A business example
An employee emails a customer spreadsheet to the wrong external recipient.
Event
Personal information leaves the intended recipient group.
Initial response
The business preserves facts, limits further exposure where possible and investigates.
Assessment
It evaluates affected information, consequences and the applicable response requirements.
What this shows
A breach can begin with an ordinary sending error. The response should follow the facts rather than assuming only hacking incidents count.
What it is often confused with
A breach can involve accidental disclosure or loss, not only a deliberate hacker attack.
What to look at in your business
Preserve incident facts and assess the applicable response framework promptly.
Context and further reading
MeitY: Digital Personal Data Protection Act, 2023. This reference supports the terminology; use the linked guide for applicability and operative requirements.
Kosha.Services · Updated 2 October 2026