Data breach

A data breach is a security incident in which personal data are accidentally or unlawfully disclosed, altered, erased, destroyed or made accessible to unauthorised persons. The General Data Protection Regulation (GDPR) uses the term “personal data breach” for this purpose. Article 4(12) and Articles 33 and 34 GDPR govern the legal classification of such incidents and the obligations arising from them.

What constitutes a data breach under the GDPR?

A data breach occurs, for data protection purposes, where a breach of security leads to the accidental or unlawful destruction, loss or alteration of personal data, or to the unauthorised disclosure of or access to personal data.

Under Article 4(12) GDPR, the term covers various types of data breaches. A distinction is made in particular between three forms:

• Breach of confidentiality: Unauthorised persons gain access to personal data or such data are disclosed without authorisation.
• Breach of integrity: Personal data are altered without authorisation or accidentally.
• Breach of availability: Personal data are lost, destroyed or no longer accessible.

Typical examples include sending an email containing personal data to the wrong recipient, losing an unencrypted data storage device or a successful cyberattack on a customer database.

Accidental deletion of personal data may also constitute a data breach. An unauthorised data leak is therefore not a necessary condition.

Not every IT security incident automatically constitutes a data breach within the meaning of the GDPR. The decisive factors are whether personal data are affected and whether the requirements of Article 4(12) GDPR are met.

When must a data breach be reported to the supervisory authority?

Under Article 33(1) GDPR, controllers must notify the competent supervisory authority of a data breach unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons.

The notification obligation therefore depends on an assessment of the potential impact on the affected individuals.

The following circumstances are particularly relevant to this risk assessment:

• The nature and sensitivity of the personal data affected;
• The number of data subjects and personal data records affected;
• The potential consequences of unauthorised access to or loss of the data;
• The likelihood that the information will be misused;
• Existing protective measures, such as effective encryption.

Potential risks include identity theft, financial loss, discrimination or loss of control over personal data.

Notification is not required if the data breach is unlikely to result in a risk to the rights and freedoms of natural persons. The controller must be able to justify and document this decision in a comprehensible manner.

Not every data breach is therefore subject to notification. However, the obligation to document the breach applies regardless of whether notification to the supervisory authority is required.

What deadlines and requirements apply when reporting a data breach?

Under Article 33(1) GDPR, a notifiable data breach must be reported to the competent supervisory authority without undue delay and, where feasible, no later than 72 hours after the controller becomes aware of it.

The deadline begins once the controller has a sufficient degree of certainty that a data breach has occurred. A complete investigation of all its consequences is not required before the notification period starts.

Under Article 33(3) GDPR, the notification must contain, in particular, the following information:

• The nature of the data breach and, where possible, the categories and approximate number of data subjects and personal data records concerned;
• The name and contact details of the data protection officer or another relevant contact point;
• A description of the likely consequences of the data breach;
• The measures taken or proposed to address the breach and mitigate its possible adverse effects.

If all the information is not yet available within the notification period, it may be provided in stages under Article 33(4) GDPR. If notification is made later than 72 hours after the controller became aware of the breach, the reasons for the delay must be provided.

If a data breach is identified at a processor, the processor must notify the controller without undue delay after becoming aware of it, in accordance with Article 33(2) GDPR. As a general rule, the statutory obligation to notify the supervisory authority rests with the controller.

When must data subjects be informed about a data breach?

In addition to notifying the supervisory authority, controllers may also be required to inform the affected data subjects directly about a data breach.

Under Article 34(1) GDPR, notification is generally required if the data breach is likely to result in a high risk to the rights and freedoms of natural persons.

Such a risk may arise, for example, where unauthorised third parties gain access to extensive health data, login credentials or particularly sensitive financial information that is susceptible to misuse.

The notification must be made without undue delay and describe the data breach in clear and plain language. In particular, data subjects must also be informed about the potential consequences, the measures taken and an appropriate contact point.

Article 34(3) GDPR provides for exceptions to the notification obligation. Individual notification is not required, for example, if the affected data have been protected by appropriate encryption measures that render them unintelligible to unauthorised persons, or if subsequent measures ensure that the high risk is no longer likely to materialise.

If individual notification would involve disproportionate effort, a public communication or a similarly effective measure may be used, subject to the statutory requirements.

The obligation to notify data subjects must therefore be distinguished from the obligation to notify the supervisory authority. The two obligations are subject to different risk thresholds.

How must companies respond to a data breach, and what are the potential consequences?

Companies must identify data breaches at an early stage, limit their impact and comply with the statutory notification and documentation obligations.

Once a data breach becomes known, the following steps are particularly important:

• Contain the incident: Prevent unauthorised access, disable compromised access credentials and secure affected systems.
• Investigate the circumstances: Establish the cause and scope of the incident and identify the personal data affected.
• Assess the risks: Evaluate the potential impact on the rights and freedoms of the affected data subjects.
• Fulfil notification obligations: Arrange any required notifications and communications within the applicable deadlines.
• Document the incident: Keep a clear record of the facts, consequences, risk assessment and measures taken.
• Improve protective measures: Address security vulnerabilities and adapt organisational procedures.

Article 33(5) GDPR requires controllers to document all data breaches. This documentation must enable the supervisory authority to verify compliance with the statutory requirements.

Breaches of the notification and communication obligations may result in supervisory measures and administrative fines under Article 83(4) GDPR. The statutory maximum is up to EUR 10 million or, in the case of an undertaking, up to 2% of its total worldwide annual turnover in the preceding financial year, whichever is higher.

In addition, claims for compensation may arise under Article 82 GDPR where the statutory requirements are met. However, a data breach does not automatically result in an administrative fine or a claim for compensation.

Practical example: A data breach caused by sending an email to the wrong recipient

An employee of a company accidentally sends an email containing an Excel file to an external recipient. The file contains the names, addresses, telephone numbers and bank account details of 150 customers.

Once the mistake is discovered, the company immediately asks the recipient to delete the email and its attachment. At the same time, it investigates the incident and assesses which personal data have been affected and what risks may arise from the unauthorised disclosure.

Given the bank account details included in the file and the number of affected individuals, the company concludes in its risk assessment that the breach poses a risk to the rights and freedoms of the customers. It therefore reports the data breach to the competent supervisory authority within the statutory deadline.

The company then separately assesses whether a high risk exists and whether the affected customers must be notified under Article 34 GDPR. Regardless of this assessment, it documents the incident and introduces additional checks when sending personal data.

legal data assessment: A data breach requires a swift response and a comprehensible risk assessment. Companies must establish clear internal reporting channels and responsibilities so that data breaches can be identified at an early stage and statutory deadlines can be met. Complete documentation of the incident is also essential, even where there is no obligation to notify the supervisory authority.

Legal bases

Article 4(12) GDPR; Article 5(1)(f) and Article 5(2) GDPR; Articles 24 and 32 GDPR; Articles 33 and 34 GDPR; Articles 58, 82 and 83 GDPR.