Data breaches and losses in organizations: Critical dimensions and implications for risk management

Abstract

Data breaches and data loss have become one of the most significant risks for organizations, regardless of their size, complexity, or sector, with effects that extend far beyond the immediate technical impact. Recent studies, such as IBM's Cost of a Data Breach Report 2024, show that these incidents combine direct response costs with business losses and long-term effects on competitiveness. Likewise, academic studies and documents from data protection authorities, including guidelines from the Spanish Data Protection Agency and the European Data Protection Supervisor, indicate that reputational, legal, operational, and social impacts (particularly on the rights and freedoms of individuals) must be integrated into risk assessment. Therefore, this document develops a conceptual framework that distinguishes six dimensions of impact: economic, reputational, operational, legal/regulatory, social/privacy, and artificial intelligence/automation; proposing an expected cost-of-consequences model that combines impact, probability, effectiveness of controls, and organizational risk appetite. The study employs documentary research with secondary data, articulating qualitative content analysis and quantitative illustration of the model in three scenarios, in order to support data management, investment and governance decisions.