within 72 hours has a lower threshold.
The notice must be a dedicated message in clear language, with contacts, likely consequences and measures: a blog post or press release is not enough.
No login links or attachments: state what the company will never ask for and give a verification channel customers already know.
SPF, DKIM and DMARC protect your exact domain: you also need look-alike domain monitoring and a prepared customer service team.
When a company discovers that its customers' names and email addresses have ended up in the wrong hands, the problem does not end with the notice. Those data are exactly what is needed to write convincing fake emails that appear to come from the company and ask people to click a link, update a payment or confirm their login details. The guidelines of the European Data Protection Board (EDPB) say so explicitly: when contact details are exposed, people can become the target of fraud attempts such as phishing emails, text messages and fraudulent phone calls.
In this guide you will find what the GDPR requires for communicating with customers after a breach (Article 34), how this relates to notifying the supervisory authority (Article 33) and what the notice should contain according to EDPB Guidelines 9/2022 and 01/2021. We then look at how to reduce the risk of fake emails in your name, with clear notices, technical defences and a prepared customer service team. This is not legal advice: every case should be assessed with your DPO or privacy adviser.
Why does phishing follow a data breach?
Because a name and an email address are enough for a credible, targeted attack. The fake email does not come from a stranger: it appears to come from a company the customer genuinely deals with.
What the EDPB guidelines say about contact details
EDPB Guidelines 01/2021 collect practical examples of breaches. In case no. 6, a website with hashed passwords, the EDPB rules out a significant risk partly because no contact details were compromised, such as email addresses or phone numbers: users were therefore not exposed to fraud attempts such as phishing emails, text messages or fraudulent calls.
The reasoning also works the other way round. In case no. 7, an attack on an online banking website, the EDPB notes that the stolen data could be used to guess passwords or to run a spear phishing campaign against the bank's customers. In case no. 18, an exfiltration of business emails, it considers the risk high partly because the data could facilitate other attacks, such as phishing.
This does not mean that every exposure of email addresses is automatically high risk. It means that follow-up phishing is a factor to consider explicitly when you assess the breach and decide what to tell customers.
The first warning may come from customers themselves
Sometimes a company discovers the breach after the phishing, not before. EDPB Guidelines 9/2022 give the example of a person who tells the controller they have received an email impersonating it, containing personal data about their actual use of the service. If a short investigation confirms an intrusion with access to the data, according to the EDPB the controller is considered "aware" of the breach and notification to the authority is required, unless a risk to individuals is unlikely. Reports of suspicious emails in your name are not mere spam.
When must you inform customers after a data breach?
You must do so when the breach is likely to result in a high risk to people's rights and freedoms. This is set out in Article 34(1) GDPR: in that case the controller communicates the breach to the data subjects without undue delay.
Notifying the authority and informing customers: two different thresholds
Notification to the supervisory authority (Article 33) and communication to data subjects (Article 34) are two separate obligations. Notification must be made without undue delay and, where feasible, within 72 hours of the controller becoming aware of the breach, unless it is unlikely to result in a risk to individuals.
Communication to customers, on the other hand, is only required where there is a high risk. The EDPB explains that the threshold is higher than for notification, so that people are not burdened with unnecessary notices. In Italy notification is sent through the online procedure on the Garante's services portal, which also offers a self-assessment tool; if your company is established elsewhere, check the procedure of your competent supervisory authority. Timings and steps are explained in our guide on what to do in the first 72 hours after a data breach.
How to assess the risk when names and emails are exposed
The EDPB lists several criteria: type of breach, nature, sensitivity and volume of the data, ease of identifying individuals, severity of consequences, characteristics of the data subjects and number of people affected.
Even data that look harmless can reveal a lot. For the EDPB what matters is what they reveal: a customer list that is not very sensitive in itself can be useful to criminals. An email address linked to your company's name can reveal the type of relationship with the customer: a healthcare, financial or legal service is not a recipe newsletter.
In the annex to Guidelines 9/2022 the EDPB examines a marketing email sent with all recipients' addresses visible to everyone. Notification and communication may be needed if many people are affected, if sensitive data are revealed or if other high-risk factors are present; they may not be needed if only a few addresses are exposed and no sensitive data are involved. If in doubt, the EDPB recommends erring on the side of caution and notifying.
The exemptions and the authority's powers
Article 34(3) provides for three cases in which communication is not required: data made unintelligible to unauthorised persons before the breach, for example by encryption; measures taken immediately afterwards that make the high risk no longer likely; disproportionate effort to contact individuals, in which case a public communication or an equally effective measure is needed instead.
If the controller decides not to inform people, the supervisory authority can require the communication where it considers a high risk likely (Article 34(4)). The EDPB also points out that the assessment can change over time: if reports of phishing in your name start coming in, the risk must be reassessed. Every decision, including the decision not to inform customers, should be justified and documented in the breach register required by Article 33(5).
