# Personal Data Breach (Article 4(12) GDPR)

What a data breach means under the GDPR, which three types of breach are distinguished, and which obligations to notify the supervisory authority and data subjects are triggered.

> Quelle: https://www.thomashelbing.com/en/wissen/dsgvo-hub/begriffe-und-definitionen/1.2.12-verletzung-des-schutzes-personenbezogener-daten
> Sprache: en



A personal data breach occurs where a security incident leads to [personal data](/docs/dsgvo-hub/begriffe-und-definitionen/1.2.1-personenbezogene-daten) being destroyed, lost, altered, or disclosed without authorization, or to unauthorized persons gaining access to it ([Article 4(12) GDPR](https://dsgvo-gesetz.de/art-4-dsgvo/)). The concept is broad and covers both accidental and intentional events.

<Callout type="info">
  **Key takeaways**

  * A data breach requires a **breach of security**. Merely unlawful processing without a security incident does not fall within it.
  * Three types of breach are covered: attacks on the **confidentiality**, **integrity**, and **availability** of data.
  * The form of the incident is irrelevant: unintended negligence and a targeted attack rank equally alongside one another.
  * Where a data breach exists, the obligations to notify under [Article 33 GDPR](https://dsgvo-gesetz.de/art-33-dsgvo/) (supervisory authority, as a rule within 72 hours) and, where applicable, [Article 34 GDPR](https://dsgvo-gesetz.de/art-34-dsgvo/) (data subjects, in the case of a high risk) apply.
  * Possible harm ranges from identity theft and financial loss to reputational damage and loss of control over one's own data ([Recital 85 GDPR](https://dsgvo-gesetz.de/erwaegungsgruende/nr-85/)).
</Callout>

## 1. Overview [#1-overview]

Article 4(12) GDPR defines a personal data breach as a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored or otherwise processed.

The defining characteristic is the requirement of a **breach of security**. A person who processes personal data without a legal basis does commit an infringement of the GDPR, but does not necessarily bring about a data breach if no security incident occurs in doing so. The two sets of criteria may overlap, but must be kept distinct from one another.

The definition is directly connected with two central consequential provisions:

* **[Article 33 GDPR](https://dsgvo-gesetz.de/art-33-dsgvo/):** The controller must, as a rule, notify the competent supervisory authority of a breach without undue delay and, where feasible, within 72 hours of becoming aware of it. The obligation to notify applies only where the breach is not likely to result in a risk to the rights and freedoms of natural persons.
* **[Article 34 GDPR](https://dsgvo-gesetz.de/art-34-dsgvo/):** Where the risk to the data subjects is likely to be high, those persons must be notified without undue delay. Exceptions exist, for instance, where the data concerned is effectively encrypted.

How to proceed in concrete terms in a serious case, from detection through risk assessment to notification and communication, is addressed in the chapter [Personal Data Breach (Data Breach)](/docs/dsgvo-hub/einzelthemen/datenschutzverletzung).

## 2. The three types of breach [#2-the-three-types-of-breach]

Article 4(12) GDPR does not expressly name any categories, but can be structured systematically according to the protected interest affected. What is decisive is whether the confidentiality, the integrity, or the availability of the data is impaired. These three dimensions correspond to the principles set out in [Article 5(1)(f) GDPR](/docs/dsgvo-hub/einzelthemen/grundsaetze-der-verarbeitung/1.3.3.8-integritaet-und-vertraulichkeit).

| Type of breach         | Protected interest affected | Description                                                 | Examples                                                                                                            |
| ---------------------- | --------------------------- | ----------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------- |
| Confidentiality breach | Confidentiality             | Unauthorized disclosure of, or unauthorized access to, data | Hacking attack, accidental transmission to the wrong recipient, phishing, deliberate disclosure to third parties    |
| Integrity breach       | Integrity                   | Unauthorized or unintended alteration of data               | Manipulation of data records by attackers, faulty data migration, unauthorized corrections by employees             |
| Availability breach    | Availability                | Destruction or loss of data                                 | Ransomware attack, defective storage medium without a backup, accidental deletion, loss of an unencrypted USB stick |

<Callout type="info">
  Several types of breach may occur at the same time. A ransomware attack may, for instance, both encrypt data (availability breach) and simultaneously exfiltrate it (confidentiality breach).
</Callout>

## 3. Form and cause: irrelevant [#3-form-and-cause-irrelevant]

The form of the triggering event is immaterial. Covered in equal measure are:

* **Unintended events**, such as employee negligence, a storage medium left behind, a misdirected email, or the improper disposal of documents.
* **Intentional acts**, such as targeted hacking, phishing, the deliberate disclosure of data to unauthorized persons, or social engineering attacks.

