GDPR question

[jamesi85]

Hi, I am a customer of a loan product and requested an SAR request for my personal information in relation to a complaint I have ongoing with them. I have received the file through e-mail however they have sent me all of the personal information and complete financial history for another customer of theirs, should I report this to anybody?

[ostell]

The other customer and let them raise a complaint. And the ICO

[des8]

.....or you could write back to the company, letting them know you have received the info regarding another customer and you now want
1) your information
2) confirmation your info has not been sent to a third party
3) your complaint dealt with expeditiously

Then ask if they want you to inform their other customer and the ICO about this lapse.

Not suggesting you pressurise them. just asking what they want

[ploddertom]

If it were me I would be waiting until the last day to inform them.

[Sara James]

Yes inform that customer too and file a complaint

[charitynjw]

There is a general duty requiring the firm to self-assess the seriousness of the breach &, where necessary, to report it to the ICO.
Not every breach is reportable,

Loads of info on the ICO website.
https://ico.org.uk/for-organisations/report-a-breach/