Misdirected email and email recall: what recall really does and how to respond

An email sent to the wrong person is one of the most common ways personal data leaves an organisation, and the recall button most people reach for first usually cannot fix it. Recall in Microsoft 365 works only in specific conditions, Gmail offers a short undo window and no recall after it, and once a message has reached another organisation the sender has almost no technical control. This guide explains exactly what Outlook recall, cloud-based message recall, Gmail Undo Send and encrypted message revocation can and cannot do, how to respond when a message has gone astray (including the UK GDPR and ICO reporting decision), and which controls prevent the mistake in the first place. It is for email administrators, data protection officers and security teams.

Key takeaways

• Recall only works inside your own Exchange Online organisation or with tenants that have explicitly allowed it. Messages to Gmail, other mail systems or the internet cannot be recalled.
• Gmail Undo Send is a delay, not a recall. It holds the message for 5 to 30 seconds; after that the message has gone.
• Encrypted mail is the exception that helps. Microsoft Purview Message Encryption can revoke link-based encrypted messages after delivery, including to external recipients, which is a reason to encrypt sensitive mail by policy.
• A misdirected email with personal data is a personal data breach. The ICO lists data "sent to the wrong address" as an example. Assess risk quickly, ask the recipient to delete, document it, and report within 72 hours if it is likely to result in a risk to individuals.
• Prevention beats recall. External recipient warnings, DLP policy tips, delayed delivery, encryption by default for sensitive data and clean autocomplete lists stop most incidents before they happen.

What each recall and undo feature actually does

Microsoft 365 recall in detail

Microsoft's support article states that both sender and recipient need a Microsoft 365 work or school account in the same organisation, and that personal email accounts cannot use message recall. Exchange Online now uses cloud-based message recall, documented on Microsoft Learn. The main behaviours:

• Mechanism: a Message Recall feature agent intercepts the recall request (message class IPM.Outlook.Recall, subject "Recall: <original subject>") and tries to hard-delete the original from recipient mailboxes. It keeps trying for up to 24 hours.
• Report: a Message Recall Report arrives in the sender's mailbox within minutes, with a link to per-recipient status, sent from [email protected]. If reports do not arrive, check that this sender is not blocked or quarantined.
• Read messages: whether already-read messages can be recalled is an organisation setting (RecallReadMessagesEnabled). Even when recall of read messages succeeds, the recipient has already seen the content, so treat it as disclosed.
• Cross-tenant: the receiving tenant decides. It must enable cross-tenant recall with Set-CrossTenantRecallConfiguration and allow-list the sender's tenant ID; otherwise the report says the message cannot be recalled across organisations.
• Hybrid: messages from cloud mailboxes to on-premises Exchange mailboxes cannot be recalled.
• Forwarding: automatic forwarding to another mailbox in the same organisation can be recalled; automatic forwarding outside the organisation, manual forwarding by the recipient and forwarding or redirecting by inbox rule cannot.
• Other exclusions: messages to mail-enabled public folders cannot be recalled by design. In Outlook for Windows, recall does not work in Online mode or with profiles containing multiple Exchange accounts.
• Encrypted messages: Purview Message Encryption or sensitivity-label-encrypted messages can be recalled if the sender has the PREMIUM_ENCRYPTION service plan and recalls from Outlook on the web or new Outlook.
• Evidence: recalled messages remain visible to eDiscovery where a mailbox is on Litigation Hold or In-Place Hold, and recalls do not appear in mailbox audit logs. Use message trace (Get-MessageTraceV2 with the Drop event detail) to confirm the result: Result:Success or Result:Failed.

Admin settings

Decision point: enabling recipient alerts is more transparent but tells the recipient there was something worth recalling, which can draw attention to it. Many organisations keep alerts off and rely on direct contact with the recipient as part of the incident response below.

