Data Breach vs Cyber Incident: What’s the Difference?

“We’ve had a breach.” It is one of the most over-used and misunderstood phrases in cyber security, and the confusion it causes is expensive. A blocked phishing email gets treated as a crisis. A genuine data theft gets brushed off as “just an IT thing”. Getting the words right is not pedantry, it decides whether a legal clock starts ticking and who you have to tell.

This guide untangles the terms every UK business should understand: event, alert, incident, breach and personal data breach. It is a companion to our full cyber incident response plan guide.

The ladder, from harmless to serious

The key move up the ladder is from “incident” to “personal data breach”, because that is where the law gets involved.

Cyber incident: the broad category

A cyber incident is any event that may harm the confidentiality, integrity or availability of your systems or data, or that breaches your security policy. It does not have to involve a clever attacker or any personal data at all. A server that goes down, a malware infection on one laptop, a denial-of-service attack, or a member of staff emailing the wrong file, are all incidents. Most incidents are handled entirely in-house and never trouble a regulator.

Personal data breach: the narrower, regulated one

A personal data breach is a specific kind of breach: one that leads to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. In plain terms, information about identifiable people was lost, exposed, altered or accessed when it should not have been. This is the category that can carry a duty to report to the Information Commissioner’s Office (ICO), and sometimes to tell the affected people.

Not every breach is reportable

Here is the part that trips people up. Even a genuine personal data breach does not automatically have to be reported. Under UK GDPR, you must notify the ICO only where the breach is likely to result in a risk to people’s rights and freedoms. Many minor breaches do not meet that threshold. Where the risk to individuals is high, you also have to inform the affected people without undue delay.

Two things matter regardless of whether you report:

• You must record every personal data breach and your reasoning, including why you decided a particular breach was not notifiable.
• Where you do report, you have 72 hours from becoming aware to notify the ICO where feasible. You are not expected to know everything by then; the approach is to report what you know and update later.

This is practical guidance, not legal advice. The regulatory position can change, so check the current ICO guidance and take professional advice for your circumstances. Our ICO registration guide covers the wider data-protection basics.

Worked examples

Why the distinction matters in practice

Getting this right changes three things: whether a legal clock starts, who you have to tell, and how you record your decision. Treating everything as a reportable breach wastes time and can cause needless alarm; treating a real personal data breach as “just IT” can land you in regulatory trouble. The middle path is to assess each incident properly and write down your reasoning. The free Cyber Incident Response Toolkit includes a personal data breach assessment form that walks you through exactly this decision.

Frequently asked questions

Related reading: the full Cyber Incident Response Plan guide, what to tell customers after an incident, and the free Cyber Incident Response Toolkit.