Personal Data Protection Act 2012 · 2020 Revised Edition · Part 6A · Notification of Data Breaches
26A. Interpretation of this Part
Feedback & supportIn plain English
In this Part, an affected individual is someone whose personal data is affected by a data breach. A data breach is when personal data is accessed, collected, used, disclosed, copied, changed or disposed of without authority. It also covers the loss of a device or storage medium holding personal data, where such unauthorised handling is likely.
Summary · Drafted with AI, checked against the official text on 30 Sep 2026.
Last amended by an amending law of 2020.
In this Part, unless the context otherwise requires —“affected individual” means any individual to whom any personal data affected by a data breach relates;“data breach”, in relation to personal data, means —
the unauthorised access, collection, use, disclosure, copying, modification or disposal of personal data; or
personal data
“personal data” means data, whether true or not, about an individual who can be identified —(a)from that data; or(b)from that data and other information to which the organisation has or is likely to have access;
the loss of any storage medium or device on which personal data is stored in circumstances where the unauthorised access, collection, use, disclosure, copying, modification or disposal of the personal data is likely to occur.
loss
“loss” means —(a)a loss in property or a supply of services, whether temporary or permanent; or(b)a loss of an opportunity to earn remuneration or greater remuneration or to gain a financial advantage otherwise than by way of remuneration,but excludes, in relation to an individual, the loss of personal data about the individual;
“affected individual” means any individual to whom any personal data affected by a data breach relates;
“data breach”, in relation to personal data, means —
the unauthorised access, collection, use, disclosure, copying, modification or disposal of personal data; or
the loss of any storage medium or device on which personal data is stored in circumstances where the unauthorised access, collection, use, disclosure, copying, modification or disposal of the personal data is likely to occur.