A data breach can affect far more than passwords or payment details. It may involve a customer’s contact information, a patient’s medical records, an employee’s private correspondence, or documents that reveal where someone lives. Sometimes, criminals steal information through a cyberattack. In other cases, an ordinary mistake exposes information to the wrong person.
For individuals, the consequences can range from unwanted messages to targeted fraud, identity misuse, or risks to personal safety. For organisations, a breach can disrupt services, damage trust, and create legal responsibilities.
Understanding what counts as a data breach, and what to do when one occurs, helps people make informed decisions without assuming that every incident means their identity or money has been stolen.
What is a data breach?
A data breach is an incident in which information is exposed, lost, changed, destroyed, or accessed without proper authorisation. The precise meaning depends on the type of data and the circumstances.
Under Article 4(12) of the UK General Data Protection Regulation (UK GDPR), a personal data breach is a security breach that leads to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data.
That definition is broader than a hacker breaking into a database. An employee could send a spreadsheet to the wrong recipient. A device containing personal information could be lost. A document might be published online with confidential details still visible. A criminal could also use stolen login credentials to access customer records.
The important question is not simply whether a system was attacked. It is whether personal data was affected in a way covered by the legal definition.
What counts as a personal data breach?
A security failure can affect personal information in more than one way.
Personal information reaches someone who should not have it, or is accessed without permission.
Personal data is lost or destroyed accidentally or unlawfully.
Personal information is changed without proper authority, potentially making records inaccurate.
Source: UK GDPR, Article 4(12).
A general IT problem is not automatically a personal data breach. A website going offline, for example, does not by itself prove that personal information was exposed. However, an incident that destroys, alters, loses, or makes personal data unavailable may require a data protection assessment, depending on the circumstances.
The Information Commissioner’s Office (ICO), the UK’s independent information rights regulator, provides official guidance on what counts as a personal data breach and how organisations should respond.
Does every unexpected use of personal information count as a breach?
No. Unexpected does not always mean unlawful, and not every use or disclosure of personal information is a data breach.
An organisation may have a lawful reason to use or share information, provided it complies with the applicable data protection rules. Some disclosures may be authorised by law or necessary for a legitimate function. Other uses may be inappropriate without necessarily meeting the legal definition of a personal data breach.
The circumstances matter. Was the information accessed or disclosed without authorisation? Was it lost, destroyed, or altered? Was there a security failure? What legal authority did the organisation have to handle the information in that way?
For example, an organisation sending a person’s information to an authorised service provider under appropriate arrangements is different from an employee emailing the same information to an unrelated person by mistake. Similarly, receiving an unsolicited marketing message does not, by itself, prove that a personal data breach has occurred.
The correct response is to establish what happened before deciding how the incident should be classified.
Unexpected use does not always mean a data breach
Classify the event by checking authorisation, what happened to the data and the applicable legal rules.
Information is shared with an approved recipient for a lawful purpose under appropriate arrangements.
This may be suspicious, but the message alone does not prove a personal data breach. Investigate the source and facts.
This can be a personal data breach because the information has been disclosed to someone who should not receive it.
Unauthorised access to personal information can qualify even if there is no evidence it was published publicly.
This is a practical guide, not a legal test. Each incident must be assessed on its facts. ICO examples.
What is the difference between a data breach and a personal data breach?
The terms are often used interchangeably in everyday conversation, but they are not identical in legal and practical contexts.
A data breach is a broad description of a security failure affecting data. The affected information might include commercial records, confidential business documents, or personal information. A personal data breach is specifically defined by data protection law and concerns personal data relating to an identified or identifiable living person.
A person’s full name does not have to appear in a record for it to qualify as personal data. Information that identifies someone indirectly, especially when combined with other details, may also fall within the definition.
For example, a leaked document containing general financial forecasts may be a serious confidentiality incident without necessarily being a personal data breach. A file containing identifiable employees’ salaries, home addresses, or medical information raises a different set of questions.
