What exactly is a data breach?

A data breach is any incident in which personal data has been exposed, lost, or altered

A data breach is, in short, an event in which personal data is no longer secure: it is lost, it has fallen into the wrong hands, or it has been altered or destroyed without authorization. It is therefore not only about hacking. A misdirected email with a customer list in the attachment, a stolen laptop without encryption, a USB stick left on the street, a phishing attack in which login credentials are compromised, or a system error that makes data unintentionally public — it all falls under the same definition, as soon as personal data is involved.

In practice, a distinction is made between three types of breaches: an availability breach (data is lost or inaccessible, for example due to a ransomware attack or a faulty backup), an integrity breach (data has been altered against the wishes of the data subject), and a confidentiality breach (data has been viewed or shared by someone who should not have done so). One incident may fall under more than one of these types at the same time. Whether an event is a data breach is separate from the question of whether it must also be reported — the latter depends on the risk posed to the data subjects involved, and is a separate step that comes after the detection of the breach.

Where this comes from: Article 4 GDPR

The definition of a data breach comes directly from Article 4 of the GDPR, where a 'personal data breach' is described as a breach of security that, whether accidentally or unlawfully, leads to the destruction, loss, alteration, or unauthorized disclosure of or access to transmitted, stored, or otherwise processed data. This definition applies directly in every Member State, without national variation. The Dutch Data Protection Authority elaborates on this definition on its page on data breaches with a classification into availability, integrity, and confidentiality breaches, and with examples from practice.