What should the notice to customers contain?
The notice must describe in clear and plain language the nature of the breach and contain at least the information in Article 33(3)(b), (c) and (d). The EDPB summarises them in four elements, to which it is worth adding practical instructions against phishing.
Element | What the GDPR requires | How to apply it after names and emails are exposed |
|---|---|---|
Nature of the breach | Description in clear and plain language (Article 34(2)) | Which data are involved and which are not, only once this has been verified |
Contact point | Name and contact details of the DPO or another contact point (Article 33(3)(b)) | A dedicated address or number, already listed on the official website |
Likely consequences | Description of the likely consequences (Article 33(3)(c)) | State explicitly that emails, texts or calls in the company's name may follow |
Measures taken or proposed | Measures to address the breach and mitigate its effects (Article 33(3)(d)) | What the company has done and what customers can do to protect themselves |
The EDPB states that, where appropriate, the controller should provide specific advice to individuals to protect themselves, such as resetting passwords if their credentials have been compromised. According to the guidelines, the main objective of the communication is precisely to give information on the steps people should take to protect themselves.
Dedicated messages and effective channels
According to the EDPB the notice should be a dedicated message, not included in a newsletter, a regular update or a standard message. Among transparent communication methods it lists direct messaging (email, SMS, direct messages), prominent website banners or notifications, postal communications and prominent advertisements in print media.
A notice confined to a press release or the corporate blog is not considered an effective way of informing people. The EDPB recommends the means that maximises the chance of reaching everyone, using several channels together if needed.
The compromised channel and timing
One point concerns phishing directly: the controller should avoid a channel compromised by the breach, because attackers impersonating the controller could use it too. If the attack affected the email-sending system or the newsletter tool, that channel should be secured or complemented by others before it is used for the notice.
As for timing, "without undue delay" means as soon as possible. Recital 86 GDPR provides that communication should take place in close cooperation with the supervisory authority and that an immediate risk of damage calls for prompt communication. The EDPB allows a delay only in justified cases, on the advice of law enforcement authorities so as not to hamper investigations; after that, people must be informed promptly.
How do you write a notice that does not itself look like phishing?
A good notice must be recognisable as genuine and should not train customers to click. If your message contains a link to a login page, an attachment and a request to confirm details, fraudsters will only need to copy it.
The Italian data protection authority, in its awareness sheet on phishing, points out that in general banks, public bodies and companies do not ask for personal information by email, text message, social media or chat. It advises not clicking on links or opening attachments in suspicious messages, and being wary of intimidating tones and threats of penalties. In your customer notice you can turn this principle into an explicit commitment by stating what your company will never ask for by email, text or phone:
passwords, OTP codes or PINs;
full payment card details or bank details to "update";
urgent payments to an IBAN different from the usual one;
installing programs or apps to "secure" the account;
confirming personal data through a link or form received by email.
Keep the notice plain: no login links, no attachments, no artificial urgency. If customers need to act, for example by changing their password, ask them to sign in by typing the website address manually or by using the official app. Publish the same text on a page of your website reachable from the home page, so that anyone receiving a doubtful message can compare it with the official version.
Provide a verification channel that customers already know, such as the customer service number on your website or contract, and a dedicated address to which suspicious emails can be forwarded. Use the same sender and domain as your usual communications: a notice sent from a domain nobody has seen before is hard to tell apart from a phishing attempt.
Which technical defences reduce fake emails in your name?
Technical defences make it harder to use your domain to send fake emails. They do not eliminate the risk.
SPF, DKIM and DMARC on your domain
In April 2026 Italy's National Cybersecurity Agency (ACN) published guidelines on configuring email for sender authentication, with the aim of countering spoofing, phishing and message tampering. The ACN recommends implementing SPF, DKIM and DMARC together: SPF alone is not enough, DKIM signs messages and DMARC checks alignment and allows unauthenticated messages to be quarantined or rejected.
These protocols protect your exact domain, not similar ones. We cover them in detail in our guide on CEO fraud and fake IBANs, where you will also find how to introduce DMARC gradually without blocking legitimate email.
Look-alike domains to keep an eye on
A CSIRT Italia bulletin of 17 February 2026 on a Business Email Compromise campaign describes attackers registering domains very similar to real ones, using easily confused characters. The same trick can be used against your customers: a domain that differs by one letter makes a fake email convincing even when SPF, DKIM and DMARC are correctly configured.
That is why it is worth monitoring registrations of domains similar to yours, for example with services offered by registrars and security providers, and considering registering the most obvious variants in advance. If you find a domain being used to impersonate you, gather evidence, warn customers through official channels and assess possible actions with your technical and legal advisers, including reporting it to the police. Also check forgotten accounts, such as former employees' mailboxes that are still active: how to handle them is explained in our guide on a former employee's business email.
