Lesson 5.4: What is a personal data breach
Know exactly what counts, so you can spot one at once. This DPDPA 2023 course page explains what is a personal data breach in plain language.
'%2F%3E%3Ccircle%20cx%3D'650'%20cy%3D'15'%20r%3D'62'%20fill%3D'%2314b8a6'%20opacity%3D'.35'%2F%3E%3Ctext%20x%3D'28'%20y%3D'54'%20font-family%3D'Poppins%2CArial%2Csans-serif'%20font-size%3D'26'%20font-weight%3D'800'%20fill%3D'white'%3EDPDPA%202023%20COURSE%3C%2Ftext%3E%3C%2Fsvg%3E)
What you will learn about what is a personal data breach
- Define a personal data breach
- Tell breach from incident
- Recognise common breach patterns
Definition (what is a personal data breach)
A personal data breach is any unauthorised processing of personal data, or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access, that compromises the confidentiality, integrity or availability of the data.
Breach types: click each
Select a numbered box to read more.
Common patterns (what is a personal data breach)
| Pattern | Example |
|---|---|
| Wrong recipient | Email with customer list sent to the wrong person |
| Phishing | Staff give away login |
| Lost device | Unencrypted laptop stolen |
| Misconfiguration | Public cloud storage |
| Ransomware | Files locked |
| Insider | Staff copies data to leave |
Worked example
An employee emails an invoice file with 300 customer names to the wrong external address. That is a breach even without malice.
Activity (5 minutes) (what is a personal data breach)
List three recent near-misses in your company and class each by type.
Check your understanding of what is a personal data breach
Q1. Ransomware that locks data is a breach of:
Q2. Sending data to the wrong recipient is:
Q3. Who should report suspicion?
Educational material for learning purposes, not legal advice. Check the official text of the DPDP Act, 2023, the DPDP Rules, 2025 and MeitY notifications for the latest position.