Skip to main content
Readiness Authority
Category: Regulatory & Privacy Compliance

Breach of Confidentiality

Also known as: Confidentiality Breach
Simply put

A breach of confidentiality happens when private information is disclosed to a third party without the consent of the person or entity it belongs to. It can occur accidentally or deliberately, and it violates the trust or legal obligations that require the information to be kept private. In some settings, such as healthcare, breaking confidentiality may be justified only in narrow circumstances, for example a severe threat to a patient or others or a legal mandate.

Formal definition

A breach of confidentiality is the unauthorized disclosure of private or sensitive information to a third party in violation of a duty of confidentiality arising from trust, contract, professional obligation, or law. The applicable duty and the conditions under which disclosure is permissible vary by jurisdiction and context; in clinical practice, for example, disclosures may be justified only in specific circumstances such as a severe threat to the patient or others or a legal mandate, and even minor breaches can arise from failure to properly safeguard or handle sensitive data. In a cyber insurance context, such breaches are generally relevant to third-party (liability) exposures rather than first-party loss, since they concern harm to others whose information was disclosed; however, whether any resulting claim, regulatory defense, or associated cost is covered depends on the specific policy wording, endorsements, exclusions, conditions, and applicable law. This entry addresses the confidentiality-breach concept generally and does not itself define the scope of any particular insuring agreement.

Why it matters

Breach of confidentiality sits at the heart of third-party (liability) exposure in cyber and professional risk, because it concerns harm to the people or entities whose information was disclosed rather than the insured's own direct losses. When private information is shared without consent, the affected party may pursue a claim grounded in violated trust, contract, professional duty, or law. For risk managers and brokers, the key point is that these are liability-side exposures: they can drive privacy claims, regulatory scrutiny, and defense costs, all of which are treated differently from first-party items such as data restoration or business interruption.

The duty of confidentiality and the narrow circumstances in which disclosure is permissible vary considerably by context and jurisdiction. In clinical settings, for example, breaking confidentiality may be justified only in specific situations such as a severe threat to the patient or others, or a legal mandate. Even seemingly minor lapses matter: mishandling or failing to properly safeguard sensitive data can itself constitute a breach. This means organizations face exposure not only from deliberate misuse but from routine handling failures, which broadens the range of scenarios underwriters and compliance teams must consider.

Because confidentiality duties are defined differently across regulatory regimes and professional standards, whether any resulting claim, regulatory defense, or associated cost is covered depends entirely on the specific policy wording, endorsements, exclusions, and applicable law. A confidentiality breach does not automatically translate into a covered loss; conversely, obtaining insurance does not reduce the likelihood of such a breach occurring. Risk transfer through a policy addresses financial consequences, not the underlying duty of care, which remains a matter for mitigation and governance.

Who it's relevant to

Insurance brokers and underwriters
Confidentiality breaches typically implicate third-party liability exposures such as privacy claims and regulatory defense, which must be distinguished from first-party items like data restoration. When assessing or placing coverage, they need to consider how policy wording, endorsements, exclusions, and conditions determine whether a resulting claim or defense cost is covered, and to recognize that duties differ across jurisdictions and professional contexts.
Chief information security officers and data handlers
Because even minor breaches can arise from failure to properly safeguard or handle sensitive data, security leaders play a central role in mitigation, reducing the likelihood of unauthorized disclosure through controls and handling practices. Insurance does not reduce that likelihood or by itself constitute resilience, so preventive safeguards remain distinct from and complementary to any risk transfer.
Legal and compliance professionals
The duty of confidentiality and the narrow circumstances permitting disclosure vary by jurisdiction and context, for example, disclosure in clinical practice may be justified only where there is a severe threat to the patient or others or a legal mandate. These professionals assess when disclosure is lawful, when it constitutes a breach, and how regulatory regimes define the applicable obligations.
Risk managers and resilience planners
They need to treat confidentiality breaches as a liability-side exposure that risk transfer addresses only at the financial-consequence level. Managing this risk involves distinguishing mitigation and avoidance (preventing disclosure) from transfer (insuring against its consequences), while recognizing that whether costs are recoverable depends on the specific policy and applicable law.

Inside Breach of Confidentiality

Underlying Legal Duty
Breach of confidentiality involves the failure to protect information that a party is obligated to keep private, whether that obligation arises from contract, common law duties, professional relationships, or statute. The specific source of the duty shapes both the liability exposure and how any related insurance coverage may respond.
Third-Party Liability Character
In a cyber insurance context, breach of confidentiality typically implicates third-party coverage, meaning liability the insured owes to others (such as individuals or organizations whose confidential information was disclosed), rather than first-party coverage for the insured's own losses. Whether a given claim falls within privacy liability, media liability, or another insuring agreement depends on the specific policy wording.
Confidential Information Scope
The concept spans different categories of protected information, which may include personally identifiable information, trade secrets, protected health information, or contractually designated confidential data. The category involved affects which duties apply and which policy definitions and sublimits may be triggered, subject to the specific wording.
Coverage Conditionality
Whether a breach of confidentiality claim is covered depends on policy definitions of 'confidential information' and 'wrongful act,' applicable endorsements, exclusions (such as those addressing intentional acts or contractual liability assumed beyond common law), conditions precedent, and jurisdiction. Coverage cannot be assumed from the mere fact that confidentiality was breached.
Distinction from Security Failure
A breach of confidentiality is a legal and liability concept describing the wrongful disclosure of protected information; it is not itself a security control or resilience metric. A confidentiality breach can occur through means unrelated to a technical compromise, such as human error or unauthorized internal access.

Common questions

Answers to the questions practitioners most commonly ask about Breach of Confidentiality.

