According to UK Data Protection Authority: > A personal data breach can be broadly defined as a security incident that has affected the confidentiality, integr

According to UK Data Protection Authority: > A personal data breach can be broadly defined as a security incident that has affected the confidentiality, integrity or availability of personal data. In short, there will be a personal data breach whenever any personal data is lost, destroyed, corrupted or disclosed; if someone accesses the data or passes it on without proper authorisation; or if the data is made unavailable, for example, when it has been encrypted by ransomware, or accidentally lost or destroyed. https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/personal-data-breaches/ https://ico.org.uk/for-organisations/guide-to-the-general-da... The wording around data breach is quite specific i.e. "security incident that has affected ...". They also give 6 examples: - access by an unauthorised third party; - deliberate or accidental action (or inaction) by a controller or processor; - sending personal data to an incorrect recipient; - computing devices containing personal data being lost or stolen; - alteration of personal data without permission; and - loss of availability of personal data. Quite obviously enforcing disclosing security vulnerabilities was not the main goal of the authority or they would mention it explicitly. Also, if they would want to process all security vulnerabilities they would need way, way more stuff. Just reporting CVEs (Common Vulnerabilities and Exposures) from products used by all companies would lead to hundreds of millions of reports. CVE list more than 100 000 vulnerabilities * all companies that use these products. Note that DPAs have issues with processing actual data breaches where numbers are in thousands.