Mention a “data breach” and many people immediately think of hackers stealing information from an organisation’s computer systems.
That is certainly one type of breach. But personal data breaches are much broader than cyber attacks.
Sending an email to the wrong person, losing paperwork, an employee looking at a record without a legitimate reason, accidentally deleting information or being unable to access important personal data can all potentially be personal data breaches.
Recognising this matters because organisations cannot respond effectively to breaches that their employees don’t recognise or report.
So what exactly counts as a personal data breach—and what should you do when one occurs?
What Is a Personal Data Breach?
The Article 4(12) of the UK GDPR defines a personal data breach as a breach of security leading to the accidental or unlawful:
- destruction;
- loss;
- alteration;
- unauthorised disclosure of; or
- access to
personal data.
A useful way of understanding this definition is that something has happened which compromises the confidentiality, integrity or availability of personal data.
A breach therefore doesn’t have to involve information being stolen.
The Three Types of Personal Data Breach
Thinking about confidentiality, integrity and availability makes breaches much easier to recognise.
Confidentiality Breaches
A confidentiality breach occurs when personal data are disclosed to or accessed by someone who isn’t authorised to see them.
Examples include:
- emailing personal information to the wrong recipient;
- attaching the wrong document to an email;
- an employee accessing a customer or colleague’s records without a legitimate reason;
- accidentally publishing personal information online;
- losing unencrypted paperwork containing personal information;
- an attacker gaining unauthorised access to a database.
This is probably what most people think of when they hear “data breach”.
But it is only one category.
Integrity Breaches
An integrity breach occurs when personal data are altered or corrupted without proper authorisation.
For example:
- an employee deliberately changes someone’s records;
- malware corrupts customer information;
- information is accidentally overwritten;
- an unauthorised person changes account information.
The information doesn’t necessarily have to leave the organisation for a breach to have occurred.
Availability Breaches
A breach can also occur when personal data become unavailable.
For example:
- ransomware encrypts records so that staff cannot access them;
- important records are accidentally deleted;
- a system failure makes critical personal information unavailable;
- the only copy of a file containing personal data is destroyed.
Whether temporary unavailability amounts to a personal data breach will depend on the circumstances and the effect on individuals.
Imagine, for example, that a hospital suddenly loses access to information needed to treat its patients. The consequences could be considerably more serious than a short outage affecting an organisation’s old customer contact list.
Accidental Mistakes Can Be Data Breaches
Another common misconception is that something only becomes a breach if somebody has done something malicious.
That isn’t the case.
Personal data breaches can result from deliberate or accidental actions.
For example, an employee intends to email a customer’s records to John Smith but selects the wrong John Smith from the address book.
There was no malicious intent. But personal data have still potentially been disclosed to someone who was not authorised to receive them.
Other everyday mistakes can include:
- leaving confidential paperwork on public transport;
- copying the wrong person into an email;
- failing to redact information before disclosure;
- disposing of documents incorrectly;
- losing a work device;
- accidentally deleting information;
- uploading a document to the wrong customer account.
That is why breach awareness needs to extend beyond IT and cybersecurity teams.
Anyone handling personal data can potentially cause—or discover—a breach.
Internal Access Can Still Be a Breach
Information doesn’t have to leave your organisation.
Suppose an employee uses their access to an HR system to look at the employment record of a colleague out of curiosity.
They haven’t downloaded the information or shared it externally.
But they weren’t authorised to access that information for that purpose.
That can still constitute a personal data breach.
Organisations therefore need to think not simply about who technically has access to information, but whether people only access personal data when they have a legitimate business reason to do so.
Cyberattacks and Data Breaches Aren’t Necessarily the Same Thing
A cyberattack and a personal data breach are related concepts, but they aren’t interchangeable.
A cyber incident might affect an organisation’s systems without compromising personal data.
Conversely, a personal data breach may have nothing to do with cybersecurity—for example, sending a paper file to the wrong address.
When a cyber incident occurs, one of the questions you therefore need to establish quickly is:
Has the confidentiality, integrity or availability of personal data been affected?
