05 Sep '25
A misdirected email, a forgotten update or a targeted cyber attack; data breaches and other cybersecurity incidents are unfortunately an inevitable part of the digital age. The consequences can be significant. It is therefore crucial to act quickly and carefully. But what exactly qualifies as a data breach or cyber incident, how can you prevent it, and what should you do if the damage has already been done?
In this blog, we will consider the question of what a data breach is and provide a step-by-step plan entitled 'First aid for data breaches & cyber incidents'. In our next blogs, we will look at cyber incidents in general, the obligation to report data breaches and cyber incidents, and we will examine in more detail whether and how such incidents can be prevented.
According to the EU General Data Protection Regulation (GDPR), a data breach is defined as a 'personal data breach'. This means that personal data has been lost, destroyed or altered as a result of a breach of security, that unauthorised access has been gained to it or that it has been disclosed without authorisation. This does not necessarily have to be done with malicious intent. Even an email in which the recipients are accidentally included in the cc instead of the bcc can constitute a data breach.
Data breaches can be roughly divided into three categories:
A data breach is often a cyber incident, but not every cyber incident is also a data breach. A data breach must usually be reported to the Data Protection Authority, but not always. Data subjects only need to be informed if there is a high risk to them. Other parties must be informed in accordance with the contractual agreements that have been made.
The consequences of an incident are often significant. For example, services or products may become inaccessible, such as electronic patient records that cannot be consulted. Sensitive data may also be exposed, as was recently the case with the data breach at the laboratory for cervical cancer screening.
Organisations may also face reduced customer confidence, reputational damage and high recovery costs. Those affected may suffer reputational damage and identity fraud. If it appears that the GDPR has been violated, those affected who have suffered damage can claim compensation and the Data Protection Authority can issue a warning or impose a fine.
What should you do if something goes wrong? It is not always possible to prevent a data breach or other cyber incident. To help organisations, we have drawn up a practical step-by-step plan entitled 'First aid for data breaches & cyber incidents'. This step-by-step plan consists of the following steps:
We will explain this step-by-step plan in more detail in our next blogs.
For a number of tips, see our previously published blog: Data breaches in practice: three tips | Ploum.
Looking for more information about data breaches or other cyber incidents? Feel free to contact one of our lawyers if you have any questions about the step-by-step plan or if your organisation needs support.
26 Nov 25
24 Nov 25
05 Nov 25
23 Oct 25
21 Oct 25
13 Oct 25
01 Oct 25
22 Sep 25
16 Sep 25
05 Sep 25
01 Sep 25
18 Aug 25
Met uw inschrijving blijft u op de hoogte van de laatste juridische ontwikkelingen op dit gebied. Vul hieronder uw gegevens in om per e-mail op te hoogte te blijven.
Stay up to date with the latest legal developments in your sector. Fill in your personal details below to receive invitations to events and legal updates that matches your interest.
Follow what you find interesting
Receive recommendations based on your interests
{phrase:advantage_3}
{phrase:advantage_4}
We ask for your first name and last name so we can use this information when you register for a Ploum event or a Ploum academy.
A password will automatically be created for you. As soon as your account has been created you will receive this password in a welcome e-mail. You can use it to log in immediately. If you wish, you can also change this password yourself via the password forgotten function.
