Personal data breach

What it means

A personal data breach is not only an attack from outside. Under GDPR it is any security failure leading to the destruction, loss, alteration or unauthorised disclosure of data: a lost laptop counts, and so does a payroll sheet sent to the wrong address.

Three consequences are distinguished: loss of confidentiality, loss of integrity and loss of availability. A lost encrypted disk is still an incident, but the risk to people is low, and it is the level of risk that decides what the company must do next.

Not every GDPR violation is a breach in this sense. Processing without a legal basis or keeping data longer than needed is unlawful, but it is not a security incident and is not notified within the incident deadline. It is dealt with differently, for example by erasure and by fixing the procedures.

How it works in practice

The controller assesses the risk and, where a risk to people’s rights is likely, notifies the Slovak data protection authority without undue delay, generally within 72 hours of becoming aware. Where the risk is high, the individuals are told as well.

Every breach goes into an internal incident log even when it is not notified, much as the record of processing activities is kept. If a supplier processes the data, it reports the incident to the controller under the processing agreement, but the assessment stays with the controller.

When a payslip reaches the wrong person, the first steps are practical: ask the recipient to delete it and confirm, change passwords, withdraw access rights that should no longer exist, and write it all down with times. Only from that record can the risk be assessed sensibly and the decision on notification be made.

What to watch out for

The expensive part is rarely the slip itself; it is the silence around it. A payroll sheet sent to a stranger is declared an internal matter and logged nowhere, and when the employee complains to the authority the penalty lands for the missing record and the missed notification, not for the e-mail.

Without an audit log the company cannot say which data the attacker reached and has to assume the worst possible scope. Instead of reporting one mailbox it informs every customer, which costs time, trust and money even though the real leak may have been small.