When personal data breach is mentioned, people tend to think immediately of personal data leaks, where unauthorised third parties can gain access to the data (such as hacking incidents by malicious parties). Whilst this does indeed count as a personal data breach, the notion of it actually applies to a much wider scope. The G29 (a European advisory body made up of various European personal data protection authorities) defines the notion of data protection breach as falling under the following three categories:   Accidental or unauthorised loss of access to, or destruction of, personal data, otherwise named an “Availability breach”. Unauthorised or accidental alteration of personal data, otherwise named an “Integrity breach”.
Unauthorised or accidental disclosure of personal data, otherwise named a “Confidentiality breach”.
A data breach does not, therefore, only apply to data leaks. It also applies to the definitive loss of data. The GDPR imposes new obligations for both data controllers and data processors in terms of personal data breach notifications.