Separately in time is not separately in channel

Not the way most firms do it. The document arrives as a plain attachment, or as a password-protected file whose password is in the next message down the same thread — and then it sits in the mailbox for years.

The ICO’s encryption guidance is specific about that second half. On encrypted attachments: “To achieve the maximum guarantees that can be offered by the use of encrypted attachments the key must be communicated over a separate communication channel, eg by disclosing the password over the telephone upon confirmation that the email has been delivered.” On encrypted media it is blunter still — putting the password in the same envelope as the disc “effectively removes the protection offered from encryption.” (ICO, Encryption scenarios, read 2 September 2025.)

A reply is the same envelope. So is a second email sent an hour later. So, in practice, is a WhatsApp message to a phone that is signed into the same mailbox.

The test is one compromise, not two messages

Ask whether a single compromised account gives up both halves. Password in the follow-up email: one account, both halves, protection gone. Password read out on a call to a number you already held on file: two separate things an attacker has to have. That is the whole test, and it is why “we send it separately” is not an answer. Separately in time is not separately in channel.

Phishing is the reason to bother. It remained the most common breach or attack type in the DSIT Cyber Security Breaches Survey 2025/2026, experienced by 38% of businesses in the preceding 12 months (published 30 April 2026). Mailbox takeover is the ordinary outcome of it, and the ordinary mailbox holds every identity document the firm has ever been sent.

Change one request this week. Take the document you ask for most — the passport, the three months of statements — and rewrite the email that asks for it. Give the client the password on the phone when you book the appointment, so it never exists in writing anywhere. Then move the file out of the mailbox once you have acted on it, and delete the message. The encryption protects the file in transit. Nothing protects a mailbox you never empty.