The legal classification matters because specific data protection obligations may apply even when no criminal attack has taken place.
Data breach vs personal data breach
The terms overlap, but the legal meaning of a personal data breach is more specific.
| Comparison | Data breach (broad use) | Personal data breach (UK GDPR) |
|---|---|---|
| What it concerns | A security incident affecting data of different kinds. | A security breach affecting personal data in a way covered by the legal definition. |
| Information involved | May include commercial, operational, confidential or personal information. | Information relating to an identified or identifiable living person. |
| Examples | Exposure of confidential business plans or unauthorised access to personal records. | Customer records sent to the wrong person, or personal information accessed without authorisation. |
| Must a person be identifiable? | Not necessarily. | Yes, directly or indirectly, for the information to be personal data. |
| Data-protection duties | Depend on the type of information and other applicable laws. | UK GDPR and data-protection duties may apply, including assessment and possible notification. |
| Does it prove a crime? | No. Mistakes and system failures can also be involved. | No. A personal data breach can be accidental or unlawful. |
Legal reference: UK GDPR, Article 4. “Data breach” is used broadly in this table; it is not a substitute for assessing the legal facts of an incident.
What information can be exposed in a data breach?
The information involved depends on what an organisation collects, why it holds it, and which systems or documents are affected. A breach does not automatically expose everything an organisation possesses.
What information could be exposed?
The actual information affected depends on the organisation and the incident.
Name, email address, telephone number or postal address.
Usernames, login details or account identifiers.
Transaction records or other financial information.
Date of birth or details on identity documents.
Medical records, treatment details or care correspondence.
Identifiers or location information that can identify someone.
Source: UK GDPR, Article 4.
Personal data can include information relating to an identified or identifiable person. This may include contact details, account identifiers, financial records, identity information, employment records, health information, and online identifiers.
The same type of information can create different levels of risk in different circumstances. An exposed email address might make a convincing phishing message easier to write. A combination of identity details could assist impersonation. Information about a person’s health, family circumstances, or location may create additional privacy or safety risks.
A breach does not prove that the exposed information has been used for fraud. An organisation may have evidence that someone accessed a system without knowing whether the information was copied, distributed, or misused. That uncertainty should be explained clearly rather than presented as proof either of harm or of safety.
NHS England’s guidance explains that personal data breaches can have consequences including scam attempts, identity fraud, discrimination, reputational damage, and, in some circumstances, effects on a person’s care. The actual risk depends on the data and the circumstances.
How does a data breach happen?
There is no single route to a data breach. Some incidents begin with deliberate criminal activity; others result from mistakes, poor processes, or failures in technology.
How Does a Data Breach Happen?
Six common routes through which personal information can be exposed, lost or accessed without authorisation.
Different causes. Different warning signs. One essential question: what information was affected?
Cyberattacks and unauthorised access
Criminals exploit software weaknesses, exposed services or poorly secured accounts to enter systems containing personal information.
Stolen credentials and social engineering
Phishing or impersonation can trick staff into revealing login details. Reused or stolen passwords may also let attackers access accounts.
Human error and accidental disclosure
Information may be emailed to the wrong recipient, shared too widely or published in a document that still contains confidential details.
Insider misuse
A person with legitimate access may deliberately view, copy or share information for an unauthorised purpose. Careless shortcuts can also create exposure.
Lost devices, documents and insecure storage
A missing phone, laptop, removable drive or paper file can expose information if someone else can access it.
Third-party suppliers and connected systems
Customer platforms, cloud services and other external providers may hold or process information. Weak configurations or compromised supplier systems can create exposure.
What are the consequences of a data breach?
The consequences vary widely. An incident involving a small amount of low-risk information may cause limited harm, while the exposure of sensitive information or information about a person at risk may have serious consequences.