Gmail and Google Workspace

• Undo Send: after sending, Gmail shows "Message sent" with Undo. Users choose a send cancellation period of 5, 10, 20 or 30 seconds under See all settings. Setting it to 30 seconds is a cheap, effective habit for anyone handling personal data.
• No recall after the window: Google's help describes no other way to unsend. Once delivered, the message is under the recipient's control.
• Admin removal inside your domain: in Frontline Plus, Enterprise Plus and Education Plus, admins with the Security center administrator privilege can use the security investigation tool to find a message and delete it from users' mailboxes in your organisation. This helps when the wrong internal recipient got the message, not when it went outside. Messages already deleted from Trash cannot be found.
• External recipient warnings: the "Warn for external recipients" setting (Admin console: Apps, Google Workspace, Gmail, End User Access) is on by default and shows a banner when composing to, replying to or threading with external addresses, except those in the Directory or the user's contacts. Check it has not been turned off for any organisational unit.

Why recall so often fails

• The recipient is external. Most damaging misdirected emails go outside the organisation, where recall has no reach unless the other tenant is on Exchange Online and has allow-listed you.
• It has already been read or synced. Mobile clients and preview panes display content almost immediately; deletion afterwards does not undo disclosure.
• It has been forwarded manually, by rule or to an external system, which Microsoft documents as not recallable.
• Client limitations: Outlook for Windows in Online mode or with multiple Exchange accounts, public folder recipients and hybrid on-premises recipients.
• False reassurance: senders assume recall worked and do not report the incident, losing time against the 72-hour clock. Always check the Message Recall Report.

How to respond to a misdirected email

The ICO lists data "sent to the wrong address" as an example of a personal data breach. The response combines containment, a risk assessment and the reporting decision.

1. Report internally at once. The sender tells the security or data protection team immediately, even if recall appears to have worked. Make this a no-blame expectation so people report quickly.
2. Try the technical options in parallel: recall (internal or allow-listed tenants), admin purge for internal mailboxes, revocation for link-based encrypted messages (Get-OMEMessageStatus to check IsRevocable, then Set-OMEMessageRevocation -Revoke $true), and revocation of any shared links or files attached by link.
3. Contact the recipient. Ask them not to open or forward the message, to delete it including from deleted items, and to confirm deletion in writing. ICO assessment guidance treats a recipient who reports the error as having acted responsibly, and notes that confirmation of deletion by a professional recipient and assurances that data will not be shared are relevant mitigating factors.
4. Rotate anything secret. If the message contained passwords, API keys, tokens or links with embedded access, revoke and rotate them now. Do not rely on the recipient's deletion.
5. Assess risk. Consider the type and sensitivity of the data (special category data raises risk), how many people are affected, whether children or vulnerable adults are involved, who the recipient is (a trusted professional or an unknown external party), whether the data was encrypted, and whether it is likely to cause harm such as fraud, distress or loss of confidentiality.
6. Decide on reporting. Under UK GDPR Article 33(1), the controller notifies the regulator without undue delay and, where feasible, within 72 hours of becoming aware, unless the breach is unlikely to result in a risk to individuals' rights and freedoms. Where the risk to individuals is high, Article 34 requires telling them without undue delay. The ICO accepts reports by phone or online form.
7. Document it whatever you decide. Article 33(5) requires the controller to document all personal data breaches, including facts, effects and remedial action, so that compliance can be verified. Record the reasoning for not reporting as carefully as a report.
8. Fix the cause and review whether controls below would have prevented it.

Note on the UK regulator: the UK GDPR text on legislation.gov.uk now refers to the Information Commission, reflecting amendments being brought into force; check the ICO site for the current reporting route. For other jurisdictions see the Breach Notification Laws by Country Guide and the Data Breach Notification Checklist.

