Skip to main content
Glossary termPublished inNormenkader IBP

Personal data breach

Also known as datalek, inbreuk in verband met persoonsgegevens, data breach

What is a "personal data breach" under the GDPR?

‘personal data breach’ means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed;

Defined in / by

Last updated: 14 October 2026.

Not only a hack

In Dutch the term is datalek, and the word suggests data leaking out. The definition is broader. Accidental destruction counts, so a ransomware attack that leaves a school without its pupil records is a breach even if nothing was copied. Loss counts, so a laptop left on a train is one. Alteration counts, and so does access by someone who should not have it, such as a teacher account that can open every class's files.

What follows is set out in Articles 33 and 34. The controller must notify the competent supervisory authority, in the Netherlands the Autoriteit Persoonsgegevens, "without undue delay and, where feasible, not later than 72 hours after having become aware of it", unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons. Where the risk is high, Article 34 adds a duty to tell the data subjects themselves. Article 33(5) requires every breach to be documented, including those that did not need notifying.

A processor that discovers a breach must inform the controller without undue delay under Article 33(2); the duty to notify the authority stays with the controller. For schools this is the practical point: most pupil data sit with suppliers, so the clock often starts with the supplier's message.

Questions and answers

Is losing access to data without anyone seeing it a personal data breach under the GDPR?

It can be. Article 4, point (12), of the GDPR covers a breach of security leading to the accidental or unlawful destruction or loss of personal data, not only disclosure. Encrypted files that a school can no longer open after a ransomware attack are an example.

How quickly must a personal data breach be notified under the GDPR?

Without undue delay and, where feasible, not later than 72 hours after the controller became aware of it, under Article 33(1) of the GDPR. Notification is not required where the breach is unlikely to result in a risk to the rights and freedoms of natural persons, but the breach must still be documented under Article 33(5).

Regulations

  • Normenkader Informatiebeveiliging en Privacy (Normenkader IBP)

    The Normenkader IBP is the Dutch framework of 69 information security and 25 privacy norms for primary, secondary and special education. Each school board must know where it stands by 1 January 2027 and meet maturity level 3 on every norm in 2030. It is a policy agreement, not an act.

    Next
    Every board knows its position against the Normenkader through a self-evaluation, and has a plan to meet all norms