Posted By Sean Fraser
Steve,

there is no reason why you cannot give your client a version that has sanitised out the personal details - after all, the client cannot reasonably argue they need that info (wehat purpose would it serve?).

They are probably more interested in why it happened, not to whom. It is a reasonable request in my mind although I noted you said it didn't happen on their patch, so you might want to find out why they want to know.

There is often a mistaken fear to admit accidents to clients as we feel it might demonstrate our failure to apply safe systems - not the case. What the client is more interested in is not the fact that it happened, but why, and what has been done since to prevent it recurring.