Guidelines 9/2022 on personal data breach notification under GDPR

• Jurisdiction: European Union
• Date: 04 April 2023
• Year: 2023
• Type of Document: Guidance

March 2025

When processing personal data, an organisation must

implement appropriate technical and organisational measures

to ensure an adequate level of security.

Despite this, breaches can still occur, so it is important to know

how to respond.

The GDPR denes a personal data breach as “a breach of

security leading to the accidental or unlawful destruction, loss,

alteration, unauthorised disclosure of, or access to, personal

data”.

A data breach can lead to physical, material, or non material

damage for individuals. This can include loss of control over

personal data, limitation of rights, discrimination, identity theft or

fraud, nancial loss, unauthorised reversal of pseudonymisation,

reputation damage, and loss of condentiality of personal data

protected by professional secrecy.

Personal data breaches

what to do

You must document all data breaches in a record, known as data breach register or documentation, by adding information

about the facts relating to the personal data breach, its eects and the remedial action taken. In the event of an inspection, this

documentation can be checked by the competent Data Protection Authority (DPA) to verify compliance with the GDPR.

Many personal data breaches must also be notied to the DPA and, in certain cases, they must be notied to the individuals

whose personal data have been aected. As a personal data breach is not necessarily an infringement of the GDPR, DPAs are not

obliged to exercise their corrective powers.

In case you have fallen victim of cybercrime, you are advised to report it to law enforcement. Europol lists the reporting

procedures in EU countries.

The EDPB guidelines on personal data breach notication under GDPR:

explain when an organisation should report a breach

provide examples of dierent types of breaches

specify who needs to be notied.