In GDPR Article 4 definitions, personal data is “any information relating to an identified or identifiable natural person,” referred to as a data subject. A personal data breach is “a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed.” According to the GDPR definition, “an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.” For personal data with personally identifiable information to apply to GDPR, it meets the following test. The personal data is processed by a data controller or data processor either automatically or manually if part of a filing system.  Data subjects, according to the General Data Protection Regulation (GDPR), are citizens or “habitual residents” of EU Member States (countries).  The data controller needs to give their regulator, the supervisory authority, a personal data breach notification within 72 hours of becoming aware of the personal data breach (or the reason for a delayed notification). The data processor informs the data controller about breaches that it observes. Article 33 of the GDPR describes what to include in a personal data breach notification.  If the sensitive data breach is “likely to result in a high risk to the rights and freedoms of natural persons, the controller shall communicate the personal data breach to the data subject without undue delay.” If the data controller meets certain conditions described in Article 34 of the GDPR, then the data subject doesn’t need to be informed of the personal data breach.