Information which can be used to distinguish or trace an individual’s identity, such as their name, social security number, biometric records, etc. alone, or when combined with other personal or identifying information which is linked or linkable to a specific individual, such as date and place of birth, mother’s maiden name, etc.

PII is considered as sensitive if the loss, compromission, or disclosure without authorization of this data could result in harm, embarrassment, inconvenience, or unfairness to an individual. For instance, the following information is considered to be sensitive PII:

• Medical
• Educational
• Financial
• Employment information

PII violations are illegal, and often involve frauds such as identity theft. Violations may also stem from unauthorized access, use, or disclosure of PII. Failure to report a PII breach can also be a violation.

The GDPR in article 4 (link to: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679#d1e1374-1-1), defines personal data as follows:

“Personal data” shall mean any information relating to an identified or identifiable natural person (‘Data Subject’); an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his physical, physiological, mental, economic, cultural or social identity.

The following personal data are considered as special categories of personal data and are subject to specific processing conditions according to the Art. 9 of the GDPR (link to: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679#d1e1374-1-1):

• Personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs
• Trade-union membership
• Genetic data, biometric data processed solely to identify a human being
• Health-related data
• Data concerning a person’s sex life or sensitive data

When data that should be kept private gets in the wrong hands, bad things can happen. A data breach at a government agency can, for example, put top secret information in the hands of an enemy state. A breach at a corporation can put proprietary data in the hands of a competitor. A breach at a school could put students’ PII in the hands of criminals who could commit identity theft. A breach at a hospital or doctor’s office can put PHI in the hands of those who might misuse it.

Since May 2018, there’s a wave of new regional data privacy regulations in the aim to make our digital experiences safer and more secure.

• GDPR – Europe’s General Data Protection Regulations
• CCPA – California Consumer Privacy Act
• LGPD – Brazil’s Lei Geral de Proteção de Dados
• POPI – South Africa’s Protection of personal information

The cost of data breaches is rising rapidly, increasing 10% year-over-year according to the 2021 Cyber Security Ventures report (link to: https://1c7fab3im83f5gqiow2qqs2k-wpengine.netdna-ssl.com/wp-content/uploads/2021/01/Cyberwarfare-2021-Report.pdf). The global cost of cybercrime is also spiking and could reach $10.5 trillion per year by 2025. To put the rapidly rising cost of cyber threats in perspective, the annual cost was about $3 trillion in 2015.

Determining exactly how much a potential data breach could cost your business may be difficult, as every business and industry has unique exposures and risk factors. However, businesses can educate themselves regarding the factors that affect the cost of data breaches most and how these numbers change based on the industry and size of your business.