Concept
A personal data breach is any unauthorised or accidental event that compromises the confidentiality, integrity or availability of personal data.
"personal data breach" means any unauthorised processing of personal data or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to personal data, that compromises the confidentiality, integrity or availability of personal data.
A breach is not only a hack. Accidental disclosure, loss of access, or unauthorised alteration all count if they compromise the data.
The definition maps to the classic security triad: confidentiality (who can see it), integrity (whether it is accurate and intact), and availability (whether you can reach it).
Emailing a spreadsheet of customers to the wrong recipient is a breach, even though no attacker was involved.
Is a ransomware lockout a breach?
Yes. Loss of access that compromises availability falls within the definition.
Does a breach have to be malicious?
No. Accidental disclosure or loss is expressly included.