Data breach

A data breach is broader than hacking. Under GDPR, a personal data breach includes an email with client details sent to the wrong person, a laptop left on a train, a spreadsheet shared publicly by accident and files encrypted by ransomware so they cannot be accessed. What matters is that the data's confidentiality, integrity or availability was compromised.

It is also different from a security incident in general. A blocked login attempt is an incident but not a breach, because no data was exposed. This page is general information, not legal advice.

How it works

Common causes for small businesses are phishing that hands over an email or cloud password, reused passwords leaked from another site, unpatched website software exploited by bots, misconfigured cloud storage left open to the internet, malware on staff devices and simple human error. Many breaches go unnoticed for weeks because nothing visibly breaks.

Once a breach is discovered, the response follows a pattern: contain it (reset passwords, take the affected system offline, revoke access), assess what data was involved and how many people, preserve logs as evidence, fix the cause, and decide who must be told. Writing down each step and decision as you go is part of the obligation, not a nice extra.

Under GDPR, if the breach is likely to result in a risk to people's rights and freedoms, the organisation must notify its supervisory authority within 72 hours of becoming aware of it, even if not all details are known yet. If the risk to individuals is high, for example when passwords, financial or health data are involved, the affected people must also be told without undue delay, with advice on protecting themselves. Every breach, notified or not, should be recorded internally. Other countries and sectors have their own notification rules.

Example

An accountant's assistant clicks a fake document-sharing email and enters her email password. Over the weekend the attacker logs in, downloads several months of messages containing clients' tax documents and sets up a rule forwarding new mail to an outside address.

On Monday a client reports a strange email sent from the firm. The firm resets the password, removes the forwarding rule, turns on two-factor authentication for every account and reviews the sign-in logs to see what was accessed. Because identity documents and financial records were exposed, it notifies the data protection authority within 72 hours, writes to affected clients explaining what happened and what to watch for, and records the whole incident and its decisions.

Why it matters for your business

A breach brings direct costs (investigation, recovery, possible fines and claims) and indirect ones that often hurt more: lost client trust and staff time spent for weeks. Prevention is mostly basic hygiene: two-factor authentication on every account, a password manager, regular updates, collecting only the data you need and deleting what you no longer use. Have a simple written plan before anything happens: who decides, who contacts the authority, where the logs are. You can check whether your business email addresses appear in known breaches with free services such as Have I Been Pwned.

Common mistakes

• Assuming a misdirected email or lost laptop does not count as a breach because nobody hacked anything.
• Waiting until every detail is known before notifying the authority, and missing the 72-hour deadline.
• Resetting one password but missing the forwarding rules, backdoor accounts or other access the attacker created.
• Keeping years of old customer data that serves no purpose, which makes any breach larger.

Questions people ask

What should I do first after a data breach?

Contain it: change compromised passwords, revoke access, disconnect affected devices and preserve logs. Then assess what data and how many people are affected, and decide quickly whether you must notify the data protection authority, which under GDPR is within 72 hours where there is a risk to individuals.

Do I have to report every data breach?

Under GDPR, you must report a breach to the supervisory authority unless it is unlikely to result in a risk to people's rights and freedoms, and record every breach internally either way. Affected individuals must be told when the risk is high. This is general information, not legal advice.

How can I check if my data was in a breach?

Free services such as Have I Been Pwned let you check whether an email address appears in known public breaches. Many password managers and browsers also warn when a saved password has been exposed. Change any affected password and turn on two-factor authentication.