For individuals, potential effects include fraud attempts, account impersonation, unwanted contact, distress, loss of privacy, discrimination, or risks to personal safety. For organisations, the impact may include investigation and recovery costs, disruption to services, complaints, loss of customer confidence, and regulatory scrutiny.
These outcomes are possibilities, not inevitable results. A breach does not automatically mean that a person will suffer financial loss or that an organisation will face a penalty. The evidence, the legal duties involved, and the actual or potential harm all matter.
The most useful questions are practical: what information was affected, who could access it, what could happen next, and what steps are being taken to reduce the risk?
What can happen after a data breach?
The impact depends on the information involved, who accessed it and how quickly the risk is reduced.
Possible effects on people
- More convincing phishing or scam messages
- Attempts to impersonate someone or take over an account
- Financial loss if information is misused
- Loss of privacy, distress or reputational harm
- Potential discrimination or personal-safety risks
Possible effects on organisations
- Investigation and recovery costs
- Disruption to systems or services
- Customer complaints and reduced trust
- Regulatory scrutiny and possible legal claims
- Changes to security and operating procedures
Real UK examples: what recent incidents show
Publicly documented incidents help explain how data breaches work in practice. The following examples are based on statements from the organisations involved. Those statements should be read as attributed accounts, not as substitutes for a regulator’s findings or an independent investigation.
ASOS: an employee account was accessed after impersonation
In its October 2026 customer update, ASOS said an unauthorised party impersonated a trusted contact to obtain an employee’s login credentials. Those credentials were then used to access information on certain third-party platforms used by the retailer.
ASOS said its investigation found that the unauthorised party had accessed some personal information, including names and contact details, as well as certain non-personal account-related information. The company said that no payment card information or account passwords had been accessed in the investigation described in its update. It also said that the affected platforms had been locked down and that its investigation was continuing.
The incident illustrates how social engineering can provide a route into business systems without an attacker necessarily exploiting a software vulnerability directly. It also shows why organisations need to protect employee accounts and manage access to external platforms carefully.
Read the company’s ASOS security incident update for its latest account and customer advice.
American Golf: customer records held in an external system
American Golf published a statement about unauthorised access to a customer system operated by an external technology provider. Its statement says the affected records included customer information such as names, email addresses, dates of birth, telephone numbers, postcodes, and limited address information.
The company says approximately 3.5 million customer records were involved, while cautioning that this does not necessarily represent 3.5 million individual customers. It also says that passwords, payment card details, and other financial information were not stored in the affected system.
American Golf says customer records were accessed but that it could not establish what the unauthorised party subsequently did with the information. The company says it notified the ICO and advised potentially affected customers to remain alert to unexpected communications.
This example highlights an important distinction: an organisation may identify which records were accessed without knowing whether the information was later copied, shared, or misused.
Read the American Golf customer data statement for the company’s account and advice.
NHS information: an IT incident is not always a cyberattack
NHS England’s official guidance distinguishes between an IT incident and a personal data breach. A system problem may disrupt a service without affecting identifiable information. In other circumstances, personal information may be shared with the wrong person, destroyed by mistake, changed so that it becomes inaccurate, or made unavailable.
An NHS IT incident is not always a data breach
The system problem and its effect on personal information are separate questions.
IT incident
A system or network problem affects a service. It does not automatically mean identifiable personal information has been compromised.
Personal data breach
Identifiable information is lost, disclosed, altered, destroyed, accessed without authorisation or made unavailable in circumstances covered by the definition.
Source: NHS England: personal data breaches and related incidents.
That distinction matters because the technical cause and the data protection impact are separate questions. An IT outage is not proof that criminals stole records. Equally, a breach does not need to involve a criminal to affect a person’s privacy or care.
NHS England says health and care organisations should investigate incidents, minimise risks to people and their care, and learn from what happened.
What the ICO’s figures can, and cannot, tell us
The ICO’s 2024–25 annual report recorded 12,412 personal data breach cases received, compared with 11,680 in 2023–24. The report also says that emailing, posting, or faxing personal information to the wrong person remained the most common reported incident type, accounting for just over 18% of reported breaches.
