Mandatory data breach notification