If it has, you may also be dealing with a personal data breach.
Examples of Personal Data Breaches
Personal data breaches can therefore include:
- a phishing attack compromising an employee’s email account;
- customer information being sent to the wrong person;
- a lost laptop containing accessible personal data;
- confidential paperwork being left in a public place;
- an employee accessing records without authorisation;
- personal information accidentally being published online;
- malware corrupting personal data;
- ransomware making records unavailable;
- personal data being accidentally deleted;
- information being changed without authority;
- confidential paperwork being disposed of insecurely.
These incidents can vary enormously in seriousness.
And that leads to another important distinction.
A Breach Is Not Necessarily a Reportable Breach
Discovering that a personal data breach has occurred does not automatically mean that you must report it to the Information Commissioner’s Office (ICO).
The organisation needs to assess the risk resulting from the breach.
Under the UK GDPR, a breach must be reported to the ICO where it is likely to result in a risk to the rights and freedoms of individuals.
Where notification is required, the organisation must report it without undue delay and, where feasible, within 72 hours of becoming aware of the breach.
If the breach is unlikely to result in a risk to people’s rights and freedoms, it does not normally need to be reported to the ICO.
However, you should still document the breach and your decision.
When Do You Need to Tell the People Affected?
There is a higher threshold for informing the individuals affected by a breach.
If the breach is likely to result in a high risk to people’s rights and freedoms, the affected individuals must generally be informed without undue delay.
This is an important distinction:
This is why simply asking “Do we have to report this breach?” isn’t enough.
The more important question is:
What could this breach mean for the people affected?
Assessing the Risk
Risk assessment is one of the most important—and sometimes most difficult—parts of breach management.
You may need to consider:
What personal data are involved?
A person’s business email address will generally present different risks from medical records, financial information, passwords or identity documents.
How sensitive are the data?
Special category data, criminal offence information and other confidential information may increase the potential consequences.
How many people are affected?
Scale matters, although a breach affecting one person can still be extremely serious.
Who has received or accessed the information?
Sending information to a trusted recipient who immediately confirms secure deletion may create a different level of risk from publishing it openly online.
Could individuals be identified?
Consider whether the information is directly identifiable or could realistically be combined with other information.
What could happen to them?
Potential consequences might include:
- identity theft;
- fraud;
- financial loss;
- discrimination;
- embarrassment or distress;
- damage to reputation;
- loss of confidentiality;
- physical harm;
- other economic or social disadvantages.
What have you done to contain the breach?
Prompt action can materially change the risk.
For example, successfully recalling an email, remotely wiping a lost device or securing an exposed system may reduce the likelihood of harm.
Risk assessment should therefore consider both the potential severity of the consequences and how likely those consequences are to occur.
What Should You Do When You Discover a Breach?
Your first priority shouldn’t be filling in an ICO notification form.
You need to establish what has happened and protect the people who may be affected.
A practical response might look like this:
1. Report
Make sure the incident reaches the appropriate person or team internally as quickly as possible.
2. Record
Start documenting what you know, including when the incident occurred, when it was discovered and what information may be affected.
3. Contain
Take reasonable steps to stop the breach continuing or becoming worse.
That might mean recalling an email, disabling an account, recovering paperwork, resetting credentials, remotely wiping a device or isolating an affected system.
4. Investigate
Establish what happened.
What data were affected? How many people? Who may have received or accessed them? Is the incident ongoing?
5. Assess
Consider the potential consequences for the individuals affected and the likelihood of those consequences occurring.
6. Notify
Decide whether the ICO and/or affected individuals need to be informed.
Remember the 72-hour reporting requirement where notification to the ICO is necessary.
7. Learn
Once the immediate incident has been managed, establish why it happened and what needs to change to prevent recurrence.
The process can therefore be summarised as:
You Don’t Need to Know Everything Before Acting
One of the dangers with the 72-hour reporting requirement is waiting for a complete investigation before deciding what to do.
You may not know immediately:
- exactly how the breach happened;
- precisely how many people are affected;
- whether information has actually been viewed;
- the full extent of a cyber attack;
- every category of data involved.