These figures describe the ICO’s reported casework. They are not a count of every breach across the UK, every affected individual, or every criminal attack. The number of cases received also does not, by itself, establish why the figures changed.
ICO personal data breach cases received
Cases recorded in the ICO’s annual report, by financial year.
This is the change in cases received by the ICO, not the total number of data breaches or people affected across the UK.
Source: ICO Annual Report and Financial Statements 2024–25. Values shown as reported by the ICO.
What does UK data protection law require?
The main framework includes the UK GDPR and the Data Protection Act 2018, alongside other rules that may apply to particular organisations or services. The Data (Use and Access) Act 2025 has also changed parts of the data protection framework, so organisations should consult current official guidance rather than relying on an old summary.
Organisations handling personal data must take appropriate steps to protect it. When a personal data breach occurs, they need to establish what happened, contain the incident, assess the likely risk to people, and decide which notifications are required.
When must an organisation report a breach to the ICO?
Does a personal data breach need to be reported?
The organisation must assess the incident and the likely risk to people’s rights and freedoms.
Contain the incident, gather the facts and assess the likely risk.
Notify the ICO without undue delay and, where feasible, within 72 hours of becoming aware, under the applicable reporting rule.
In addition to the regulator notification, affected individuals generally must be informed without undue delay, subject to legal requirements and exceptions.
It is not a universal deadline for every breach or every individual notification.
Plain-English summary only. Check the current law and guidance before making a reporting decision. The ICO says some guidance is under review following the Data (Use and Access) Act 2025.
Not every personal data breach must be reported to the regulator. The ICO’s published UK GDPR guidance says an organisation must notify the ICO when a breach is likely to result in a risk to people’s rights and freedoms. Notification should be made without undue delay and, where feasible, within 72 hours of the organisation becoming aware of the breach.
Where a breach is likely to result in a high risk to people’s rights and freedoms, the organisation must also communicate it to affected individuals without undue delay, subject to the applicable legal requirements and circumstances.
The 72-hour period is not a general deadline for individuals to report a breach. Nor does it mean every affected person must receive a message within 72 hours. It concerns the organisation’s reporting obligation to the regulator when the relevant threshold is met.
The ICO’s guidance notes that it is under review following changes made by the Data (Use and Access) Act 2025. Organisations should check the current guidance and legislation when making a real reporting decision.
Does an organisation have to tell everyone affected?
No. Whether an organisation must directly inform affected individuals depends on the risk and the applicable rules. Where the breach is likely to result in a high risk to people’s rights and freedoms, the organisation generally has to communicate it to them without undue delay.
A notification should help people understand what happened, which information may be affected, and what steps they can take. If you receive a message about a breach, read it carefully but remain alert to fraudulent messages that imitate a genuine company or regulator.
What can the ICO do?
The ICO can receive complaints, assess reported incidents, and take regulatory action where appropriate. It can also provide guidance to help organisations understand their responsibilities and improve how they handle personal information.
What can the ICO do?
The Information Commissioner’s Office is the UK’s independent information rights regulator.
Consider complaints about how organisations handle personal information.
Seek information and assess whether data-protection requirements have been met.
Publish guidance to help people understand their rights and organisations understand their duties.
Use its regulatory powers when justified by the circumstances and applicable law.
Source: ICO guidance for the public.
If you believe an organisation has mishandled your information, the ICO advises raising the concern with that organisation first and giving it an opportunity to investigate and respond. You can then consider making a complaint to the ICO if you remain dissatisfied.
A complaint is not the same as a criminal report. Contacting the ICO does not automatically establish that a breach occurred, guarantee compensation, or mean the regulator will take enforcement action in every case.
What should you do if your personal data has been breached?
Your response should depend on the information involved and the warning you have received. Avoid assuming the worst, but do not ignore a credible notification.
