Glossary term
Data Breach
Subject: Technology, Cyber and Data, Cyber Risk and Incident Response
Also known as: Personal data breach
A data breach is an incident in which information is accessed, disclosed, lost, altered or destroyed without authorisation, whether through attack, error or theft.
Explanation
Breaches range from a hacker copying a customer database to an employee emailing a spreadsheet to the wrong person, a lost unencrypted laptop or a misconfigured cloud storage bucket. Three classic types are confidentiality breaches (unauthorised disclosure or access), integrity breaches (unauthorised change) and availability breaches (loss or destruction). A personal data breach is one involving information about identifiable people, and it triggers data protection duties: under GDPR, notifying the supervisory authority generally within 72 hours of becoming aware, unless the risk to people is unlikely, and telling individuals when the risk is high. Other laws set different clocks. Not every security incident is a breach, since an attack that is blocked exposes nothing. The bill for a serious breach usually runs well beyond the fine: investigation, notices, legal claims and customers who leave.
Example
A clinic mistakenly sends appointment letters listing 300 patients' names and conditions to a mailing list. The error is spotted the same afternoon. The data protection officer assesses the risk to patients as high, notifies the regulator within the deadline, writes to those affected explaining what happened and offering support, and changes the mailing process.
Not to be confused with
- Security incident
- A security incident is any compromise or attempt on systems; a data breach specifically means information was exposed, changed or lost.