Personal Data Protection Act 2012 · 2020 Revised Edition · Part 6A · Notification of Data Breaches
26B. Notifiable data breaches
Feedback & supportIn plain English
A data breach is notifiable if it causes, or is likely to cause, significant harm to an affected individual. It is also notifiable if it is, or is likely to be, of a significant scale. If personal data is accessed, used, disclosed, copied or modified without authority only within an organisation, the breach is treated as not notifiable.
Summary · Drafted with AI, checked against the official text on 30 Sep 2026.
Last amended by an amending law of 2020.
A data breach is a notifiable data breach if the data breach —
data breach
“data breach”, in relation to personal data, means —(a)the unauthorised access, collection, use, disclosure, copying, modification or disposal of personal data; or(b)the loss of any storage medium or device on which personal data is stored in circumstances where the unauthorised access, collection, use, disclosure, copying, modification or disposal of the personal data is likely to occur.
results in, or is likely to result in, significant harm to an affected individual; or
is, or is likely to be, of a significant scale.
Without limiting subsection (1)(a), a data breach is deemed to result in significant harm to an individual —
harm
“harm”, in relation to an individual, means —(a)any physical harm; or(b)harassment, alarm or distress caused to the individual;
if the data breach is in relation to any prescribed personal data or class of personal data relating to the individual; or
in other prescribed circumstances.
Without limiting subsection (1)(b), a data breach is deemed to be of a significant scale —
if the data breach affects not fewer than the prescribed number of affected individuals; or
in other prescribed circumstances.
Despite subsections (1), (2) and (3), a data breach that relates to the unauthorised access, collection, use, disclosure, copying or modification of personal data only within an organisation is deemed not to be a notifiable data breach.
personal data
“personal data” means data, whether true or not, about an individual who can be identified —(a)from that data; or(b)from that data and other information to which the organisation has or is likely to have access;