Compliance Glossary

Breach Notification under the GDPR is the obligation of a controller to report any security incident in which individuals’ personal data have been subject to unauthorized access or disclosure, destruction, or other forms of misuse. 

It helps alert data subjects and regulators of a potential breach and provides them with information about the incident. This can include what occurred, what was impacted, and what is being done to mitigate the effects. 

For example, suppose a 3rd party misuses an organization’s system to access a database containing sensitive financial information on its customers. In that case, that organization must notify authorities within 72 hours of discovering the breach. Failing to do so could result in significant fines and penalties for noncompliance.