Skip to content

The GDPR’s Rules on Data Breaches: Analysing Their Rationales and Effects

Author: Zuiderveen Borgesius, F., Asghari, H., Bangma, N., & Hoepman, J.
Published in: SCRIPTed, 20(2), 352-382
Year: 2023
Type: Academic articles
DOI: 10.2218/scrip.20.2.2023.8979

The General Data Protection Regulation (GDPR) requires an organisation that suffers a data breach to notify the competent Data Protection Authority. The organisation must also inform the relevant individuals, when a data breach threatens their rights and freedoms. This paper focuses on the following question: given the goals of the GDPR’s data breach notification obligation, what are its strengths and weaknesses? We identify six goals of, or rationales for, the GDPR`s data breach notification obligation, and we assess the obligation in the light of those goals. We refer to insights from information security and economics, and present them in a reader-friendly way for lawyers. Our main conclusion is that the GDPR’s data breach rules are likely to contribute to the goals. For instance, the data breach notification obligation can nudge organisations towards better security; such an obligation enables regulators to perform their duties; and such an obligation improves transparency and accountability. However, the paper also warns that we should not have unrealistic expectations of the possibilities for people to protect their interests after a data breach notice. Likewise, we should not have high expectations of people switching to other service providers after receiving a data breach notification. Lastly, the paper calls for Data Protection Authorities to publish more information about reported data breaches. Such information can help to analyse security threats.

Visit publication
Download Publication


Connected HIIG researchers

Hadi Asghari, Dr.

Researcher: AI & Society Lab

  • Open Access
  • Transdisciplinary
  • Peer Reviewed

Explore current HIIG Activities

Research issues in focus

HIIG is currently working on exciting topics. Learn more about our interdisciplinary pioneering work in public discourse.