GDPR Q3

What is a data breach under GDPR?

Q3. What is a data breach under GDPR?

Category: Breaches

A personal data breach is any security incident that leads to the loss, change, or unauthorised sharing of personal data. It is not limited to hacking; human mistakes like emailing the wrong person count too.

In simple terms

Breaches cover confidentiality, integrity, and availability problems.
You must quickly assess the risk to individuals.
Serious breaches must be reported to the ICO and sometimes to the people affected.

Types of breaches

GDPR recognises three main categories. Confidentiality breaches expose data to unauthorised people, integrity breaches alter data, and availability breaches make data unavailable when needed.

Sending personal data to the wrong recipient.
Losing a laptop or USB stick containing personal information.
Ransomware that encrypts files and stops access to data.

Assessing risk

Controllers must determine how likely it is that the breach harms individuals. Consider the type of data, how many people are affected, and what could happen if the data is misused.

Special category data usually creates higher risk.
If the data was encrypted or anonymised, the risk may be lower.
Keep a breach log even when you decide not to notify the ICO.

When to notify

If the breach is likely to result in a risk to people’s rights and freedoms, you must inform the ICO within 72 hours. If the risk is high, you must also tell the affected individuals without undue delay.

Notifications to the ICO must describe the breach, its impact, and mitigation steps.
You can provide information in phases if all details are not yet known.
If you miss the 72-hour deadline, explain the reasons for the delay.

Practical steps to take

Activate your incident response plan and contain the breach immediately.
Evaluate what personal data is involved and the likely impact.
Decide whether ICO or affected individuals need to be notified.
Record the breach in your internal register with dates and actions taken.
Review lessons learned and update your controls to prevent future incidents.

Real-life examples

Misaddressed email

An employee emails a spreadsheet of customer addresses to the wrong client. The organisation recalls the message, informs the recipient to delete it, and records the incident in the breach log.

Lost device

A staff member leaves an unencrypted laptop on a train. Because it contains payroll information, the company reports the loss to the ICO and affected employees within 72 hours.

Helpful reminders

Breach reporting duties apply even to small organisations.
Train staff to recognise and escalate incidents quickly.
Keep template notification letters ready for high-risk situations.
Document every breach decision, even if you decide not to notify.

Key takeaway

Treat every personal data incident seriously—swift action protects individuals and demonstrates accountability.