When a Misdirected Email Becomes a Data Breach: Lessons from the Morgan Stanley Deal-List Leak

A banker reportedly attached the wrong file to a routine client email. The file was Morgan Stanley’s internal deal pipeline, more than a hundred transactions the firm was running or watching across Asia and beyond.  His attempt to recall the email was unsuccessful and rival bankers were soon saying they would use the list to chase the same deals while regulators in three jurisdictions had begun asking questions.

The firm met the clients whose deals were named, told staff to keep the list off their own devices and ran training built around the misdirected email in particular. Securities and Exchange Board of India (“SEBI”) began looking at whether its rules were touched and Hong Kong and mainland China noticed too.  The incident also raises questions about the legal consequences of an email sent in error.

The incident raises questions under two distinct legal regimes and the issues need to be considered separately. One concerns securities regulation and the handling of price-sensitive information; the other concerns the protection of personal data. While SEBI’s attention is on the first, the data protection implications are relevant to businesses beyond banking, particularly as the DPDP framework comes into force.

Securities law implications

The securities law question is whether the disclosure involved unpublished price-sensitive information. The insider-trading rules forbid an insider from passing on unpublished price sensitive information about a listed or soon-to-be-listed company, except for a legitimate purpose.[1]  An upcoming IPO, block trade or acquisition may involve unpublished price-sensitive information.  The relevant provisions cover unauthorised disclosure of such information, even if no trade takes place. Anyone who receives such information may be treated as an insider and may have a duty to keep it confidential. So, forwarding the list to clients, even by mistake, may have brought some recipients into possession of unpublished price-sensitive information.  The regulator is, therefore, likely to look not only at what information was leaked, but also at why the company’s safeguards failed to prevent the leak.

Data protection implications

The data protection position is different and the starting point is whether the file included personal data.  The Digital Personal Data Protection Act (“DPDP Act”) is about personal data, meaning data about an identifiable person.[2] While a pipeline of corporate deals is mostly confidential business information which is not directly the subject matter of the DPDP Act, the deal papers are seldom so tidy. If the file identifies individuals such as promoters, fund partners or bankers that information is personal data and letting it slip may have implications under the DPDP Act.

On that footing a misdirected email is about as clear a personal data breach as one could invent. The definition is wide on purpose, covering any accidental disclosure that compromises the confidentiality of personal data, with no malice needed and no minimum threshold below which a breach can be ignored. Two duties then start the moment the organisation knows: it must tell each affected person without delay and tell the Data Protection Board, at once and then in fuller form within seventy-two hours. Behind both sits the standing duty to have guarded the data properly to begin with. And none of it can be contracted away: the company answers for the breach even where a processor was handling the data and even where the person who sent the email meant no harm.

When the DPDP obligations take effect

The commencement dates are important. The DPDP Act was enacted in 2023, but its implementation was dependent on notification of the Rules which came in November 2025. Even then, the provisions did not all take effect at the same time. The provisions most relevant to a data leak like this one –those concerning data security and the obligation to report a personal data breach –  are scheduled to take effect in May 2027. However, this should not provide the company with blanket protection, since its exposure under securities laws may already exist today. What the DPDP Rules provide is a future compliance deadline and a window for preparation. A firm that uses the time before May 2027 to establish data-scanning and labelling processes and develop a tested incident-response plan should be better prepared than one forced to put these measures in place. An email sent with the wrong attachment can expose customer records, salary details or patient information.

Practical steps for businesses

An email sent with the wrong attachment can expose customer records, salary details or patient information. The law now recognises that data leaks can happen through both human error and deliberate theft and treats them alike for reporting. So, the sensible response is to focus not only on responding to data breaches but also on preventing them in the first place.

The controls that help are often simple. Software that checks outgoing emails and flags messages with suspicious attachments or incorrect recipients can help prevent such mistakes. Warnings before sending emails to external recipients and a short delay that allows employees to recall a message can also prevent many errors at little cost. Finally, businesses should have a data breach response plan and test it regularly to ensure they can act quickly when a breach occurs.

 Workplace tools can also contribute to inadvertent disclosures. For example, email autocomplete may select the wrong recipient, digital assistants may send emails on someone’s behalf, and AI tools may share sensitive documents. Businesses should have clear policies on which tools can be used to handle client or deal-related information. They should also prohibit employees from entering such information into tools that have not been approved for that purpose.

 The risk is not confined to banking, and an email sent in error may attract regulatory scrutiny and cause commercial harm to a business. Businesses can reduce these risks by labelling sensitive documents, checking outgoing emails and regularly testing their data breach response plans.

[1]SEBI (Prohibition of Insider Trading) Regulations, 2015. The provisions chiefly in point read as follows.

Regulation 2(1)(n) — “unpublished price sensitive information”:

“unpublished price sensitive information” means any information, relating to a company or its securities, directly or indirectly, that is not generally available which upon becoming generally available, is likely to materially affect the price of the securities and shall, ordinarily including but not restricted to, information relating to the following: — (i) financial results; (ii) dividends; (iii) change in capital structure; (iv) mergers, de-mergers, acquisitions, delistings, disposals and expansion of business and such other transactions; (v) changes in key managerial personnel.”

Regulation 3(1):

“No insider shall communicate, provide, or allow access to any unpublished price sensitive information, relating to a company or securities listed or proposed to be listed, to any person including other insiders except where such communication is in furtherance of legitimate purposes, performance of duties or discharge of legal obligations.”

Regulation 3(4):

“Any person in receipt of unpublished price sensitive information pursuant to a ‘legitimate purpose’ shall be considered an ‘insider’ for purposes of these regulations and due notice shall be given to such persons to maintain confidentiality of such unpublished price sensitive information in compliance with these regulations.”

Regulation 9A further requires a listed company or intermediary to keep an institutional mechanism, including a written procedure for inquiry into a leak or suspected leak and a structured digital database of those with whom such information is shared. The 2(1)(n) definition was widened by the 2025 amendment; the text above is as in force at the time of writing and should be checked against the gazetted regulations.

[2]Digital Personal Data Protection Act, 2023, Sections 2(u), 8(1) and 8(4) to (6) and the Schedule; the Digital Personal Data Protection Rules, 2025, Rules 6 and 7. The safeguards and breach notification duties sit in the group of Rules carrying an eighteen-month transition and become effective on 13^th May 2027.

Author: Dwaipayan Das

Co-Author: Amiya Mukherjee

This content is intended for informational purposes only and does not constitute a legal opinion. Readers are encouraged to seek legal counsel prior to acting upon any of the information provided herein. Despite our efforts to maintain accuracy, we do not make representations, warranties or undertakings regarding the quality, completeness or reliability of the content.  This content, including the design, text, graphics, their selection and arrangement, is Copyright 2026, Lexplosion Solutions Private Limited or its licensors. ALL RIGHTS RESERVED, and all moral rights are asserted and reserved.

For any clarifications, please reach out to us at 91-33-40618083 or inquiries@lexplosion.in. Refer to our privacy policy by clicking here.