Data Breach
A breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. Must be reported to the ICO within 72 hours if likely to result in a risk to individuals' rights.
Independent editorial summary — not the official statute text. Read the official version on legislation.gov.uk.
The Information Commissioner's Office defines the concept directly: 'A personal data breach means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. This includes breaches that are the result of both accidental and deliberate causes.' It is deliberately broader than a hack or a leak — the ICO stresses 'a breach is more than just about losing personal data.'
The UK GDPR imposes a strict clock on reporting: 'The UK GDPR introduces a duty on all organisations to report certain personal data breaches to the relevant supervisory authority. You must do this within 72 hours of becoming aware of the breach, where feasible', and if reporting is delayed beyond that, 'you must give reasons for the delay.' A second, higher duty applies to the people affected: 'If the breach is likely to result in a high risk of adversely affecting individuals' rights and freedoms, you must also inform those individuals without undue delay.' The chain of responsibility extends to processors too — 'If your organisation uses a data processor, and this processor suffers a breach, then under Article 33(2) it must inform you without undue delay as soon as it becomes aware.'
Related terms
Official sources
This explanation is drawn from the official sources below; every substantive statement is verified against them. For advice on a specific matter, see our find help page.