naqad usb stick mal-data tal-klijent waqt li ma nafx fejn hi, hu dan datalek

A USB stick that is lost is usually a data breach

A USB stick with customer data that is lost is in most cases a data breach within the meaning of the GDPR. The definition in Article 4 of the GDPR speaks of a breach of security that leads to loss of personal data, and that is precisely what happens when a stick with names, addresses or other customer data can no longer be found: the data has not been destroyed, but has passed out of the control of the business. Whether they also fall into the wrong hands is not the core of the question — loss of control is already enough to fall under the definition.

What happens after that depends on what was on the stick and how it was secured. An encrypted stick with a limited set of data presents a different picture than an unencrypted stick with many customer details or sensitive information. That distinction is relevant to the question when must I report a data breach to the Data Protection Authority, and also to the question of whether customers themselves need to be informed — that question is described on the page about must I inform the data subjects themselves in case of a data breach. For the distinction between an incident and a data breach in the broader sense, the page what exactly is a data breach is a logical starting point.

Where this is based on

The definition of a breach is set out in Article 4 of the GDPR, and Article 33 of the GDPR governs notification to the supervisory authority once the conditions for it are met. The Data Protection Authority elaborates on this further on its page on reporting data breaches, and the EDPB has published guidelines with examples of types of data breaches, including loss of data carriers. The obligation to report applies throughout the EU on the basis of the regulation, but the place where reports are made varies by country: in the Netherlands it is the Data Protection Authority, in other member states the supervisory authority designated there.