Glossary
Personal data breach
A breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data.
Article 4(12) GDPR defines a personal data breach as "a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed". Guidance from the Article 29 Working Party, endorsed by the EDPB, groups breaches into three types: confidentiality (unauthorised disclosure or access), integrity (unauthorised alteration) and availability (loss of access or destruction).
The definition matters to security teams because it is wider than "data leak". A ransomware attack that encrypts a database without exfiltration can still be a breach if personal data becomes unavailable, for example when no usable backup exists. Not every security incident is a personal data breach, but every personal data breach is a security incident.
Once the controller is aware of a breach, Article 33 requires notification to the supervisory authority without undue delay and, where feasible, within 72 hours, unless the breach is unlikely to result in a risk to individuals. Article 34 requires communication to data subjects where the risk is high, and Article 33(5) requires every breach to be documented. Our breach notification guide walks through the full workflow.