A personal data breach is a security incident that leads to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to personal data. Whether it happens by accident or on purpose is irrelevant. A personal data breach must generally be reported to the competent supervisory authority within 72 hours.