Personal data breach
A personal data breach is a breach of security that leads to personal data being destroyed, lost, altered, disclosed or accessed without authority, whether by accident or on purpose. A lost laptop, ransomware that locks a customer database and an email sent to the wrong person all count. Some breaches must be reported to the regulator within 72 hours.
- Clauses
- EU GDPR Article 4(12) · UK GDPR Article 4(1) · UK GDPR Article 33(1) · UK GDPR Article 34 · UK GDPR Article 33(5)
Where the term appears
EU GDPR Article 4(12) defines it, and the UK text holds the same words as point (12) of UK GDPR Article 4(1). UK GDPR Article 33(1) requires you to report a breach to the regulator without undue delay and, where feasible, within 72 hours of becoming aware of it, unless it is unlikely to put anyone at risk. UK GDPR Article 34 requires you to tell the people affected when the risk to them is high. EU GDPR uses the same article numbers. The personal data breaches page covers what each report contains.
Wider than a leak
A breach can hit confidentiality (data seen by the wrong people), integrity (data altered) or availability (data lost or locked away, even for a while). Auditors look for the ones teams miss: an outage that left records unreachable, or a spreadsheet overwritten with no backup. Every breach goes in your own breach log, reported or not (UK GDPR Article 33(5)), and the log is often the first thing a regulator asks to see.
How Sted uses it
- Sted’s knowledge base includes a Data Protection Incident Record (REC-DPI) under the Incident Management Procedure (PRC-IMP), with ten sections from what happened and whose data was involved, through the risk to people, containment and who had to be told and when, to the root cause and a post-incident review.
- Records are part of the Full Management System plan.
Sted does not report a breach to the regulator or contact the people affected. Your organisation does that, within the deadlines the law sets.
Related terms
- Personal data: what the breach affects.
- Controller and processor: the controller reports; a processor must tell the controller without undue delay.
- Special category data: raises the risk to the people affected.
- Incident response and breach notification: the task, step by step.