One Bulk Email Exposed 18 People: The ICO's Warning for Every Outbound Team
On 5 August 2026 the UK's Information Commissioner's Office issued the Metropolitan Police Service an enforcement notice and a reprimand after personal information was disclosed in two sensitive cases. One of the two was an ordinary email. An officer wrote to everyone affected by a change to a suspect's bail date and placed the recipients in the "To" field. Eighteen people connected to the UK Parliament could then see each other's names and email addresses, and the context of the message made it possible to infer why they were on that list.
Nothing was hacked and no database leaked. One field on one message produced a regulatory action against the largest police force in the country, and the regulator's conclusion pointed squarely at the organisation's controls rather than the person who pressed send.
The Finding Was About Controls
The ICO concluded that the MPS failed to put in place appropriate technical and organisational measures to protect people's personal information, an infringement of section 40 of the Data Protection Act 2018. That phrasing is worth reading twice, because it is the same test any UK or EU business meets or fails under the equivalent provisions.
The investigation found the officer who sent the email had not completed data protection training for over four years, and that the line manager had not completed relevant training for almost four. Completion rates for mandatory Managing Information training across the force were low, and the MPS acknowledged that further improvement was needed. The regulator treated the incident as the visible output of that gap rather than as an isolated slip by one person.
Jo Stones, the ICO group manager for civil and cyber investigations, stated the standard plainly: "Policies and reminders are not enough if they are not followed, checked and enforced."
Where Commercial Teams Carry the Same Exposure
| Where it happens | What goes wrong | The control that removes it |
|---|---|---|
| A rep emails a segment from their own mailbox | Addresses land in To or CC and every recipient sees the list | Route any send above a set recipient count through a tool that addresses each message individually |
| A quick update to attendees, applicants, or a waitlist | Membership of the list itself discloses something about the people on it | Treat list membership as personal data and send one to one by default |
| A CSV handed between teams | Suppression and consent state travel separately from the addresses and then diverge | One system of record for suppression, checked at send time rather than at import time |
| A forwarded thread with an audience change | Earlier recipients and quoted content ride along unnoticed | Compose fresh whenever the audience changes |
| A shared mailbox with broad access | Nobody can establish afterwards who sent what | Named accounts, no shared credentials, and a send log you can query |
Cold outbound running through a sequencer is the low-risk case in that table, because every message gets composed and addressed to a single person by construction. Risk concentrates in the manual sends that sit outside the tool: the event reminder, the pricing change, the apology after an outage. Those leave from a normal mailbox, under time pressure, written by whoever is closest to the problem.
Volume Is Not What Makes a Send Sensitive
Two recipients can constitute a disclosure if pairing them reveals something. Three hundred can be harmless if the list is a public directory. The test the ICO applied was whether the context allowed sensitive information to be inferred, and the body of that email did not contain the sensitive detail at all. The subject and the sender were enough.
The practical version for a commercial team is one question asked before any multi-recipient send: does membership of this list say anything about these people that they would not want the others to know. Customers of a named competitor, applicants for a role, attendees of a debt restructuring webinar, anyone in a regulated or investigative context. Where the answer is yes, individually addressed sends are the only acceptable route, and the decision does not belong to whoever happens to be drafting.
Build the Control Rather Than Circulating the Reminder
The MPS responded with a force-wide reminder about mandatory information security training and a new behavioural alert tool that prompts staff when an email is heading to multiple external recipients. The ICO considered those steps and still issued the enforcement notice, because training completion remained low and the wider technical work had not been shown to be effective.
That sequence is the useful lesson for a sales leader. An alert is better than nothing, and it remains a prompt that a busy person dismisses on the way to sending. Controls that hold are the ones that remove the option: mail flow rules blocking external sends above a recipient threshold, a platform where individual addressing is the only available mode, permissions that stop most of the team from mailing a list at all.
Training still matters, and the four-year gap in this case is a genuine finding. Treating training as the primary defence is what the regulator declined to accept.
Compliance failures in outbound rarely come from the campaign engine. They come from the improvised send that skipped it, which is why the rule has to name the mailbox as well as the platform.
Want Outbound Where the Controls Are Built In?
We set up the sending infrastructure, suppression logic, permissions, and reply handling inside accounts you own, then run the whole motion with one system of record for who was contacted and why. Lists get checked before they send rather than after somebody notices, and the evidence sits where an auditor or a nervous general counsel can read it.
Frequently Asked Questions
Hiring an in-house SDR costs $5,500+/month in salary alone, before tools ($3K–5K/month), training, and management. Agencies typically charge $3,000–8,000/month. A managed outbound system like LeadHaste runs $2,500/month — with infrastructure the client owns and a performance guarantee.
With a properly built system, most clients see their first qualified replies within 2–3 days of campaign launch (after the 2–3 week warm-up period). The real power shows in month 2–3 as domain reputation strengthens, sequences optimize from real data, and targeting sharpens.
In-house works if you have a dedicated ops person, 6+ months of runway for ramping, and budget for 20+ tool subscriptions. Outsourcing makes sense when you want speed-to-pipeline, can't justify a full-time hire, or need multi-channel orchestration (email + LinkedIn + intent data) that requires specialized tooling.
Inbound attracts leads through content, SEO, and ads — prospects come to you. Outbound proactively reaches prospects through targeted email, LinkedIn, and calls. Inbound scales slowly but compounds over time. Outbound delivers faster results but requires ongoing execution. The best B2B companies run both.
A compound outbound system is an orchestrated set of 20–30 tools (enrichment, sending, warm-up, analytics) that improves automatically over time. Month 2 outperforms month 1 because domain reputation strengthens, AI sequences learn from engagement data, and targeting tightens from real conversion patterns. It's the opposite of starting fresh every month.
Dimitar Petkov
Co-Founder of LeadHaste. Builds outbound systems that compound. 4x founder, Smartlead Certified Partner, Clay Solutions Partner.