Data breach
A personal data breach is a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data, and under the GDPR it usually has to be reported within 72 hours.The definition is Article 4(12) of the GDPR. It covers more than hacking: an email sent to the wrong list, a lost laptop, a deleted database without a backup, or a misconfigured server that exposes files are all breaches.
Article 33 requires the controller to notify the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of the breach, unless it is unlikely to result in a risk to people's rights and freedoms. A late notification must explain the delay. A processor must tell its controller without undue delay. Every breach, notified or not, must be documented. Article 34 adds a duty to inform the affected people directly when the risk is high, except where the data was rendered unintelligible, for example by encryption, where later measures removed the high risk, or where individual notice would take disproportionate effort, in which case a public communication replaces it.
Websites have a specific exposure: third-party scripts. A compromised tag or library that runs on a checkout page can read what visitors type. The ICO fined British Airways £20 million in October 2020 after attackers used modified code on its website to divert customers' payment details in 2018. Reducing the scripts that run before consent, and knowing which ones a site loads through a cookie scanner, also reduces that attack surface. In California, section 1798.150 of the Civil Code gives consumers a private right of action for certain breaches.