I lost a USB stick with customer data — is that a data breach

A lost USB stick is usually a data breach

A USB stick with customer data that has gone missing is in most cases a data breach under the GDPR. The definition in Article 4 GDPR refers to a breach of security that leads to loss of personal data, and that is precisely what happens when a stick containing names, addresses or other customer data can no longer be found: the data has not been destroyed, but has gone beyond the control of the business. Whether the data also falls into the wrong hands is not the core question — loss of control is already enough to fall within the definition.

What happens next depends on what was on the stick and how it was secured. An encrypted stick with a limited set of data presents a different picture than an unencrypted stick with many customer details or sensitive information. This distinction is relevant to the question when must I report a data breach to the Dutch Data Protection Authority, and also to the question of whether customers themselves need to be informed — that question is described on the page about must I inform the data subjects themselves in the event of a data breach. For the distinction between an incident and a data breach in the broader sense, the page what exactly is a data breach is a logical starting point.

Where this is based on

The definition of a breach is set out in Article 4 GDPR, and Article 33 GDPR governs notification to the supervisory authority once the conditions for it are met. The Dutch Data Protection Authority elaborates on this further on its page about reporting data breaches, and the EDPB has published guidelines with examples of types of data breaches, including loss of data carriers. The obligation to report applies throughout the EU under the Regulation, but the place where notification is made varies by country: in the Netherlands it is the Dutch Data Protection Authority, in other Member States the supervisory authority designated there.