The only decisive factor is whether the outcome of the event falls within the definition of Article 4(12) GDPR, not the motivation or the fault of the person who caused it.

## 4. Possible harm [#4-possible-harm]

Recital 85 GDPR sets out, by way of example, the harm that may result from a breach ([Recital 85 GDPR](https://dsgvo-gesetz.de/erwaegungsgruende/nr-85/)). This list is relevant to the risk assessment carried out in connection with the obligations to notify:

* Loss of control over one's own data
* Limitation of rights
* Discrimination
* Identity theft or fraud
* Financial loss
* Unauthorized reversal of [pseudonymization](/docs/dsgvo-hub/begriffe-und-definitionen/1.2.5-pseudonymisierung)
* Reputational damage
* Loss of confidentiality of data protected by professional secrecy

The severity of the harm and the likelihood of its occurrence determine whether, and with what urgency, the obligations to notify under Articles 33 and 34 GDPR are triggered.

<Callout type="warn">
  The risk assessment is the controller's responsibility and must be documented. A missing or delayed notification despite an existing obligation to notify may give rise to fines under Article 83(4)(a) GDPR.
</Callout>

<Cards>
  <Card title="Personal Data Breach (Data Breach)" href="/docs/dsgvo-hub/einzelthemen/datenschutzverletzung" description="Practical handling of a data breach: process, deadlines, risk assessment, notification, and communication." />

  <Card title="Article 4(12) GDPR" href="https://dsgvo-gesetz.de/art-4-dsgvo/" description="Legal definition of a personal data breach." />

  <Card title="Article 33 GDPR" href="https://dsgvo-gesetz.de/art-33-dsgvo/" description="Notification to the supervisory authority within 72 hours." />

  <Card title="Article 34 GDPR" href="https://dsgvo-gesetz.de/art-34-dsgvo/" description="Communication to the data subjects in the case of a high risk." />

  <Card title="Recital 85 GDPR" href="https://dsgvo-gesetz.de/erwaegungsgruende/nr-85/" description="Possible harm and risk assessment." />

  <Card title="Pseudonymization" href="/docs/dsgvo-hub/begriffe-und-definitionen/1.2.5-pseudonymisierung" description="Unauthorized reversal of pseudonymization as a typical instance of harm." />

  <Card title="Integrity and Confidentiality" href="/docs/dsgvo-hub/einzelthemen/grundsaetze-der-verarbeitung/1.3.3.8-integritaet-und-vertraulichkeit" description="Article 5(1)(f) GDPR: the principles concerned at a glance." />
</Cards>


---

## About the author

This article was written by [Dr. Thomas Helbing, specialist lawyer for IT law in Munich](https://www.thomashelbing.com/en).

Since 2020 and continuously through today (2026), Handelsblatt has [recognized](https://www.thomashelbing.com/en#auszeichnungen) Dr. Helbing as one of **"Germany's Best Lawyers"** in IT law and data protection law.

According to Kanzleimonitor.de (2024 to 2026 editions), he ranks among the **leading lawyers for data protection and IT law** and is listed among the **top 100 lawyers in Germany (2024/25)**. Kanzleimonitor is considered a particularly meaningful market study because it is based exclusively on personal recommendations from in-house counsel.

Dr. Helbing has **many years of advisory experience in data protection and IT law** and advises clients of all sizes, from startups through fast-growing SaaS companies and unicorns to international corporate groups.

His [professional background](https://www.thomashelbing.com/en#stationen) covers the **full spectrum of IT and technology law practice**. He began his career at a major international law firm, then gained **in-house experience at a DAX-listed company**, and is himself an **entrepreneur and founder of several digital ventures**. He also has **hands-on programming experience**, which allows him to understand technical systems, software architectures and digital business models not only from a legal perspective but also from a technical one.

For many years, his [clients](https://www.thomashelbing.com/en#referenzen) have included **technology companies and SaaS providers**, leading **German research institutions** and a **systemically important German bank**. His advisory focus lies in particular on **GDPR compliance, the data economy, SaaS, AI regulation and IT contract law**.