This article examines the specific features of civil liability for personal data breaches in the current context of the development of the information society and the digitalisation of social relations. It analyses international, European and national legislative acts governing legal relations in the field of personal data protection, in particular the provisions of the Council of Europe Convention for the Protection of Individuals with regard toAutomatic Processing of Personal Data, Directive 95/46/EC, the General Data Protection Regulation (GDPR), as well as the Constitution of Ukraine, the Civil Code of Ukraine and the Law of Ukraine 'On the Protection of Personal Data'.The legal nature of personal data as an object of civil and information legal relations is examined, and its main characteristics, types and features of the legal regime are identified.Particular attention is paid to examining the concept of personal data breaches and their manifestations in the modern digital environment.It is noted that a personal data breach may take the form of the unlawful dissemination, disclosure, transfer or provision of access to personal information without the consent of the data subject or without any other legal basis.It is argued that personal data leaks are one of the most common violations in the field of information law and pose a significant threat to an individual's right to privacy and protection of their private life.It has been established that civil liability serves as an important mechanism for restoring the infringed rights of data subjects, in particular through compensation for material and non-material damage caused by the unlawful use or dissemination of information about a natural person.In addition, key issues regarding legal regulation in this area were identified, including the fragmented nature of the regulatory framework, the difficulty of determining who is liable in cases of data breaches, and the insufficient effectiveness of mechanisms for monitoring data processing.The report emphasises the need to harmonise national legislation with European Union law and to improve civil liability mechanisms in order to enhance the protection of individuals' rights and legitimate interests in the digital environment.Particular attention is drawn to the advisability of introducing more effective approaches to holding legal entities accountable for breaches of personal data protection legislation.