GDPR data breach during project handover

Your 18-person practice has just reached practical completion on a £6m housing-association scheme of 42 rented and shared-ownership flats in Leeds. The handover meeting is scheduled for Friday morning. On Wednesday afternoon, a Part 2 architectural assistant in your team emailed the consolidated Operation and Maintenance (O&M) manual to the client's facilities manager. The manual is 480 pages and contains: a key plan annotated with the names of leaseholders matched to flat numbers; the contact telephone numbers and email addresses of 14 named residents who agreed to be project liaisons; a separate appendix listing the layout of three flats specifically designed for tenants with mobility impairments, with detailed dimensions of grab rails, transfer spaces, and the location of medical alarm pull cords; and the contractor's residual fire risk register listing the apartments housing vulnerable persons by reference to their PEEP (Personal Emergency Evacuation Plan). On Friday morning, 48 hours after the email was sent, your office manager discovers that the email address used by the assistant was not the client's facilities manager but a similarly named contact in the recipient's address book: a facilities manager at a completely unrelated commercial site managed by a different contractor. The recipient confirmed in a Friday morning telephone call to your office that he received the email, that he opened it and reviewed the index, but states that he has not forwarded, printed, or saved it, and that he is willing to delete it on confirmation that no further action is required. The residents have not been told. The housing association client and the unintended recipient contractor have been told. Your professional indemnity insurer has been notified and is asking what notifications you have made to the ICO and to the data subjects. Your Data Protection Officer is on maternity leave; the deputy DPO is asking for a written briefing within two hours.