Is breach of confidentiality the same as a data breach?
No. A data breach typically refers to a security incident in which information is accessed, exfiltrated, or exposed without authorization. Breach of confidentiality is a broader legal and contractual concept: it describes the wrongful disclosure of information that a party was obligated to keep confidential, whether that obligation arose from a contract, a professional duty, or a statutory duty. A data breach may give rise to a breach of confidentiality claim, but a breach of confidentiality can also occur without any technical security failure, for example, through a deliberate or negligent disclosure by an authorized person. The two terms are not interchangeable, and coverage analysis should identify which is actually at issue.
Does breach of confidentiality automatically fall under first-party cyber coverage?
Not typically. Liability arising from a breach of confidentiality, that is, claims brought by others whose information was wrongfully disclosed, is generally analyzed under third-party coverage, such as privacy liability, rather than first-party coverage for the insured's own losses. First-party coverage responds to the insured's direct costs (for example, data restoration or business interruption), while third-party coverage responds to liability owed to affected parties. Whether any particular claim is covered depends on the specific policy wording, applicable endorsements, exclusions, and the jurisdiction, so the mere label 'breach of confidentiality' does not determine which coverage part, if any, applies.
How can we tell whether a confidentiality obligation is contractual or statutory, and why does it matter for coverage?
Review the source of the duty: a contractual confidentiality obligation arises from agreements such as non-disclosure agreements or service contracts, while a statutory or regulatory duty arises from applicable law. The distinction matters because many liability policies contain exclusions or conditions that treat contractually assumed liability differently from liability imposed by law. Some forms limit coverage for liability the insured assumed under contract, subject to carve-backs. Because these provisions vary by insurer form and jurisdiction, the specific policy wording should be read alongside the underlying obligation to assess how, or whether, a claim would respond.
What documentation supports a breach of confidentiality claim under a liability policy?
Insurers typically expect records that establish the existence of a confidentiality obligation, the nature of the disclosure, and the resulting claim. This can include the relevant contracts or policies imposing the duty, evidence of what information was disclosed and to whom, timelines of the incident, notice of claim or circumstance, and correspondence with affected or claiming parties. Prompt notice is often a condition precedent to coverage in many policies, so documenting when the insured first became aware of the disclosure or claim is important. The precise requirements depend on the policy's conditions and should be confirmed against the specific wording.
How should a breach of confidentiality be handled in incident response versus crisis management?
These are distinct functions and should not be treated as interchangeable. Incident response addresses the operational and technical steps of identifying, containing, and remediating the disclosure and preserving evidence. Crisis management addresses broader organizational impacts, such as stakeholder communications, reputational considerations, and executive decision-making. A breach of confidentiality may also trigger legal and notification workflows separate from both. Coordinating these streams, while keeping privileged legal analysis appropriately protected, helps ensure that response activities support, rather than complicate, any later coverage claim. How insurer-appointed vendors or panel counsel fit into this depends on the policy terms.
Does purchasing liability coverage for breach of confidentiality reduce the likelihood of one occurring?
No. Insurance is a mechanism of risk transfer: it may fund defense costs and covered liability after a wrongful disclosure, subject to the policy terms, but it does not reduce the probability of a breach and does not by itself constitute resilience. Reducing likelihood requires risk mitigation, such as access controls, confidentiality training, contractual safeguards, and data handling procedures, which operates independently of the coverage decision. Effective programs generally treat insurance and mitigation as complementary, using controls to lower the chance and severity of a disclosure while relying on coverage to address residual financial exposure.

Common misconceptions

Breach of confidentiality is the same thing as a data breach or a cybersecurity incident.
They overlap but are not identical. A data breach commonly refers to unauthorized access to or acquisition of data, often through a security compromise, while breach of confidentiality is a liability concept centered on violating a duty to keep information private. Confidentiality can be breached without any technical intrusion (for example, through misdirected disclosure), and a security incident may occur without a legally actionable breach of confidentiality.
If a policy covers privacy or cyber events, any breach of confidentiality claim will automatically be paid.
Coverage is conditional and depends on the specific insuring agreement, the policy's definitions of confidential information and wrongful act, applicable exclusions, and jurisdiction. Some breaches may fall outside the definitions, be excluded (for instance where liability was contractually assumed beyond what common law imposes), or fail a condition precedent.
Buying insurance for confidentiality exposures reduces the likelihood that a breach will occur.
Insurance is a mechanism for risk transfer, not risk mitigation. It may help finance the liability consequences of a breach but does not by itself reduce the probability of a confidentiality failure or substitute for controls, governance, and resilience measures that address the underlying risk.

Best practices

Map the sources of confidentiality duties (contractual clauses, professional obligations, statutory requirements, and common law) so exposures can be understood before assessing how coverage might respond.
Review policy definitions of 'confidential information' and 'wrongful act' alongside relevant exclusions and endorsements to confirm whether anticipated confidentiality exposures fall within the third-party insuring agreements, and involve broker or coverage counsel where wording is ambiguous.
Do not treat insurance as a substitute for controls; pair any risk transfer with mitigation measures that reduce the likelihood of unauthorized disclosure, including access governance and handling procedures for confidential data.
Distinguish confidentiality breaches arising from technical compromise from those arising from human error or unauthorized internal disclosure, since the applicable duties and potentially responsive coverage may differ.
Confirm whether contractual liability assumed beyond common law duties is addressed by the policy, given that some forms limit or exclude such assumed liability, subject to the specific wording.
Consider jurisdictional variation, since duties of confidentiality and the availability of coverage can be defined and applied differently across regulatory regimes and insurer forms.
a promotional banner asking how ready are you for PCI DSS 4.0? With a call-to-action to get the checklist now.