Since 25 May 2018, controllers experiencing a personal data
breach must – as a general rule – notify it to the
appropriate supervisory authority. Not all breaches will require
notifications: those that do not pose a risk to the rights and
freedoms of natural persons will generally fall under the radar.
However, if such risk shall exist, the data controller will be
required to notify a given breach to the relevant supervisory
authority as well as to the natural persons concerned – if
the likelihood of risk is high.
As defined under article 4 of the General Data Protection
Regulation (GDPR), personal data breach means a breach of security
leading to the accidental or unlawful destruction, loss,
alteration, unauthorised disclosure of, or access to, personal
data. This includes accidental/unintentional and
willful/intentional breaches. It also means that a breach is more
than just about losing personal data, since a mere lack of access
by the controller to the personal
