Personal data breach

Under the GDPR, a personal data breach is an event that may lead to unauthorised access to, alteration of or loss of personal data.

Explained – what is a personal data breach?

A personal data breach is a security incident affecting personal data that creates risks to the rights and freedoms of natural persons. The term is defined in Article 4(12) of the GDPR as a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or unauthorised access to, personal data. Examples include cyber attacks, misdirected mailings or lost USB drives. Personal data breaches are particularly relevant within data protection and information security.

When does a personal data breach become relevant?

The issue arises whenever an organisation processes personal data and something occurs that threatens confidentiality, integrity or availability. This includes internal mistakes and external attacks. For example, an employee may send personal data to the wrong recipient, a database may be hacked, or physical records may go missing. As soon as personal data are processed, these events can occur and the organisation must take measures to prevent them.

Illustration of a GDPR personal data breach, showing a compromised laptop, exposed personal data and security incident management.

Key considerations for personal data breach management

Organisations that process personal data should maintain clear procedures to prevent and handle personal data breaches. The following aspects are critical:

  • Maintain a documented incident response plan and incident management procedure aligned with GDPR requirements.
  • Provide staff awareness training on the secure handling and protection of personal data.
  • Implement technical safeguards such as encryption and access controls.
  • Establish routines for rapid incident triage, incident assessment and incident investigation.
  • Report certain breaches to the Data Protection Agency within 72 hours (GDPR breach notification).
  • Inform data subjects where there is a high risk to their rights and freedoms.
  • Keep incident documentation for all events, including those not requiring notification, and record them in a breach register.

Following these points is essential to reduce harm and avoid administrative fines GDPR.

Frequently asked questions on personal data breach

A personal data breach is any security incident affecting personal data, for example unauthorised access or data loss. This reflects the GDPR personal data breach meaning in Article 4(12) and covers a wide range of scenarios (see examples of personal data breaches above).

A personal data breach must be reported to the Data Protection Agency within 72 hours of discovery if it may pose risks to data subjects’ rights and freedoms. In some cases, data subjects must also be notified. This is part of the GDPR personal data breach notification duty.

Handling should follow a clear, staged process:

  • Identify and contain the incident
  • Assess the risks to data subjects
  • Notify the Data Protection Agency where required (72-hour deadline)
  • Inform data subjects where a high risk exists
  • Document the entire sequence of events

Rapid action limits harm and helps meet GDPR requirements, including the 72-hour deadline, by ensuring the right controls and evidence are in place.

The responsible party is the data controller, i.e. the organisation that determines the purposes and means of the processing of personal data. If a data processor detects a breach, it must alert the data controller even if the data were processed in the processor’s systems.

A personal data breach concerns events affecting personal data, while an IT security incident may involve any type of data or systems. An IT incident becomes a personal data breach where personal data are involved.

If you need structured support, a data breach lawyer can help define scope, gather evidence, and align decisions to policy and law.

Contact us

If you prefer phone, please feel free to contact Felix Morling at +46 70 444 42 85

"*" indicates required fields