Skip to main content
Home

What is a data breach?

Contents

A data breach could happen if your personal information is:

  • inappropriately accessed;
  • lost;
  • accidentally destroyed;
  • altered without permission;
  • damaged; or
  • disclosed to someone it shouldn’t have been. 

The organisation responsible for your personal information could do this accidentally, intentionally, or due to recklessness. This could have a negative impact on your livelihood and wellbeing. However, some data breaches won’t cause you harm beyond possible inconvenience.

Personal information is about who you are, where you live, what you do and more. It’s any and all information that identifies you. This could include:

  • your name and address;
  • photographs;
  • customer reference numbers;
  • medical information;
  • school reports; and
  • customer reviews.

If a document, file or image identifies you, or could be used in combination with other information to identify you, then it’s personal information. This applies even if the information doesn’t include your name.

However, it is only personal information if it relates to someone who’s alive. Data protection laws don’t apply after someone has died.

How could an organisation share, lose, access or disclose my information inappropriately?

Organisations should follow policies and procedures to protect your personal information. However, there are occasions when your information could be affected, this can include: 

  • an unauthorised person or organisation accessing it;
  • an incorrect recipient receiving it;
  • theft or loss of computers or mobile devices that contain it; and
  • someone altering or deleting it without the organisation’s permission.  

Examples

  • I made a hotel booking. On the day of my arrival, the hotel company sent an email about building maintenance work. They failed to use the bcc function, and I could see over 50 email addresses of guests also staying that day.
  • I had a grievance with someone at work. When my employer was investigating the complaint, they accidentally sent my information to the person I was complaining about. I’ve had to take time off work as the situation has worsened.
  • My adopted child’s school sent paperwork to their birth parents without removing my name. I only found out when the birth parents turned up at my home. I’ve had to move house to protect myself and my child.