# What counts as a personal data breach under the GDPR?

A breach of security that leads to personal data being destroyed, lost, altered, disclosed or accessed without authorisation, whether by accident or on purpose. It is broader than a leak: ransomware that encrypts a customer database is a breach even if nothing was copied, because the data became unavailable, and so is an e-mail sent to the wrong recipients or a lost unencrypted laptop. Not every security incident is a personal data breach, since some involve no personal data, and not every breach must be reported. Under Article 33 of the GDPR, the controller notifies the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware, unless the breach is unlikely to result in a risk to people; every breach must be documented either way. Decide with your DPO. From the Starter plan, NetSenX prepares a draft Article 33 notification for your DPO from the incident data; assessing the risk and submitting stay with you.

General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.

FAQ: [EU law: GDPR, DORA, CRA and AI Act](https://netsenx.com/en/faq/eu-law) · https://netsenx.com/en/faq/what-counts-as-a-personal-data-breach

## Read next

- https://netsenx.com/en/blog/2026-10-26_ai-act-nis2-dora-cra
- https://netsenx.com/en/compliance
- https://netsenx.com/en/dpa

## Related questions

- [What is the difference between a controller and a processor under the GDPR?](https://netsenx.com/en/faq/controller-or-processor-what-is-the-difference)
- [What security measures does the GDPR actually require?](https://netsenx.com/en/faq/what-security-does-the-gdpr-require)
- [Does our company need a data protection officer?](https://netsenx.com/en/faq/do-we-need-a-data-protection-officer)
- [Can we monitor our network for security on the basis of legitimate interest?](https://netsenx.com/en/faq/can-we-monitor-the-network-under-legitimate-interest)
- [How high can GDPR fines be?](https://netsenx.com/en/faq/what-are-gdpr-fines)