white_paper_on_data_protection_in_india_171127_final_v2

B. PERSONAL DATA BREACH NOTIFICATION
The aggregation of data in the hands of public and private entities leaves them vulnerable to
data breaches. Data breaches can take many forms including; hackers gaining access to data
through a malicious attack; lost, stolen, or temporary misplaced equipment; employee
negligence; and policy and/or system failure. It is important to identify these threats and
establish processes to deal with these breaches.
2.11 Issues and International Practices
(i)
Defining Data Breaches
While data breaches may occur in various forms, these breaches can be classified using the
fundamental principles of information security, i.e. confidentially, integrity and availability.
So, a personal data breach may be categorised as the following:
a. Confidentiality breach: Where there is an unauthorised or accidental disclosure of, or
access to, personal data.
b. Integrity breach: Where there is an unauthorised or accidental alteration of personal
data.
c. Availability breach: Where there is an accidental or unauthorised loss of access to, or
destruction of, personal data.
Based on the circumstances, a breach can concern confidentiality, availability and integrity of
personal data at the same time, as well as any combination of these. Whereas determining if
there has been a breach of confidentiality or integrity is relatively clear, whether there has
been an availability breach may be less obvious. Carefully defining personal data breach is
thus imperative.
The EU GDPR defines a ―personal data breach‖ as “a breach of security leading to the
accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to,
personal data transmitted, stored or otherwise processed”. 724 Article 29 Working Party
guidance on personal data breach notification notes that there is a difference between a
security incident and a personal data breach. 725 A personal data breach is essentially a subset
of a security incident. All personal data breaches are security incidents, not all security
incidents are necessarily personal data breaches. So, only a security incident that hampers the
security, confidentiality or integrity of personal data would result in a ‗personal data breach‘.
724 Article 4(12), EU GDPR.
725 Article 29 Data Protection Working Party, ‗Guidelines on Personal data breach notification under Regulation
2016/679‘, European Commission (3 October 2017), available at:
http://ec.europa.eu/newsroom/document.cfm?doc_id=47741, (last accessed 10 November 2017).
161