A personal data breach is a security incident that leads to accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access to personal data.
Breach Notification Requirements
- To supervisory authority: Within 72 hours of becoming aware (unless unlikely to result in risk)
- To affected individuals: Without undue delay if high risk to rights and freedoms
What to Document
You must document all breaches, including facts, effects, and remedial actions taken.