/Glossary · Defined term
personal data breach
Defined in section 2(u) of the Act.
Act, section 2(u)
(u) “personal data breach” means any unauthorised processing of personal data or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to personal data, that compromises the confidentiality, integrity or availability of personal data;
The Digital Personal Data Protection Act defines a "personal data breach" as specific types of incidents that compromise the confidentiality, integrity, or availability of personal data. This definition is broad and covers two main categories of events. The first category is any "unauthorised processing" of personal data. Processing generally refers to operations performed on data, so any unauthorized action falls under this umbrella.
The second category covers a wide range of "accidental" events. These include the accidental disclosure, acquisition, sharing, use, alteration, destruction, or loss of access to personal data. This means a breach is not limited to malicious attacks or theft by outside parties. It equally applies to internal mistakes, such as accidentally deleting files, unintentionally sharing information with the wrong person, or losing access to a database.
However, an unauthorized or accidental event only becomes a "personal data breach" under the Act if it results in a specific outcome. The event must compromise the confidentiality, integrity, or availability of the personal data. Confidentiality means keeping data secret, integrity means keeping it accurate and unchanged, and availability means being able to access it when needed. If an incident compromises any of these three elements, it meets the definition of a personal data breach.
Key points
- A personal data breach includes any unauthorized processing of personal data [2(u)].
- It also covers accidental disclosure, acquisition, sharing, use, alteration, destruction, or loss of access to personal data [2(u)].
- To qualify as a breach, the event must compromise the confidentiality, integrity, or availability of the personal data [2(u)].
Common misreadings
- A reader might think a breach only involves data theft, but the text explicitly includes accidental destruction or loss of access.
- A reader might assume any accidental sharing is automatically a breach, but the text requires that the event actually compromises the data's confidentiality, integrity, or availability.
Interpretation prepared from the official text only, 9 September 2026. The official text above prevails.
/MYND · DPDP practice
Putting this into practice?
MYND runs DPDP compliance programmes for the data that flows through HR, payroll, finance and vendor operations: readiness assessments, consent and notice design, processor contracts and breach playbooks. Tell us what you are working on and a compliance lead will reply within one working day.