Data breach
Also called personal data breach, cybersecurity incident
A data breach is a security incident that leads to the accidental or unlawful loss, destruction, alteration, disclosure of, or access to, data. For personal data, the GDPR requires firms to notify the regulator within 72 hours unless the breach is unlikely to put individuals at risk.
How it works
When a breach is detected, the firm contains it, assesses what data was affected and judges the risk to individuals and to the business. Several clocks can start at once. Data protection rules, financial regulators, securities law and contracts may each require notice. Firms keep a breach log of every incident, including those not reported, with the reasons for each decision.
Breaches matter to regulated firms because they trigger parallel duties. A cyber attack on an EU bank can be a GDPR personal data breach and a major ICT incident under DORA at the same time. US listed firms may need to disclose a material incident to investors. Late or incomplete reporting is itself a breach and is often treated more seriously than the incident.
The rules
Controllers must notify the supervisory authority within 72 hours of becoming aware of a personal data breach, and tell individuals when the risk is high.
Controllers and processors of personal dataFinancial entities must classify ICT-related incidents and report major incidents to their competent authority using initial, intermediate and final reports.
EU financial entitiesCompanies must disclose a material cybersecurity incident on Form 8-K within four business days of determining it is material.
SEC-registered public companiesCovered firms must run an incident response programme and notify affected individuals within 30 days when sensitive customer information is compromised.
Broker-dealers, investment advisers, funds and transfer agentsCommon questions
What counts as a personal data breach?
Any security incident that compromises the confidentiality, integrity or availability of personal data. Examples include a hacked database, an email sent to the wrong person, a lost laptop or ransomware that locks records. It does not need to involve theft or publication.
Does every data breach have to be reported?
No. Under the GDPR, a breach must be reported to the regulator unless it is unlikely to result in a risk to individuals. All breaches must still be recorded internally. Other regimes, such as DORA, use their own thresholds for what is reportable.
When does the 72-hour clock start?
It starts when the controller becomes aware of the breach, meaning it has a reasonable degree of certainty that an incident has compromised personal data. If full details are not yet known, the firm can report in phases.
How is a breach different from a cyber incident?
A cyber incident is any event that threatens systems or data. It becomes a data breach when data is actually lost, altered, disclosed or made unavailable. Many breaches have no cyber element, such as misdirected post or emails.
Our coverage
News and analysis on GRC and resilience from RegTech Post.
Read the coverage →RegTech PostDentsu Hack Exposes Employee Bank, Payroll and Social Security DataRead the article →RegTech PostWhitehall Scrambles to Overhaul Data Protection After £1bn MoD Afghan BreachRead the article →
