What counts as a personal data breach

The GDPR definition

Article 4(12) of the GDPR defines a personal data breach as a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data that is transmitted, stored or otherwise processed ¹. The wording covers accidents as well as attacks ¹.

The ICO applies the UK GDPR. Its guide says a breach is more than just losing personal data ². It gives access by an unauthorised third party and sending personal data to an incorrect recipient as examples ². It says a breach can affect the confidentiality, integrity or availability of personal data ².

A breach is not always a notifiable breach

The definition and the duty to report are separate tests. Under Article 33, a controller does not have to notify the supervisory authority when the breach is unlikely to result in a risk to the rights and freedoms of people ¹. Under Article 34, individuals must be told when the breach is likely to result in a high risk ¹.

Every breach must still be recorded. Article 33(5) requires the controller to document the facts of the breach, its effects and the remedial action taken ¹. The ICO says this applies whether or not the breach is reported ².

Record keeping is enforced. On 17 December 2024 the Irish Data Protection Commission (DPC) fined Meta €3 million under Article 33(5) for failing to document the facts of breaches and the remedial steps ⁷.

How other jurisdictions frame it

The HIPAA risk assessment

HHS lists four factors for the risk assessment. They are the nature and extent of the health information, who received it, whether it was actually acquired or viewed, and how far the risk was mitigated ³.

The HIPAA rule applies to unsecured protected health information. HHS says information is unsecured when it is not rendered unusable, unreadable, or indecipherable to unauthorized persons, and it names encryption and destruction as the methods ³.

Common breach types in official records

Misdirected correspondence features heavily in the Irish figures. The DPC received 6,521 valid breach notifications in 2025 and said almost half resulted from correspondence sent to the wrong recipient ⁸.

Attacks on systems are another type. In a decision dated 21 July 2026, the CNIL fined a private hospital in France €500,000 after an attacker accessed data of 524,867 patients in summer 2025 ⁹. The CNIL found breaches of Article 32 on security and Article 34 on telling the people affected ⁹.

A software flaw can be a breach too. The DPC found that between 14 and 28 September 2018, unauthorised parties exploited a vulnerability in Facebook features, affecting about 29 million accounts worldwide and about 3 million in the EU and EEA ⁷.