Typical risk outcomes

Prevention controls

• External recipient warnings: Gmail's warning is on by default; in Microsoft 365 use external recipient MailTips and external sender tagging. Warnings only work if they are not shown so often that users ignore them.
• Delay delivery: set Gmail Undo Send to 30 seconds and enable Undo Send in new Outlook; classic Outlook users can use a client rule to defer delivery by a minute or two. The delay catches the "wrong person" moment that happens just after pressing Send.
• Clean autocomplete: autocomplete picking a similar name is a common cause. Train users to remove stale or personal addresses from suggestions, and for high-risk teams consider restricting it.
• DLP policy tips and blocking: Microsoft Purview or Google Workspace DLP rules can warn or block when sensitive data types (national identifiers, health or financial data) are sent externally, or require justification. See the Data Loss Prevention (DLP) Guide.
• Encrypt sensitive mail by policy: mail flow rules or sensitivity labels that apply Purview Message Encryption make link-based messages revocable after delivery. Microsoft recommends a custom branding template to make sure encrypted messages can be tracked and revoked.
• Share links, not attachments: sending a link to a file in SharePoint, OneDrive or Google Drive with access restricted to named people means a misdirected link can be revoked and access is logged.
• Bulk mail through the right tool: send group communications from a mailing system that personalises each message rather than using CC or BCC lists.
• No credentials by email: use a secrets manager or a one-time secret sharing tool. See the Secrets Management Guide.

Choosing controls by organisation size

• Small organisations: turn on Undo Send at the longest setting, keep external warnings on, ban credentials and bulk CC lists by policy, and write a one-page misdirected email procedure.
• Larger and regulated organisations: add DLP with policy tips for sensitive data types, encryption by default for teams handling special category data, cross-tenant recall agreements with close partners on Exchange Online, and incident metrics.

Detection and measurement

• Self-reports: the main detection source. Track time from send to internal report.
• Message Recall Reports and message trace: monitor recall use; a spike indicates a process or training issue.
• DLP events: overrides and justifications on external sends of sensitive data.
• Encryption reports: Purview's Message Encryption report shows revocation status for encrypted mail.

Metrics:

• Number of misdirected email incidents per month, split by internal and external recipient.
• Median time from send to report to the data protection team.
• Percentage of incidents with written confirmation of deletion from the recipient.
• Percentage of reportable incidents reported within 72 hours.
• Percentage of external emails containing sensitive data types that were encrypted.

Common failure patterns

• Relying on recall and saying nothing: the sender recalls, assumes it worked and never reports. The recall report often says failed.
• CC instead of BCC on sensitive group mailings: the recipient list itself discloses personal data.
• Emailed credentials not rotated: in the Poland ArcGIS password leak, login details accidentally put into an email were later exposed while still valid, because the password had not been changed in three years and there was no MFA.
• Warning fatigue: external warnings on every thread train people to click through.
• No record for non-reported incidents: breaches judged below the threshold are not documented, failing Article 33(5).
• Attachments instead of controlled links: nothing can be revoked once the attachment is delivered.

Framework mapping

Practitioner checklist

• Confirm cloud-based message recall settings in Exchange Online and decide on recipient alerts and the maximum recallable age.
• Agree cross-tenant recall allow-lists with close partners that use Exchange Online.
• Set Gmail Undo Send to 30 seconds and enable Undo Send in new Outlook for staff handling personal data.
• Check external recipient warnings are on for every organisational unit or policy.
• Apply DLP policy tips or blocks for sensitive data types sent externally.
• Encrypt sensitive external mail by policy with a branding template so messages are revocable.
• Publish a short misdirected email procedure: report, contain, contact recipient, rotate secrets, assess, decide, document.
• Keep a breach log covering every incident, including those not reported.
• Track incident counts, time to report and 72-hour compliance.

Standards and references

• Microsoft Learn: Work with cloud-based message recall
• Microsoft Support: Recall or replace an email message that you sent
• Microsoft Learn: Revoke email encrypted by Advanced Message Encryption
• Google: Gmail Help, Undo sent emails
• Google Workspace: Control Gmail external recipient warnings
• Google Workspace: Security investigation tool, Gmail messages
• ICO: Report a personal data breach
• legislation.gov.uk: UK GDPR Article 33

Related NHI Mgmt Group resources: Data Loss Prevention (DLP) Guide · Data Breach Notification Checklist · Email Security Guide · OpenPGP and S/MIME Email Encryption Guide. This guide summarises recall features and UK GDPR breach obligations and is not legal advice.