A data breach is a security incident in which personal data is accessed, disclosed, altered, or destroyed without authorization — through cyberattack, accidental exposure, or human error. Under GDPR Article 33, data controllers must notify their supervisory authority within 72 hours of a breach that risks individuals' rights. If high risk is likely, GDPR Article 34 requires direct notification to affected data subjects. Breaches are not limited to hacking — sharing a mailing list with the wrong recipient or losing an unencrypted device both qualify. Consent records maintained by a CMP can serve as audit evidence during breach investigations.