Data breach: definition

In short

The definition is in Article 4(12) of Regulation (EU) 2016/679. A cyber attack is not necessary: a lost laptop, an email sent to the wrong recipient or an archive deleted by mistake with no copy are all breaches. The European guidelines divide them into three types, which can combine:

• confidentiality: data seen or taken by someone who should not have it;
• integrity: data altered without authorisation;
• availability: data lost or made inaccessible, even temporarily, as with ransomware.

What the GDPR requires

• Notification to the supervisory authority (Art. 33), in Italy the Garante (the Italian Data Protection Authority): the controller sends it without undue delay and, where feasible, within 72 hours of becoming aware of the breach, unless the breach is unlikely to result in a risk to the rights and freedoms of individuals. If it arrives later, the delay must be explained.
• Communication to data subjects (Art. 34): required when the risk is high, in plain language and with the recommended measures. It is not needed, for example, if the data was strongly encrypted.
• Documentation (Art. 33(5)): all breaches, including those not notified, must be recorded with the facts, the consequences and the remedial action taken. This is the register of breaches.
• The processor (for example an IT or cloud supplier) must inform the controller without undue delay.

For organisations within the scope of NIS2, an incident may also require a parallel notification to CSIRT Italia, Italy's national CSIRT, with different timescales and content. The two assessments should be made together. The guide data breach: what to do in the 72 hours sets them out step by step.

Why it matters

72 hours go by quickly, and the time is almost always lost working out who has to decide. That is why it pays to have roles defined in advance (a CSIRT, the DPO if one has been appointed), a risk assessment model and a register ready.

Example

A salesperson loses their company laptop on a train, with the contact details of 2,000 customers. If the disk is encrypted and the key has not been compromised, a risk to individuals is unlikely: the breach must be recorded but not necessarily notified. If the disk is not encrypted, the company must assess the risk and, in all likelihood, notify the Garante within 72 hours. The same event, two different outcomes: the difference is made by a security measure decided beforehand.

Related terms

• DPO
• CSIRT
• Dark web: where much stolen data ends up
• Ransomware