A GDPR breach is a personal data incident that affects the confidentiality, integrity, or availability of data protected by the EU General Data Protection Regulation. It is not limited to data theft: unauthorized deletion, alteration, loss, or exposure can also count if it creates risk for the people concerned.
This matters because many organizations must assess the incident quickly and, in some cases, notify the data protection authority and affected individuals. Security teams therefore need to determine what happened, which records were touched, whether access was authorized, and whether the event could harm rights and freedoms. In practice, a tool or AI agent that can modify live records without review may turn a technical failure into a GDPR breach, especially when write access is not tightly controlled. Strong logging, access separation, and rollback procedures help prove scope and support compliance decisions.