Make a SAR and got someone else’s financial details - WWYD?

[LifeIsPainHighness]

I made a Subject Access Request to an organisation. They sent me my information but it included correspondence from someone who happens to be my friend, to the organisation, about financial assistance (judging by the email subject title). I haven’t read the email body or attachments but because I didn’t realise it was initially not about me, I did glance at the email/attachments. The titles of the attachments point to bank statements, mortgage statements and payslips.

I have no idea why it’s ended up in my SAR response, or how.

Should I tell my friend or tell the organisation? I’m very sketchy on these things but I’m pretty certain it’s bad that this has happened!

I'd let them know. They have an obligation to report this to the ICO, so I'd tell them you know this and would like to be informed of the ICO's response.

Tell the organisation, so they can inform their customer and the ICO.

What kind of organisation is it? A local one? Its a huge coincidence that they accidentally send wrong documents and it belongs to someone you actually know. Do they live in same street? Have same or similar name?

What did they say when you contacted them to point out there mistake?

It's a definite breach of something - Confidentiality? Data Protection? Don't know what exactly.

But you should let them know so that they can investigate and try to ensure it doesn't happen again.