Near miss or breach?

Not every scare is a breach. A near miss is a security incident where personal data was put at risk but, on the facts, was not actually destroyed, lost, altered, disclosed, or accessed. The line matters because breaches carry legal duties, while near misses are "only" lessons to learn. But the line is thinner than people think, and the safe habit is the same for both: report it.

Examples of near misses

• You attach the wrong file, notice before pressing send, and remove it. No data left your control.
• A phishing email arrives and a colleague reports it without clicking anything or entering credentials.
• A door to a records room is found propped open overnight, but access logs and a check of the room show nobody entered.

Examples that are breaches, not near misses

• You send the wrong file and recall it, but recall fails or you cannot prove the recipient never opened it. Disclosure happened, or cannot be ruled out.
• A colleague enters their password on a phishing site, even if the account is locked down minutes later. Credentials were disclosed and access may have occurred.
• The propped-open door scenario, but there are no access logs, so nobody can say whether anyone entered. If you cannot rule out access, you assess it as a potential breach.

The honest test

The question is not "did anything bad probably happen?" It is "can we show that the destruction, loss, alteration, disclosure, or access did not happen?" Where you cannot show it, the incident is treated as a breach and assessed properly.

Why near misses still deserve a report

A near miss is free information. It shows you exactly where a control failed or nearly failed, at zero cost to any individual. Organisations that log and review near misses fix weaknesses before they become reportable incidents. So report near misses through the same route as breaches, and let the people who own breach response make the call. You lose nothing by reporting a near miss, and you may prevent the real thing.