Cybersecurity incident or personal data breach? How to tell them apart in law

The article examines the essential legal differences between the notions of cybersecurity incident and personal data breach, in the light of the applicable European and national regulatory framework. The analysis compares the provisions of O.U.G. nr. 155/2024, which transposes Directive (EU) 2022/2555 (NIS2), with those of Regulation (EU) 2016/679 (GDPR), highlighting the points of convergence and the distinctions between them. It sets out the criteria for drawing the line, the notification obligations, the institutional responsibilities and the legal consequences. The article aims to provide a practical guide for companies in Romania that must decide quickly whom to notify of an incident - DNSC or ANSPDCP.

In a global context marked by the accelerated digitalisation of public and private services and by an increase in cyberattacks, the legal distinction between a cybersecurity incident and a personal data breach takes on particular importance. After a ransomware attack or unauthorised access, the key question becomes: are we dealing with a technical incident or a GDPR breach? Although the two concepts are often used interchangeably in everyday language, they belong to distinct legal regimes and give rise to different legal obligations.

1. The regulatory framework and the legal interest protected

On the one hand, Ordonanța de urgență a Guvernului nr. 155/2024 (Government Emergency Ordinance no. 155/2024) on the cybersecurity of the national civil cyberspace transposes Directive (EU) 2022/2555 (NIS2), imposing obligations on public and private entities to implement technical and organisational measures designed to ensure the resilience of IT systems.

On the other hand, Regulation (EU) 2016/679 (GDPR) establishes the legal framework for the protection of natural persons with regard to the processing of personal data, imposing strict rules on the security of processing, the notification of breaches and the protection of data subjects' rights.

Although both instruments seek to protect the integrity, confidentiality and availability of information, the legal purpose and the protected entity differ significantly. O.U.G. nr. 155/2024 protects the functioning of IT systems, whereas the GDPR protects the individual.

2. Legal definitions and the criteria for distinguishing them

From the perspective of the applicable regulatory framework, under art. 2 of O.U.G. nr. 155/2024, a cybersecurity incident is any event which affects or is liable to affect the confidentiality, integrity or availability of networks and IT systems, whether or not it involves personal data. The instrument requires the entities concerned to report promptly to the Directoratul Național de Securitate Cibernetică (National Cyber Security Directorate - DNSC), within 24 hours for an early warning and 72 hours for the full report.

In parallel, Articles 32–34 GDPR define a personal data breach as a breach leading to the destruction, loss, alteration, unauthorised disclosure of, or unauthorised access to, the personal data processed. Under art. 33(1) GDPR, notification to the Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (National Supervisory Authority for Personal Data Processing - ANSPDCP) must be made without undue delay and, where feasible, not later than 72 hours after becoming aware of it.

A cyber incident therefore has a general technological dimension, whereas a personal data breach has a specific legal dimension, related to the rights of the data subjects.

The decisive element distinguishing the two situations is the nature of the information affected. If the incident concerns the IT infrastructure (for example, a DDoS attack, a malware infection, a technical failure) without involving personal data, it falls within the scope of cybersecurity incidents governed by O.U.G. nr. 155/2024. If the event affects data by which a natural person can be identified, directly or indirectly, we are dealing with a personal data breach, governed by the GDPR.

Consequently, not every cyber incident amounts to a personal data breach, but every personal data breach is, by its very nature, an IT incident. The two regimes partly overlap, but they are not equivalent.

Consequently, not every cyber incident amounts to a GDPR breach, but every GDPR breach is, in essence, also an IT incident.

3. Notification obligations and institutional competences

The notification obligations, as well as institutional competence, are likewise distinct. In the case of a cybersecurity incident, essential and important entities (for example, providers of digital infrastructure, communications, energy, transport or healthcare services) must report the event to the DNSC, using the Platforma Națională pentru Raportarea Incidentelor de Securitate Cibernetică (National Platform for Reporting Cybersecurity Incidents - PNRISC). The purpose of the notification is to enable the response to be coordinated at national level and to prevent the attack from spreading.

By contrast, in the case of a personal data breach, the controller is required to notify the ANSPDCP under art. 33 GDPR and, where appropriate, to inform the data subjects under art. 34 GDPR.

In practice, three situations can be distinguished:

• a cyber incident not involving personal data - notification to the DNSC alone;

• a cyber incident which also affects personal data - simultaneous notification to the DNSC and the ANSPDCP;

• a stand-alone personal data breach - notification to the ANSPDCP only.

Art. 62 para. (2) of OUG 155/2024 (Government Emergency Ordinance no. 155/2024) strengthens institutional cooperation: DNSC does not impose penalties for conduct falling within the scope of the GDPR where ANSPDCP is already conducting an investigation, thereby preventing double sanctioning.

4. Responsibilities and penalties

Both the GDPR and O.U.G. no. 155/2024 require controllers and public or private entities to implement technical and organisational measures proportionate to the risks identified.

Under Art. 32 GDPR, the controller must ensure the confidentiality, integrity and availability of personal data, including through pseudonymisation, encryption and regular testing of systems.

Similarly, Chapter III of O.U.G. no. 155/2024 imposes security measures applicable to the entire IT system, such as technology risk management, supply chain protection and periodic auditing of the infrastructure.

Under both regimes, the management bodies of the entities concerned are personally responsible for implementing these measures, and the appointment of a person responsible for security (for example, an IT Security Officer or a Data Protection Officer - DPO) is mandatory.

That said, failure to comply with reporting and security obligations carries different legal consequences. Under Art. 83 para. (4) GDPR, breaches of the data security provisions (Art. 32–34) are punishable by administrative fines of up to EUR 10,000,000 or 2% of total worldwide annual turnover.

In parallel, O.U.G. no. 155/2024 provides for administrative penalties and corrective measures, including temporary suspension of IT operations, while in serious cases the criminal provisions of Legea nr. 161/2003 (Law no. 161/2003) on computer-related offences may apply.

In addition, Art. 77 GDPR grants the data subject the right to lodge a complaint with the supervisory authority, guaranteeing access to an effective administrative remedy - a mechanism currently absent from the cybersecurity incident regime.

For controllers, the major risk is not only the fine, but also operational paralysis - the temporary suspension of IT activities by DNSC.

5. Practical conclusions: towards integrated governance

The legal distinction between a cybersecurity incident and a personal data breach has significant implications for organisational responsibility and institutional coordination. While the former concerns the protection of IT infrastructure and digital resilience, the latter protects the dignity and private life of the individual.

To avoid penalties, companies should adopt a two-stage internal triage procedure:

technical assessment - to establish the impact on the IT infrastructure;
legal assessment - to determine whether personal data are involved and what notification obligations arise.

In a world where the boundaries between technology and personal life are blurring, these two regimes should be seen as parts of a single system of integrated data and cybersecurity governance, built on active cooperation between DNSC and ANSPDCP. By aligning itself with European standards, Romania is thus building a двойную... двух-line defence: a technological one, based on resilience and prevention, and a legal one, centred on the protection of the individual and their data.

In 2025, institutional maturity is measured by the ability of authorities and companies to respond in a coordinated, swift and proportionate manner to emerging digital risks - where law and technology meet.