3.5Data breaches & penalties
The essentials in 30 seconds
- Breach = unauthorised destruction, loss, alteration or disclosure (hacking, theft, email to the wrong recipient, leak) — often through human error.
- If at risk: notify the authority (short deadline) and, if the risk is high, inform the individuals — never conceal.
- Potentially heavy penalties (high fines, sometimes a % of turnover per V2, injunctions) + reputational cost; good faith and cooperation count.
Running mini-case — Yacine handles his leak without hiding it
Yacine discovers that a customer file was sent to the wrong recipient. Instead of hiding it, he contains it (access cut, password changed), documents the facts, assesses the risk to people and checks his notification duties under his country's rules. Then he fixes the cause: limited access, awareness-raising, less data kept.
Final episode of cases 3.1-3.4 — Yacine moves from prevention to response.
1. The data breach
A data breach is an incident leading to the destruction, loss, alteration or unauthorised disclosure of data (hacking, theft, email to the wrong recipient, database mistakenly made accessible, leak). Many result from human error, not just hackers.
Where there is a risk to individuals: often a duty to notify the authority (short deadline) and, if the risk is high, to inform the individuals. Concealing or delaying makes things worse.
2. Penalties, kept in proportion
Breaches can lead to high fines (sometimes a % of turnover), injunctions, compensation claims, and above all a reputational cost often greater than the fine itself.
But authorities take into account seriousness, good faith, the measures in place and cooperation: prevention and a proper response protect you.
3. Prevent rather than suffer
Secure access, keep backups, raise awareness, minimise data: less data, less risk.
Prepare your response reflex in advance and keep your compliance up to date (register, bases, information): it is the best protection.
🔎 Concrete example — 🔎 Practical example — Proportion for an SME
Proportionate prevention.
Record fines → major players, massive breaches.
SME acting in good faith that made efforts, responds, notifies, cooperates → treated differently.
→ preventing (security, minimisation) and responding fast protect against most of the risk.Result: a prevention mindset with a fast response.
Reflex: never conceal a breach.
Section vocabulary
- Data breach
- An incident leading to the destruction, loss, alteration or unauthorised disclosure of personal data (hacking, theft, error, leak).
Simple example: Yacine's customer file sent to the wrong recipient.
What it is not: a simple outage with no data impact.
Reflex: contain, document, assess the risk.
- Notification
- The duty, in the event of a risky breach, to inform the authority (often within a short deadline) and sometimes the individuals concerned.
Simple example: Yacine checks his country's rules and notifies promptly.
What it is not: concealing in the hope nobody notices.
Reflex: check the applicable deadline before the crisis.
- Administrative fine
- A financial penalty from the data-protection authority; it can be very high (sometimes a percentage of turnover) for serious breaches.
Simple example: Record fines targeting negligent large players.
What it is not: an automatic flat rate for every SME.
Reflex: prevent and cooperate: it shapes the penalty.
- Reputational cost
- Loss of trust and damage to image after a leak or a breach; often greater than the fine itself.
Simple example: Yacine's customers doubting after a hidden leak.
What it is not: a simple accounting line.
Reflex: transparency protects trust.
- Assessment factors
- Elements taken into account by the authority (seriousness, good faith, measures in place, cooperation) which shape the penalty.
Simple example: Yacine's efforts and fast response count in his favour.
What it is not: a blind scale with no context.
Reflex: document efforts and response from the start.
In practice — In practice — Preventing breaches and knowing how to respond
- Prevent: secure access, keep backups, raise awareness, and minimise the data you hold (less data = less risk).
- Prepare a response reflex: if an incident occurs, act fast, document the facts, assess the risk to individuals.
- Meet your country's notification duties (authority, and individuals if the risk is high) without concealment or delay.
- Keep your compliance up to date (register, bases, information) — the best protection against both incidents AND penalties; seek advice if the incident is serious.
Ready-to-say script — launching the incident response (30 s)
'First we contain: we cut off access and change passwords. Then we note everything: what, when, which data, how many people. Then we assess the risk and check whether we must notify. Nobody hides anything.'
Say it to the team as soon as discovered: contain, document, assess, notify.
Copy-paste template — incident sheet
DISCOVERED ON: _______________ BY: _______________
FACTS (what, how, since when): _______________
DATA / PEOPLE: _______________ | RISK: _______________
MEASURES (contain): _______________
NOTIFICATION (authority / individuals, local deadline): _______________
FIXED CAUSE: _______________VSE / small budget
With no security officer: unique passwords, two-factor authentication, regular backups and an access spreadsheet cut most of the risk.
SME in Algiers
Yacine identifies in advance his country's authority and deadlines (Law 18-07): in a crisis, there is no time to discover everything.
Sending error
Email to the wrong recipient: recall the message, ask for deletion, change the link if possible — then document and assess.
Serious incident
Wide leak or sensitive data: contain, erase no traces, get help (lawyer, provider) and notify under the rules.
✓ Best practices
- Prevent: security, backups, awareness-raising, minimisation.
- If an incident occurs, act fast, document, assess the risk.
- Notify under your country's rules, without concealment or delay.
✗ Common pitfalls
- Concealing a leak (often the worst choice, legally and reputationally).
- Responding late or underestimating the incident.
- Believing negligence costs a small organisation nothing.
Key takeaways
- A data breach (hacking, theft, error, leak) often triggers a duty to NOTIFY the authority (short deadline) and sometimes the individuals.
- Penalties can be heavy (high fines, sometimes a % of turnover, injunctions, compensation) and the REPUTATIONAL cost often exceeds the fine.
- Authorities take into account seriousness, good faith, measures in place and cooperation: prevention and a proper response protect you.
- The key = prevent (security, minimisation) and prepare to respond fast and without concealment; duties, deadlines and amounts vary by country.
48h challenge — apply it tomorrow
Check 3 access rights (who sees what), enable two-factor authentication and write your incident reflex in 4 lines (contain, document, assess, notify).
- I can define a data breach.
- My incident reflex fits in 4 lines.
- I cut 3 unnecessary access rights this week.
Frequently asked questions
What to do in the first hours of a leak?
Act fast, without panicking or concealing: 1) contain (cut off access, change passwords, isolate, recover the mistaken sending); 2) assess (which data, sensitivity, how many people, since when); 3) document from the outset (a log); 4) check notification duties (often a short deadline); 5) get help if significant; 6) inform individuals accurately if required; 7) fix the cause. Identify your country's regime in advance.
Can huge fines hit a small business?
Record amounts almost always target very large players and serious breaches — they are maximums for the worst cases, not everyone's tariff. Authorities scale by seriousness, sensitivity, good faith, measures and cooperation; for a good-faith SME that responds, support or an injunction is often preferred. But an SME can be penalised for a characterised breach (ignoring everything, concealing), and even a moderate fine hurts. Proportionate prevention at this level protects against most of it.
What should you do after a risky data breach?