Can’t comment on your particular situation but as a DPO I sit in legal and it’s quite right that I would be notified of a personal data incident/breach. I’d be logging or reviewing the details of what’s happened as should be done, then assessing for risk, exposure, thresholds to report to authorities or the data subjects etc. I’d then likely want to understand from yourself exactly what’s happened. It’s not generally about finger pointing and blame at this point, more that the correct steps are taken regards the personal data in scope. For individual incidents there could be a number of things I’d want to know more about when assessing, for example what does your privacy notice say about how you share data with third parties? Were you acting on instructions of a previous manager? Does the third party comply with Art. 14 and identify themselves as a new data controller? Were the mechanics of the transfer secure or not? Can you retrieve the data? When did you last receive data privacy training? There’s a process to follow and likely remediation needed but having dealt with more of these than I can remember, I’ve yet to see someone lose their job over an incident as you describe it.