Encourage reporting – If the worst happens and an email goes out Cc'd instead of Bcc'd, staff should be encouraged to report the unauthorised disclosure to those responsible for data protection. That way, it can be recorded in the Breach Register and can be learnt from.