Phishing
A social-engineering attack in which users are deceived — usually by email — into revealing credentials, transferring funds, or installing malware.
Full Definition
Phishing is the entry vector for most account compromises and a non-trivial share of data breaches. Attackers send messages impersonating a trusted sender (an executive, a vendor, a shared service) and direct the user to a credential-harvesting page, an attachment carrying malware, or a wire-transfer instruction. Spear phishing targets specific individuals with highly contextualised bait; business email compromise (BEC) impersonates executives to authorise fraudulent payments.
Controls combine technical layers (DMARC / DKIM / SPF for inbound email authentication, Safe Links URL rewriting, attachment sandboxing, phishing-resistant MFA that defeats real-time credential proxies) with user training (regular simulated phishing campaigns that measure click-through rate and reporting rate). For privacy specifically, phishing-driven account compromise is a leading cause of personal-data exposure — the breach that reaches regulators often starts with a single clicked link. GDPR, DPDP and PDPA all treat phishing-triggered personal-data exposure as a notifiable breach.
Related terms
Multi-Factor Authentication (MFA)
An authentication model that requires two or more independent factors — something the user knows, has, or is — to confirm identity.
Incident Response
The structured process by which an organisation detects, triages, contains, remediates and learns from a security or privacy incident.
Insider Threat
A security risk originating from an authorised user — employee, contractor, business partner — who misuses their access to harm the organisation or exfiltrate data.
Relevant regulations
Automate your privacy program
TruePrivacy handles DSRs, consent management, data mapping, and breach response — all in one platform.
Free 14-day trial · No credit card required · Setup in minutes