Understanding GDPR Data Breach: Key Concepts and Definitions

The General Data Protection Regulation (GDPR), which came into force in May 2018, represents a significant shift in the way data protection is viewed and enforced in the European Union (EU) and beyond. A major component of this regulation is the way it addresses data breaches, with stringent requirements on how they are defined, reported, and managed. Understanding the concept of a data breach under GDPR is critical not only for businesses that operate within the EU but for any entity that handles the personal data of EU residents. This article will delve into the key concepts, definitions, and obligations related to GDPR data breaches, providing a comprehensive guide for organisations to navigate this complex landscape.

Table of Contents

What is GDPR?

Before exploring data breaches under the GDPR, it’s essential to understand the regulation itself. The GDPR is a legal framework established to regulate the collection, storage, and processing of personal data of individuals within the EU. Its primary objective is to give individuals more control over their personal data and to harmonise the laws across EU member states.

The GDPR applies not only to organisations based within the EU but also to non-EU businesses that offer goods or services to individuals in the EU or monitor their behaviour. Non-compliance with the GDPR can lead to hefty fines—up to 4% of annual global turnover or €20 million, whichever is greater. This has made GDPR compliance a priority for businesses around the world.

What Constitutes a Data Breach Under GDPR?

A data breach, under GDPR, is defined as “a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed” (Article 4(12) GDPR). This definition is quite broad and covers incidents beyond just the unauthorised access to data by malicious actors. In fact, it includes any event that compromises the confidentiality, integrity, or availability of personal data.

Some key elements of this definition are worth highlighting:

Confidentiality Breach: This occurs when unauthorised persons access personal data. Examples include hacking, malware, or phishing attacks, but also human errors such as accidentally sending personal data to the wrong recipient.
Integrity Breach: This happens when personal data is altered or modified in an unauthorised manner, either intentionally or unintentionally.
Availability Breach: This involves personal data being lost or destroyed in a way that it is no longer accessible to the individuals or organisations that are entitled to access it. Common examples include ransomware attacks or accidental data deletion without proper backups.

This broad scope means that a data breach can result from both internal factors, such as employee negligence, and external threats, such as cyberattacks. It is therefore crucial for organisations to have robust security measures and response plans in place to handle potential breaches.

Types of Data Breaches Under GDPR

Data breaches under GDPR can generally be classified into three categories:

Confidentiality Breaches: These occur when personal data is disclosed to unauthorised individuals or entities. For example, if a company’s database is hacked and customer data is leaked, it would constitute a confidentiality breach. Similarly, emailing personal data to the wrong person also falls under this category.
Integrity Breaches: This type of breach happens when personal data is altered without authorisation. For instance, if an attacker changes the details of an individual’s medical record, this would constitute an integrity breach. Even if the alteration is accidental, it still qualifies as a breach under GDPR.
Availability Breaches: These occur when personal data is lost, destroyed, or rendered unavailable. An example would be if a company’s backup system fails, resulting in the permanent loss of important customer records. Even if the data is eventually recovered, the temporary unavailability could still be classified as a data breach.

Understanding these categories helps organisations identify what constitutes a breach and how different types of breaches affect the personal data they manage.

The GDPR Data Breach Notification Requirement

One of the most stringent requirements under GDPR is the obligation to notify both the supervisory authorities and the affected individuals in the event of a data breach. This requirement ensures transparency and accountability, enabling swift action to mitigate the potential harm caused by the breach.

Notifying the Supervisory Authority

Under GDPR, data controllers must notify the relevant supervisory authority of a data breach “without undue delay” and, where feasible, within 72 hours of becoming aware of it (Article 33 GDPR). The term “becoming aware” has been interpreted by the European Data Protection Board (EDPB) as the moment when the controller has a reasonable degree of certainty that a breach has occurred.

The notification to the supervisory authority must include the following information:

Nature of the breach: A description of the nature of the personal data breach, including the categories and approximate number of individuals affected, and the categories and approximate number of personal data records involved.
Contact details: The name and contact details of the data protection officer (DPO) or another point of contact where further information can be obtained.
Consequences of the breach: A description of the likely consequences of the breach.
Measures taken: A description of the measures taken or proposed to address the breach, including measures to mitigate its potential adverse effects.

If the organisation is unable to provide all the required information at the time of the initial notification, it can submit the information in phases, but it must do so without undue delay.

Notifying Affected Individuals

In addition to notifying the supervisory authority, GDPR also requires organisations to inform the individuals affected by the breach if the breach is likely to result in a high risk to their rights and freedoms (Article 34 GDPR). This notification must also be done “without undue delay”.

The notification to individuals must be written in clear and plain language and should include:

A description of the nature of the breach.
The name and contact details of the data protection officer or other contact point.
A description of the likely consequences of the breach.
A description of the measures taken or proposed by the organisation to mitigate the breach’s effects.

This obligation to notify individuals is designed to ensure transparency and to give individuals the opportunity to take steps to protect themselves, such as changing passwords or monitoring their financial accounts.

