EU definition of a personal data breach.

> "‘personal data breach’ means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed;

Based upon this definition just allowing the access is a breach.

Well it seems like a gray area. There's a meaningful difference between "accessing" something and "having access to" something. To me this seems like it would only cover the former.

I’m not aware of access logs exist, perhaps history tracking if enabled on that object(limited to 10 fields per object).

It would absolutely be considered a breach if customer data was accessible by non authorized staff, moreso if by partners.

Salesforce has a feature called Event Monitoring. Event monitoring does show lots of information, like pages access, reports exported, api endpoints used, etc. but it needs to be purchased. However, Salesforce does track and retain that data for some time so you can decide to purchase it retroactively if you ever want.

TIL, thanks. Maybe they ought to give that away to those who have an affected org.