An incident which leads to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access to personal data.