Security breach (security incident)

A security breach is an event in which a stated organisational policy or legal requirement regarding information security has been violated, or in which the confidentiality, integrity or availability of information or systems has been compromised. In practice organisations distinguish a security event (an observable occurrence), a security incident (an event that has or may have compromised security and requires response) and a confirmed breach. Every breach starts as an incident; not every incident becomes a breach.

A security breach becomes a personal data breach under Art. 4(12) GDPR only where personal data is actually affected, in which case the 72-hour notification clock of Art. 33 starts when the controller becomes aware with reasonable certainty. Incidents affecting systems that hold no personal data (for example a research server holding only anonymised aggregates, or manufacturing systems) are security breaches without being personal data breaches, but they may still trigger other duties: reporting of significant incidents within 24 hours (early warning) and 72 hours under the NIS2 Directive for entities in the health sector, reporting of cybersecurity incidents affecting medical devices under the MDR vigilance system, and, for clinical trials, serious breach reporting under Art. 52 CTR where trial integrity or subject safety is affected.

Life sciences organisations are attractive targets for ransomware and intellectual property theft, and their incident response plans should therefore integrate the GDPR, NIS2, MDR and GCP assessment paths into a single triage. ISO 27001 and ISO 27035 provide the management framework; the ENISA methodology supports severity assessment of the personal data component. Vendor contracts should define incident notification timelines (typically 24 to 48 hours to the sponsor) so that downstream regulatory deadlines can be met.