How do you prepare customer service?
Customer service is the front line after the notice: it will receive questions, reports and sometimes customers who have already clicked. If it is not prepared, it may give inconsistent answers or ask for personal data to "verify" identity, exactly as a fraudster would.
Prepare a shared script before sending the notice: what happened in simple words, which data are involved, what the company will never ask for and how to recognise a genuine communication. Agents must never ask for passwords or codes, or give details that have not yet been confirmed.
Define an escalation path. Reports of suspicious emails, texts or calls should be collected in one place, keeping the complete original message where possible, and passed on to whoever is handling the incident and to the DPO. They help you reassess the risk and update the documentation.
If a customer says they have already entered data on a fake page, the agent must know what to advise: change the password for the service straight away, and for any others where it is reused; if card or account details were given, contact the bank through known and reliable channels, as the Italian authority also suggests. Phishing does not necessarily arrive in the days of the notice: keep the script updated and to hand in the following weeks too.
Checklist: what to do in the first days after the exposure
This sequence does not replace your incident response plan, but it helps you not to miss the steps that reduce follow-up phishing. Adapt it to your situation together with your DPO.
Contain the breach and check which data were exposed: names, emails, phone numbers or other.
Assess the risk with your DPO, explicitly considering targeted phishing, and decide on notification and communication.
If notification is required, send it to the supervisory authority within 72 hours of becoming aware, in phases if needed.
Secure the sending channels before using them for the notice.
Check your domain's SPF, DKIM and DMARC and look for recently registered similar domains.
Prepare a dedicated notice, with no login links or attachments, listing what you will never ask for.
Publish the same information on your website and train customer service with a shared script.
Collect reports, reassess the risk and update the breach register.
What should you do in the following months?
In the following months the goal is to understand why it happened and reduce the likelihood of it happening again.
Review who has access to customer lists, which suppliers process customer records and with what safeguards, and whether the data you keep are really necessary. If a supplier was involved, check that the contract requires it to inform you without undue delay, as Article 33(2) requires.
Update training for all staff, not only customer service. In its summary sheet on personal data breaches, the EDPB lists among preventive measures training employees on data protection, multi-factor authentication for access to sensitive data and monitoring unusual data flows.
Finally, check that your response plan includes a notice template already approved, the channels to use, the customer service script and the DPO's contact details. The EDPB recommends involving the DPO in handling breaches; if you have no one in-house, consider an outsourced DPO. For a refresher on general principles and obligations, start from our guide on what the GDPR is.
How Complaion helps you with the GDPR and data protection
Complaion supports companies with GDPR compliance and with certifications on information management. A dedicated Lead Auditor starts from your situation, checks what you already have and what is missing, and proposes the most suitable path among GDPR compliance, ISO 27701 and ISO 27001.
The platform collects evidence, manages policies, privacy notices and the record of processing activities, keeps the review schedule and prepares you for the audit. The Lead Auditor also conducts the internal audit, so you know whether your procedures really work. If you need a data protection officer, there is our outsourced DPO service.
More than 1,000 clients have already chosen Complaion. If you want to understand where to start, contact us.
Frequently asked questions on data breaches and phishing
If only names and emails were exposed, do I have to inform customers?
It depends on the risk. Communication is mandatory only if the breach is likely to result in a high risk to individuals. What matters is the number of customers affected, the type of relationship the address reveals, any sensitive data and the likelihood of targeted phishing. Even when it is not mandatory, the EDPB considers informing people a good practice in many cases, so that they can protect themselves.
Is a notice on the blog or a press release enough?
No. According to EDPB Guidelines 9/2022, a notice confined to a press release or the corporate blog is not an effective means. You need dedicated, direct messages such as email or SMS, possibly alongside a prominent banner on the website. A public communication is foreseen when contacting people individually would involve disproportionate effort.
Can I include a link in the notification email?
It is best to avoid links to login pages or forms. A notice with a link to click is easy for fraudsters to copy and trains customers in the wrong habit. Instead, ask them to reach the website by typing the address manually or to use the official app, and give a support number they already know.
If I have informed customers, do I also have to notify the authority?
Yes, if notification is required. Notification to the supervisory authority is mandatory unless a risk to individuals is unlikely, while communication to customers is required where there is a high risk: if the risk is high, both are needed. Notification must be sent within 72 hours of becoming aware, through your authority's procedure, and every breach must be documented in the register in any case.
What should customer service do if a customer reports a suspicious email?
Thank the customer, ask them not to click and to forward the original message to the dedicated address, without ever asking for passwords or codes. The report should be logged and passed to whoever is handling the incident and to the DPO: it may point to an ongoing campaign or an undiscovered breach and lead to a reassessment of the risk.
