GDPR requires a mandatory notification of a breach and you could face penalties of up to 4 % of your global turnover or € 20 million, whichever is greater.