However, if the organisation has taken measures to mitigate the high risk to the rights and freedoms of individuals, such as encrypting the data involved, it may not be necessary to notify the affected individuals.

Exceptions to the Notification Obligation

While GDPR sets out clear rules for data breach notification, there are some exceptions where an organisation may not be required to notify either the supervisory authority or affected individuals.

No Risk to Rights and Freedoms

If the data breach is unlikely to result in a risk to the rights and freedoms of individuals, there is no need to notify either the supervisory authority or the affected individuals. For instance, if an organisation loses access to encrypted personal data but is confident that the encryption is strong enough to prevent any unauthorised access, this might not constitute a notifiable breach.

Technological Safeguards

As mentioned earlier, if the organisation has implemented appropriate technical measures to protect the data involved in the breach, such as encryption or pseudonymisation, it may not need to notify individuals. These measures must ensure that the personal data is rendered unintelligible to unauthorised parties.

Post-Breach Mitigation

If the organisation can demonstrate that it has taken steps to mitigate the risks associated with the breach before any harm can occur, this could exempt it from notifying individuals. For example, if a breached database is swiftly secured and the organisation can prove that no data was accessed, it may not need to inform individuals of the breach.

Fines and Penalties for Data Breach Non-Compliance

The GDPR enforcement regime includes significant penalties for non-compliance, particularly in relation to data breach notification requirements. Organisations can be fined up to 2% of their annual global turnover or €10 million (whichever is higher) for failing to notify a breach to the supervisory authority or the affected individuals within the required timeframe.

In cases where the breach results from non-compliance with other GDPR provisions, such as inadequate data protection measures, fines can increase to 4% of annual global turnover or €20 million (whichever is higher).

These hefty fines underscore the importance of compliance with GDPR’s data breach provisions. They also highlight the need for organisations to implement strong data security measures, conduct regular risk assessments, and have well-prepared data breach response plans in place.

The Role of the Data Protection Officer (DPO)

Under the GDPR, certain organisations are required to appoint a Data Protection Officer (DPO) to ensure compliance with the regulation. The DPO plays a critical role in managing data breaches and ensuring that the organisation follows the required procedures.

The DPO is responsible for:

Monitoring the organisation’s compliance with GDPR.
Advising on data protection obligations.
Acting as a point of contact between the organisation and the supervisory authority.
Overseeing the organisation’s response to data breaches, including notification requirements.

The DPO is also involved in creating and implementing data protection policies, conducting data protection impact assessments (DPIAs), and ensuring that the organisation’s employees are trained in data protection best practices.

Steps to Prepare for and Respond to a Data Breach

Given the complexity of data breaches and the strict GDPR requirements, it is crucial for organisations to have a solid plan in place for managing and responding to breaches. Here are key steps to prepare for and respond to a data breach:

Develop a Data Breach Response Plan: This plan should outline the steps to take in the event of a breach, including who is responsible for managing the response, how the breach will be investigated, and how notifications will be handled. The plan should also include provisions for regular testing and updating.
Conduct Regular Risk Assessments: Regular risk assessments can help identify potential vulnerabilities in the organisation’s data protection practices and allow for timely remediation.
Implement Strong Security Measures: Organisations should implement robust technical and organisational measures to protect personal data, such as encryption, access controls, and regular security audits.
Train Employees: Employees should be trained on data protection best practices and the importance of safeguarding personal data. They should also be aware of the organisation’s data breach response plan and know how to report potential breaches.
Appoint a DPO: If required, appointing a DPO can help ensure that the organisation is compliant with GDPR and has a dedicated individual overseeing data protection efforts.
Monitor for Breaches: Implementing monitoring tools and processes to detect potential breaches early can help minimise damage and ensure timely notification.
Document Breaches: GDPR requires organisations to document all data breaches, even if they do not require notification. This documentation should include the details of the breach, the consequences, and the actions taken to address it.
Communicate Transparently: In the event of a breach, clear communication with both the supervisory authority and affected individuals is essential. Timely, accurate, and transparent communication can help mitigate the damage caused by the breach and reduce the risk of penalties.

Conclusion

GDPR has set a new global standard for data protection, and understanding the intricacies of data breaches under this regulation is critical for organisations that handle personal data. The broad definition of a data breach under GDPR, encompassing confidentiality, integrity, and availability breaches, means that organisations must be vigilant in safeguarding the personal data they process. The stringent notification requirements further emphasise the need for preparedness and transparency.

By understanding the key concepts and definitions related to GDPR data breaches, as well as the obligations and potential penalties, organisations can take proactive steps to protect personal data and ensure compliance with the regulation. With the increasing frequency and sophistication of cyberattacks, a robust data protection strategy is not only a legal requirement but also a vital component of maintaining customer trust and safeguarding business operations.

The consequences of failing to comply with GDPR’s data breach provisions can be severe, both in terms of financial penalties and reputational damage. However, by investing in strong security measures, conducting regular risk assessments, and fostering a culture of data protection awareness, organisations can mitigate the risks and navigate the complexities of GDPR with confidence.