Data breach vs privacy incident: what's the difference and does each one trigger notification?

People often use “data breach” and “privacy incident” interchangeably, but they describe different things. Understanding the distinction matters because notification obligations usually hinge on it.

Privacy incident: the broad category

A privacy incident is any event that may compromise the confidentiality, integrity, or availability of personal information, or that involves the mishandling of that information. This is an intentionally wide umbrella. It includes:

• An email containing personal data sent to the wrong recipient
• A lost or stolen laptop or unencrypted USB drive
• Records left accessible to staff who have no need to see them
• A misconfigured system that briefly exposed data

Many privacy incidents are caught and contained before any harm occurs. An incident is essentially a potential problem that must be assessed.

Data breach: a confirmed, narrower event

A data breach is a confirmed subset of privacy incidents in which personal information was actually accessed, acquired, disclosed, or used without authorization. Put simply: every breach is a privacy incident, but not every incident rises to the level of a breach. The difference usually comes down to assessment, did protected information truly leave authorized control, and is there a risk of harm to the people involved.

Does each one trigger notification?

Not automatically, and the rules vary by jurisdiction and sector.

• Privacy incidents generally trigger internal obligations first: report it, contain it, investigate, and document the assessment. Many incidents end here with no external notice required.
• Data breaches are far more likely to trigger external notification, to affected individuals and sometimes to regulators, depending on the type of data, the level of risk, and the applicable law. Federal agencies, healthcare entities, financial institutions, and organizations operating across states or countries each face different thresholds and timelines.

Because requirements differ, organizations should rely on a written incident-response procedure that defines how incidents are escalated, when a “breach” determination is made, and who decides whether notification is required. A risk-based assessment, consistent with frameworks such as the NIST Privacy Framework, drives that decision.

Sound recordkeeping supports all of this: knowing what personal data you hold, where it lives, and who can access it makes both assessment and notification far more reliable. Learn more at /topics/privacy-pii/.