Centre for Information Policy Leadership, Data Breach Notification under the GDPR