Personal data breach

GDPR Art. 4(12) defines the breach broadly: it covers confidentiality (a leak or unauthorised access), integrity (unauthorised alteration) and availability (loss or destruction, including ransomware that locks records). The LGPD uses the expression "security incident" (Arts. 46 and 48), and the ANPD regulation on incident reporting refers to confirmed adverse events affecting the same three properties.

Not every breach must be reported. Under the GDPR, the controller notifies the supervisory authority unless the breach is unlikely to result in a risk to people, and informs individuals when the risk is high. Under the LGPD, notice to the ANPD and to data subjects is due when the incident may cause relevant risk or damage. In both regimes the controller must document every breach, reported or not, and processors must alert the controller without undue delay.

Example: an employee sends a spreadsheet with customer health data to the wrong supplier. The team contains it, assesses the risk, records the facts and decides on notification. AI-related failures can overlap with breaches, as when a chatbot reveals another user's data.