Personal data breach

A security incident leading to the accidental or unlawful destruction, loss, alteration or unauthorised access to personal data, for example an email sent to the wrong recipient, a lost laptop or a hacking attack. A breach must as a rule be notified to the data protection authority within 72 hours, unless it is unlikely to pose a risk to data subjects. If the risk is high, the affected individuals must also be informed. Every breach, including those not notified, must be documented in an internal log.