If your personal data may have been exposed
Take the steps relevant to the information involved. Not every incident requires every action.
Use the organisation’s official website or trusted contact details, not unexpected links.
Change exposed or reused passwords and enable two-step verification where available.
Contact your bank through an official channel if financial details may be involved.
Save the notification, suspicious messages, account alerts and relevant correspondence.
Request clear information about the data involved and any recommended next steps.
Use the organisation’s complaint process and consider contacting the ICO if concerns remain.
Sources: NCSC guidance for individuals and families and ICO guidance for the public.
Start by verifying the message. Visit the organisation’s official website directly or use contact details you already trust. Do not follow unexpected links or provide passwords, security codes, or banking details in response to a message claiming to explain a breach.
If a password may have been exposed, change it through the genuine service and change it anywhere else you reused it. Enable two-step verification where available. If financial information may be involved, contact your bank or card provider using the number on your card or its official website, review transactions, and report anything you do not recognise.
Keep copies of breach notifications, suspicious messages, account alerts, and correspondence with the organisation. These records can help when you ask questions, dispute a transaction, or make a complaint.
Ask the organisation what information was involved, whether access to your records was confirmed, what it has done to contain the incident, and whether it recommends further action. If its response does not resolve your concern, follow its complaints process and consider contacting the ICO.
If the incident involves threats, stalking, abuse, or an immediate safety concern, prioritise your safety and contact the appropriate emergency or support service.
How can data breaches be prevented?
Reduce the risk of a data breach
Good protection combines technology, careful processes and informed people.
Use strong, unique passwords and two-step verification for important accounts.
Give staff and suppliers access only to the information they need.
Apply security updates and review exposed services and account permissions.
Check recipients, document permissions and remove information that should not be published.
Understand where information is stored and how suppliers handle incidents.
Keep appropriate backups, monitor activity and establish a clear incident-response process.
Sources: NCSC two-step verification advice and strong, separate email passwords.
No single measure can eliminate every risk. Effective protection combines technical safeguards, sensible processes, and people who understand how information should be handled.
Organisations should restrict access to personal data to people who need it for their work, maintain systems and software, protect accounts, and review how information is shared with external suppliers. Staff need practical guidance on sending documents, checking recipients, handling sensitive records, and reporting mistakes promptly.
Organisations should also have a response process for when something goes wrong. Appropriate backups, reliable logs, clear escalation routes, and a documented incident response plan can help contain an incident and assess its impact.
Individuals can reduce their own exposure by using unique passwords, enabling two-step verification, keeping devices updated, and being cautious with unexpected requests for information. These measures cannot prevent every organisational breach, but they can make it harder for a criminal to use exposed information to access another account.
The bottom line
A data breach is not simply another way of saying that a company was hacked. A personal data breach can result from criminal activity, an employee’s mistake, a lost device, a supplier’s system, or information that is lost, changed, destroyed, or made unavailable.
The consequences depend on the information involved, the circumstances, and the risk to the people concerned. A breach notification is a reason to pay attention, not proof that every piece of information has been stolen or misused.
For UK readers, the practical priorities are to verify the notification, protect affected accounts or finances, ask the organisation for clear information, and use official guidance if concerns remain. For organisations, prompt containment, a careful risk assessment, and compliance with the applicable reporting duties are essential.
Reliable information matters more than dramatic claims. Understanding what actually happened, and what remains unknown, is the best starting point for responding to a data breach.
Related Reading
Understanding data breaches is one part of understanding the wider cybersecurity landscape. These Secritic guides explore related topics and provide useful background on cybercrime.
What Is Cybercrime?
Learn what cybercrime means, the different forms it can take, and how criminal activity affects individuals, businesses and organisations.
Cybercrime Empire
Explore the wider world of cybercrime and the criminal activity that can put digital information, accounts and systems at risk.
Community discussion
Join the conversation
1 comment
Sign in to comment
Join the conversation with your Secritic account. Comments are available to signed-in readers.