Regulation and data
Personal data breach
A personal data breach is any breach of security that results in the accidental or unlawful destruction, loss or alteration of personal data, or to their unauthorised disclosure or access (art. 4.12 of the GDPR). Losing a staff phone with residents' data, or sending a list by mistake, are breaches.
Also known asdata breach · security breach · brecha de seguridad
What to do, and how fast
It takes no cyberattack: confidentiality broken through carelessness, data altered by mistake or data that stop being available, such as a file with no backup that gets corrupted, are breaches too. What the GDPR asks of the controller depends on the risk to people:
| Risk | What the controller does |
|---|---|
| Unlikely | Documents it: facts, effects and the measures taken (art. 33.5) |
| Possible | Also notifies the AEPD, the Spanish authority, without undue delay and, where feasible, within 72 hours of becoming aware; if later, it explains why (art. 33.1) |
| High | Also tells the people affected, in clear and plain language (art. 34.1) |
Worth knowing
Encryption can spare the message to those affected: it is not needed if the data were unintelligible to whoever accessed them (art. 34.3.a); see encryption. Notification is made through the AEPD's online office and can be completed in phases if not all the information is available (art. 33.4). If the breach happens at a supplier, the supplier tells the centre without undue delay (art. 33.2), but the 72-hour deadline still belongs to the centre, which is the controller.
Sources
Related terms
- AEPD (Spanish Data Protection Agency)The AEPD, the Spanish Data Protection Agency, is the independent administrative authority that enforces the GDPR and the LOPDGDD in Spain: it handles complaints, inspects and sanctions, receives breach notifications and the appointment of data protection officers, and publishes guides and tools.
- EncryptionEncryption is the technique that turns data into text nobody can read without the key. The GDPR names it among the security measures of its art. 32 and gives it a practical effect: if encrypted data are lost and the key is safe, it may not be necessary to tell each person affected.