What counts as a personal data breach under the GDPR?

A breach of security that leads to personal data being destroyed, lost, altered, disclosed or accessed without authorisation, whether by accident or on purpose. It is broader than a leak: ransomware that encrypts a customer database is a breach even if nothing was copied, because the data became unavailable, and so is an e-mail sent to the wrong recipients or a lost unencrypted laptop. Not every security incident is a personal data breach, since some involve no personal data, and not every breach must be reported. Under Article 33 of the GDPRGDPR: General Data Protection Regulation. The EU data protection law (Regulation (EU) 2016/679)., the controller notifies the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware, unless the breach is unlikely to result in a risk to people; every breach must be documented either way. Decide with your DPODPO: data protection officer. The person responsible for data protection in a company under the GDPR.. From the Starter plan, NetSenX prepares a draft Article 33 notification for your DPO from the incident data; assessing the risk and submitting stay with you.

General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.

← All 20 questions on EU law: GDPR, DORA, CRA and AI ActAll topics