An incident in which sensitive, protected, or confidential information is accessed, stolen, or disclosed without authorization.
Data breaches can result from cyberattacks, such as ransomware or stolen passwords, but also from mistakes, such as a misconfigured cloud storage bucket, an email sent to the wrong person, or a lost laptop without encryption. Exposed data may include customer names, contact details, payment information, health records, or business secrets.
Many laws require organizations to notify regulators and affected people within set time frames. Under the GDPR, for example, a reportable personal data breach must generally be reported to the supervisory authority within 72 hours of becoming aware of it. A breach at a small online retailer might expose customer addresses and order histories, leading to phishing attempts against those customers. Preparation includes encryption, access controls, backups, an incident response plan, and knowing which notification rules apply.
Tools and policies, known as DLP, that detect and stop sensitive data from being shared, leaked, or moved outside approved channels.
GDPRGeneral Data Protection Regulation: the European Union's law governing how organizations collect, use, and protect personal data.
HIPAAThe Health Insurance Portability and Accountability Act, a 1996 US law that sets rules for protecting the privacy and security of health information.
Incident ResponseAn organization's structured process for detecting, containing, investigating, and recovering from security incidents.
Personally Identifiable InformationAny information that can identify a specific person, alone or combined with other data, such as a name, email, or ID number.
Parent apps, digital check-in, autopay tuition and real-time ratio tracking are reshaping daycare. Here is what center owners should adopt first, what parents will notice and how to protect children's data.
Every comprehensive US state consumer privacy law in effect or enacted as of October 2026, with effective dates, thresholds, key rights and official sources.
An hour-by-hour checklist for the first 24 hours after a cyberattack: containment, evidence, who to call, notification and safe recovery.