Data Breach

A data breach is the loss of control, compromise, unauthorized disclosure, or unauthorized acquisition of personally identifiable information. It also covers access by someone who is not authorized, and access by an authorized user for an unauthorized purpose. That is the NIST glossary definition; the GDPR, HIPAA, and SEC rules each set their own definitions and deadlines.

Incident or breach

NIST defines an incident as an occurrence that actually or potentially jeopardizes the confidentiality, integrity, or availability of an information system or its information. A violation or imminent threat of violation of security policies is also an incident.

The European Data Protection Board says all personal data breaches are security incidents, but not all security incidents are personal data breaches. It sorts breaches into three types: confidentiality, integrity, and availability. Its example of loss is ransomware encrypting the only copy of a set of personal data.

GDPR: 72 hours to the regulator

GDPR Article 4(12) defines a personal data breach as a breach of security leading to the accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of, or access to, personal data.

Under Article 33, the controller must notify the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of the breach. No notice is needed if the breach is unlikely to result in a risk to people's rights and freedoms. A late notice must give the reasons for the delay. Controllers must document every personal data breach.

The EDPB treats a controller as aware once it has a reasonable degree of certainty that a security incident has compromised personal data. Under Article 34, the controller must also tell the affected people without undue delay when the breach is likely to result in a high risk to them.

HIPAA: 60 days and the 500-person threshold

Under the HIPAA Breach Notification Rule, a breach is an acquisition, access, use, or disclosure of protected health information in a manner not permitted under Subpart E of 45 CFR Part 164 that compromises the information's security or privacy. Such an event is presumed to be a breach unless a risk assessment shows a low probability that the information was compromised.

The notice duties apply to unsecured protected health information. Covered entities must notify each affected individual without unreasonable delay and no later than 60 calendar days after discovery. A breach involving more than 500 residents of a state or jurisdiction also requires notice to prominent media outlets there. Breaches involving 500 or more people go to the HHS Secretary at the same time as the individual notices. Smaller breaches are logged and reported within 60 days after the end of the calendar year.

Public companies: Form 8-K Item 1.05

On July 26, 2023, the SEC adopted rules requiring public companies to disclose any cybersecurity incident they determine to be material. The disclosure goes on Form 8-K under Item 1.05. A company must determine materiality without unreasonable delay after discovery. It then generally has four business days to file. The filing may be delayed if the US Attorney General finds that immediate disclosure would pose a substantial risk to national security or public safety.

Sources

Checked November 5, 2026.

Related Terms

Incident ResponsePersonally Identifiable InformationGDPRRansomwareZero Trust