Under the GDPR, what counts as a personal data breach, and does it only mean data being stolen?

## The definition in the Regulation The GDPR defines the term in **Art. 4(12)**: a personal data breach is *"a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed."* Three parts of that sentence do the work: - **"a breach of security"**: the trigger is a security failure. A GDPR infringement that is not a security failure, such as processing without a lawful basis or keeping data too long, is a different problem under different Articles. It is not a "personal data breach". - **"accidental or unlawful"**: intent does not matter. A misaddressed email, a lost USB stick or an accidental deletion qualifies as much as an intrusion. - **the five outcomes**: destruction, loss, alteration, unauthorised disclosure, unauthorised access. Only two of them, disclosure and access, are defined by data reaching someone. EDPB Guidelines 9/2022 add a useful distinction: all personal data breaches are security incidents, but not every security incident is a personal data breach. A phishing attempt blocked before it reaches any personal data is an incident, not a breach. ## Three kinds of breach The EDPB guidelines borrow the classic information-security triad to classify breaches. One event can fall into several at once. | Type | What happened | Example | |---|---|---| | **Confidentiality** | unauthorised or accidental disclosure of, or access to, personal data | a customer file emailed to the wrong recipient | | **Integrity** | unauthorised or accidental alteration of personal data | a faulty script overwrites delivery addresses | | **Availability** | accidental or unauthorised loss of access to, or destruction of, personal data | ransomware encrypts records with no usable backup | The availability row is the one candidates forget. The guidelines say a **permanent** loss or destruction of personal data is always an availability breach. A **temporary** loss caused by a security incident is also a breach. Unavailability caused by **planned maintenance** is not, because it is not a "breach of security". ## Worked example: ransomware at a clinic A clinic's booking database is encrypted by ransomware. The investigation finds no evidence that anything was copied out. 1. **Is it a breach?** Yes. Patients' appointment data has been made unavailable by a security failure, so this is at least an availability breach. The lack of exfiltration evidence rules out nothing about availability. It only changes the confidentiality question, which stays open until the investigation can answer it. 2. **Does it have to be notified?** That is a separate question. Under **Art. 33(1)** the controller notifies the supervisory authority unless the breach is *unlikely to result in a risk* to people's rights and freedoms. The EDPB guidelines give examples in both directions. Patient data that is unavailable, even for a while, can put people at risk because appointments and treatment are disrupted. Data restored from a backup in good time, with no other malware, may not need reporting. 3. **Does it have to be recorded?** Yes, always. **Art. 33(5)** requires the controller to document *any* personal data breach, notifiable or not. ## Why the label matters Calling something a breach does not mean calling the regulator. It starts the GDPR's decision chain: 1. Is this a personal data breach under Art. 4(12)? 2. If yes, record it (Art. 33(5)). 3. Is it likely to result in a risk to individuals? If yes, notify the supervisory authority (Art. 33(1)). 4. Is it likely to result in a *high* risk? If yes, also tell the affected individuals (Art. 34(1)), unless an Art. 34(3) exception applies. A team that only looks for "data stolen" will miss availability and integrity breaches entirely. Those breaches then never reach the record or the risk assessment, and the controller cannot show the supervisory authority that it complied. ## Common traps - **"No exfiltration, so no breach."** Wrong: loss of access and destruction are breaches in their own right. - **"It was an accident, so it doesn't count."** Wrong: the definition says "accidental or unlawful". - **"Any GDPR violation is a breach."** Wrong: the term is limited to security failures. - **"Not notifiable means nothing to do."** Wrong: the Art. 33(5) record is still required.