Meh, happens all the time
This sort of thing happens quite regularly with the 3rd sector.
I work for a local authority and have on several occasions had to instruct our staff to recover and secure personal information that has been left behind by charities and care providers.
We being the local council usually get informed (and blamed) even when it's nothing to do with us at all. But we'll assume a duty of care and secure the information until the ICO tells us what to do (usually secure destroy at our (well yours Mr Taxpayer) expense).