Personal data breach

A personal data breach means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed (Art. 4(12) GDPR). The EDPB Guidelines 9/2022 classify breaches as confidentiality breaches (unauthorised disclosure or access), integrity breaches (unauthorised alteration) and availability breaches (loss of access or destruction), and a single incident, such as ransomware, may combine all three. Not every security incident is a personal data breach: the incident must actually affect personal data.

Under Art. 33 the controller must notify the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware, unless the breach is unlikely to result in a risk to individuals; the notification describes the nature of the breach, categories and approximate numbers of data subjects and records, likely consequences and measures taken. Under Art. 34, where the breach is likely to result in a high risk, affected data subjects must also be informed. A processor must notify its controller without undue delay. Every breach, notified or not, must be documented in a breach register (Art. 33(5)).

In life sciences, common breaches include misdirected emails containing patient lists, lost laptops with unencrypted trial data, compromised EDC or eCOA accounts, ransomware at a site or CRO, and unblinding through misconfigured access. Because health data is involved, risk is rarely "unlikely", and the ENISA severity methodology (assessing data processing context, ease of identification and circumstances of the breach) is widely used to decide on notification. Vendor contracts should impose notification to the sponsor within 24 to 48 hours so that the sponsor can meet its own 72-hour deadline, and breaches affecting trial integrity may also need to be reported as serious breaches under Art. 52 CTR.