That should not prevent you from beginning your investigation, containment and risk assessment.
Where a breach is reportable, the ICO recognises that organisations may not have every detail within the initial 72-hour period and further information can be provided later.
The important thing is to have a process capable of identifying and escalating breaches quickly enough to make appropriate decisions.
Record Every Personal Data Breach
Even where you decide that a breach does not need to be reported to the ICO, it should still be documented.
Your breach record should capture information such as:
- what happened;
- when it happened;
- when you became aware;
- the personal data involved;
- the people affected;
- immediate containment measures;
- your assessment of the potential consequences;
- your assessment of likelihood;
- whether the ICO was notified;
- whether individuals were informed;
- the reasoning behind those decisions;
- remedial action;
- lessons learned.
This isn’t simply an administrative exercise.
A good breach log allows you to demonstrate your decision-making and identify recurring problems.
Five individually minor incidents caused by staff sending emails to the wrong recipient, for example, may reveal a wider problem that needs addressing.
Preventing Data Breaches
Organisations cannot eliminate every possibility of a breach.
They can, however, reduce both the likelihood of breaches occurring and their potential impact.
Measures might include:
- appropriate access controls;
- multi-factor authentication;
- encryption;
- secure disposal;
- patching and vulnerability management;
- secure backups;
- data minimisation;
- appropriate retention periods;
- staff training;
- clear policies and procedures;
- supplier assurance;
- breach detection and reporting arrangements.
Good data protection also reduces the consequences when something goes wrong.
If you only collect the information you need, delete it when it is no longer required, restrict access appropriately and protect sensitive information properly, there is simply less unnecessary information available to be compromised.
One of the Biggest Risks: Staff Don’t Recognise a Breach
An organisation can have an excellent breach procedure and still respond badly if employees don’t recognise when they should use it.
Staff shouldn’t be expected to decide whether an incident is serious enough to report to the ICO.
They need to understand:
“Something has happened to personal data that shouldn’t have happened. I need to report it internally.”
The appropriate person or team can then investigate, assess the risk and decide what happens next.
Creating a culture in which people report mistakes promptly is therefore an important part of effective breach management.
A breach concealed for fear of blame can be far more damaging than an honest mistake reported immediately.
Data Breach Checklist
When an incident occurs, ask:
- ☐ Has the confidentiality, integrity or availability of personal data been affected?
- ☐ When did we become aware of the breach?
- ☐ Is the breach still happening?
- ☐ What personal data are involved?
- ☐ How many people could be affected?
- ☐ Who has accessed or received the information?
- ☐ What immediate action can we take to contain it?
- ☐ What could happen to the people affected?
- ☐ How likely are those consequences?
- ☐ Is there likely to be a risk to individuals’ rights and freedoms?
- ☐ Is there likely to be a high risk?
- ☐ Do we need to notify the ICO?
- ☐ Do we need to inform affected individuals?
- ☐ Have we documented our decisions?
- ☐ What caused the breach?
- ☐ What should we change to prevent it happening again?
Understanding a Breach Is Only the First Step
Recognising a personal data breach is important. But in practice, some of the most difficult decisions come afterwards.
How serious is it?
What should you do immediately?
How do you assess the risk to individuals?
Does the ICO need to be informed?
Should you contact the people affected?
What should you record?
And how do you demonstrate afterwards that your response was appropriate?
These are decisions organisations need to be able to make confidently—and often quickly.
Handling Data Breaches Workshop – 12 November
Our practical Handling Data Breaches Workshop on 12 November takes the next step from understanding what a breach is to working through how to manage one effectively.
We’ll look at recognising and assessing breaches, immediate response and containment, evaluating risk, deciding when the ICO and affected individuals need to be informed, documenting decisions and learning from incidents.
If you have responsibility for data protection, information governance, compliance, risk or handling incidents within your organisation, the workshop is designed to help you approach those decisions with greater confidence and a practical process you can apply when something goes wrong.
Find out more about the Handling Data Breaches Workshop and reserve your place here.