Data Breach
A security incident in which personal data is accessed, disclosed, altered, or destroyed without authorisation.
Full Definition
A data breach is any incident that results in the unauthorised access, disclosure, alteration, loss, or destruction of personal data. Breaches can be caused by external attacks, insider threats, or accidental disclosures. Most data protection regulations require organisations to assess breaches and notify regulators and/or affected individuals within defined timeframes — 72 hours under GDPR and PIPA, 3 calendar days under Singapore's PDPA, and 'as soon as reasonably practicable' under India's DPDP Act. A structured breach response plan is essential for meeting notification deadlines.
How each law treats it
72 hours to the supervisory authority from awareness, with notification to data subjects 'without undue delay' where the risk is high.
3 calendar days to the PDPC from determining the breach is notifiable (significant harm OR 500+ individuals), with subject notification as soon as practicable.
Intimation to the Data Protection Board of India and affected Data Principals without delay, with a detailed 72-hour report to the DPBI (extendable on written request).
60 days to affected individuals; HHS annually or within 60 days depending on breach scope; media where 500+ residents of a state are affected.
In practice
- Pre-draft the regulator notification letter. In the first 24 hours the hardest copy to write is the holding statement that satisfies the regulator and the subject without saying something you'll later retract.
- Document the awareness timestamp carefully — the clock runs from 'awareness' not 'discovery'. Awareness is a judgment call; the one who makes it should write it down the same day.
- Rehearse quarterly. The breach runbook is a drawer document until it's exercised.
Common pitfalls
- Starting the clock from the forensic conclusion rather than from the moment the controller knew enough to assess the risk.
- Over-notifying trivial incidents and under-notifying material ones — the DPO should be the single call-maker.
- Treating encryption as a universal 'no risk, no notification' defence — the exception only applies when the encryption is current, strong, and the key is uncompromised.
Frequently asked questions
What triggers the 72-hour GDPR clock exactly?+
The moment the controller becomes aware that a personal data breach has occurred and that it is reasonably likely to result in a risk to the rights and freedoms of data subjects. Documented awareness is the controlling fact.
What if we discover a breach after the 72 hours have elapsed?+
Notify immediately and include a 'reasons for the delay' section in the notification. The EDPB expects a credible explanation; the clock is not a hard bar on filing but on the first filing.
Does a ransomware attack count as a personal data breach?+
Yes, where personal data is encrypted and inaccessible to the controller even temporarily. The CNIL and ICO have both treated ransomware-induced unavailability as an Article 33 event.
Related terms
Relevant regulations
Automate your privacy program
TruePrivacy handles DSRs, consent management, data mapping, and breach response — all in one platform.
Free 14-day trial · No credit card required · Setup in minutes