Laws around the world impose strict data security obligations on organisations that process personal data, and in some cases require them to report data breaches to data protection authorities and individuals affected by the data breach. This article elaborates on what constitutes a personal data breach and what a data breach prevention and response strategy might look like. In particular, it considers the incident notification requirements under the new EU Directive on measures for a high common level of cybersecurity across the Union (NIS2), effective as of 16 January 2023, which significantly expands the categories of entities within the scope. With such an extension, a wide range of entities that did not fall under the former NIS Directive, will be subject to additional incident notifications.
