Personal Data Breach (Article 4(12) GDPR)

A personal data breach occurs where a security incident leads to personal data being destroyed, lost, altered, or disclosed without authorization, or to unauthorized persons gaining access to it (Article 4(12) GDPR). The concept is broad and covers both accidental and intentional events.

1. Overview

Article 4(12) GDPR defines a personal data breach as a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored or otherwise processed.

The defining characteristic is the requirement of a breach of security. A person who processes personal data without a legal basis does commit an infringement of the GDPR, but does not necessarily bring about a data breach if no security incident occurs in doing so. The two sets of criteria may overlap, but must be kept distinct from one another.

The definition is directly connected with two central consequential provisions:

• Article 33 GDPR: The controller must, as a rule, notify the competent supervisory authority of a breach without undue delay and, where feasible, within 72 hours of becoming aware of it. The obligation to notify applies only where the breach is not likely to result in a risk to the rights and freedoms of natural persons.
• Article 34 GDPR: Where the risk to the data subjects is likely to be high, those persons must be notified without undue delay. Exceptions exist, for instance, where the data concerned is effectively encrypted.

How to proceed in concrete terms in a serious case, from detection through risk assessment to notification and communication, is addressed in the chapter Personal Data Breach (Data Breach).

2. The three types of breach

Article 4(12) GDPR does not expressly name any categories, but can be structured systematically according to the protected interest affected. What is decisive is whether the confidentiality, the integrity, or the availability of the data is impaired. These three dimensions correspond to the principles set out in Article 5(1)(f) GDPR.

3. Form and cause: irrelevant

The form of the triggering event is immaterial. Covered in equal measure are:

• Unintended events, such as employee negligence, a storage medium left behind, a misdirected email, or the improper disposal of documents.
• Intentional acts, such as targeted hacking, phishing, the deliberate disclosure of data to unauthorized persons, or social engineering attacks.

The only decisive factor is whether the outcome of the event falls within the definition of Article 4(12) GDPR, not the motivation or the fault of the person who caused it.

4. Possible harm

Recital 85 GDPR sets out, by way of example, the harm that may result from a breach (Recital 85 GDPR). This list is relevant to the risk assessment carried out in connection with the obligations to notify:

• Loss of control over one's own data
• Limitation of rights
• Discrimination
• Identity theft or fraud
• Financial loss
• Unauthorized reversal of pseudonymization
• Reputational damage
• Loss of confidentiality of data protected by professional secrecy

The severity of the harm and the likelihood of its occurrence determine whether, and with what urgency, the obligations to notify under Articles 33 and 34 GDPR are triggered.