Can I just BCC my client list?

No, not for anything containing personal information. The ICO’s position is that BCC is “not enough on its own to properly protect people’s personal information.” It is a courtesy field, not a security control.

That distinction matters because BCC fails in a specific, predictable way: one wrong field. Put an address in To or Cc instead of Bcc and you have disclosed your entire client list to every person on it. There is no undo, and for a firm whose clients are mid-divorce, mid-insolvency or mid-house-purchase, the list itself is the sensitive thing — before you get anywhere near an attachment.

This is not a rare accident. Nearly a thousand BCC-related breaches have been reported to the ICO since 2019, and it has stayed one of the top ten non-cyber breach types throughout that period. It is one of the most common ways small organisations end up making a report.

What to do instead

The ICO names three alternatives, in roughly ascending order of effort:

1. A bulk email service. Mailchimp, Brevo, Buttondown — anything that sends one message per recipient by design. Each person receives their own email and cannot see anyone else.
2. Mail merge. If you are sending from Outlook or Gmail to twenty people, mail merge does the same job without a new subscription.
3. Secure data transfer for anything genuinely sensitive — a portal or link, rather than an attachment sitting in a mailbox indefinitely.

The practical rule: if the recipients would be surprised to learn the others existed, BCC is the wrong tool. That covers most client lists, and nearly all of them in mortgage, legal, accountancy and insurance work.

The version that actually sticks

Write it down. Not a policy document — one line in whatever you already use as a process note: bulk client email goes through [tool], never through BCC. Habits beat intentions here, and the mistake almost always happens when someone is in a hurry and reaches for the fastest thing to hand.