How to Tell a Personal Data Breach From an Ordinary Security Incident
Not every security incident involving personal data is a breach in the statutory sense, and the distinction is drawn by a definition rather than by judgement. A personal data breach is defined in section 2 of the Digital Personal Data Protection Act, 2023, and the definition has a structure that repays being read element by element.
Step 1: Note That the Definition Is Already Operative
Section 2 came into force on publication of commencement notification G.S.R. 843(E) dated November 13, 2025, while the obligations that attach to a personal data breach have not commenced. The defined term exists now; the duties that use it do not.
That is not an idle observation. An incident occurring today can be classified against the statutory definition even though nothing in the Act requires anything to be done about it, and an organisation that has practised the classification will not be learning it for the first occasion on which it matters.
Step 2: Read the Definition as Two Routes and One Gate
Clause (u) of section 2 defines personal data breach as any unauthorised processing of personal data, or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to personal data, that compromises the confidentiality, integrity or availability of personal data.
Structurally there are two ways in and one condition that both must satisfy. The first route is unauthorised processing. The second is one of the named accidental events. Whichever route applies, the event must also compromise confidentiality, integrity or availability, and that requirement is the gate.
Step 3: Work Through the First Route, Unauthorised Processing
The first route does not require any accident. It requires processing that was not authorised, and processing is itself a defined term in section 2, so the content of this limb comes from that definition rather than from ordinary usage.
Two consequences follow. An entirely deliberate and competent operation can be a personal data breach if it was not authorised, which is how internal misuse falls inside the definition. And the question of what was authorised is answered by reference to the permission actually held, so the scope of that permission is worth being able to state.
Step 4: Work Through the Second Route, the Accidental List
The second route names accidental disclosure, acquisition, sharing, use, alteration, destruction and loss of access. The list is worth reading item by item, because it is wider than the mental picture most incident procedures are built around.
Disclosure and acquisition cover the case where personal data leaves. Alteration and destruction cover the case where it stays and is damaged. Loss of access covers the case where nothing leaves and nothing is damaged but the data can no longer be reached, which is why an availability event is inside this definition and not outside it.
Step 5: Apply the Gate
Both routes are subject to the requirement that the event compromises the confidentiality, integrity or availability of personal data. The three limbs correspond to the three ways the list in the previous step can bite, and the requirement is disjunctive, so any one of them is enough.
This is the element that keeps the definition from swallowing every irregularity. An accidental act that compromises none of the three is not within the definition, and that conclusion has to be reasoned on the facts rather than assumed because the incident felt minor.
One point of construction deserves to be flagged rather than glossed over. The qualifying words sit at the end of the clause, after the accidental list, so a reader could argue that they attach only to that list and not to the unauthorised processing limb. The natural reading, and the one to work from, is that they govern both routes, but an advice that depends on the point should say which reading it takes.
Step 6: Note What the Definition Does Not Require
The definition sets no threshold of harm, no minimum number of affected individuals, no requirement that anyone outside have seen the data, and no requirement of intent. It does not ask whether the data was encrypted, whether it was recovered, or whether the organisation was at fault.
Those matters may be relevant to other questions. They are not part of the test of whether a personal data breach has occurred, and importing them into the determination is the most common way of answering it wrongly.
Step 7: Run the Test on the Record, Not on the Narrative
Apply the definition to what the logs, the forensic findings and the contemporaneous notes actually establish. Where the facts are incomplete, say which element is unresolved rather than treating the whole question as open, because usually only one element is.
Personal data is itself defined in section 2 as any data about an individual who is identifiable by or in relation to such data, so whether what was affected is personal data at all is the element to settle first. The analysis is cheap once the facts are stated and impossible when they are not.
Step 8: Record the Determination, the Reasons and the Date
Write down the conclusion, the route and the element relied on, the facts it rests on and the date on which it was reached. A determination that an incident is not a personal data breach needs the same record as a determination that it is.
Facts in an incident move, and a classification made on Monday may be wrong by Thursday. A dated determination can be revisited and shown to have been reasonable when it was made; an undated one cannot be defended at all.
Common Pitfalls to Avoid
Treating the definition as future law: Section 2 came into force on publication of the commencement notification.
Requiring an accident: The first route is unauthorised processing, which needs no accident.
Reading processing in its ordinary sense: It is a defined term in section 2.
Thinking only about data leaving: The list includes alteration, destruction and loss of access.
Forgetting the qualifying condition: The event must compromise the confidentiality, integrity or availability of personal data.
Reading the three limbs cumulatively: The requirement is disjunctive, so any one of them suffices.
Importing a harm threshold: The definition sets no threshold of harm, no minimum number of individuals and no requirement of intent.
Leaving a negative determination unrecorded: A conclusion that there was no personal data breach needs the same record as the opposite conclusion.
Key Statutory Provisions
Section 2 of the Digital Personal Data Protection Act, 2023: Definitions. Clause (u) defines personal data breach as any unauthorised processing of personal data, or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to personal data, that compromises the confidentiality, integrity or availability of personal data. Clause (t) defines personal data as any data about an individual who is identifiable by or in relation to such data. Processing is also a defined term in the same section.
Commencement notification G.S.R. 843(E) dated November 13, 2025: Brings section 2 into force on publication, while the obligations in Chapter II commence eighteen months after publication.
Sources and References
Section 2 of the Digital Personal Data Protection Act, 2023, bare text
The definition of personal data breach, independent printing with its elements
Digital Personal Data Protection Act, 2023, Act No. 22 of 2023, Chapter I
Disclaimer: This article is for informational purposes only and does not constitute legal advice. Readers should consult a qualified legal professional for advice specific to their circumstances.
Comments