Following a potential breach of personal data, whether or not through a malicious attack, organisations operating in the United Kingdom (“UK”) can expect regulatory scrutiny and claims for compensation, on top of their own significant costs and losses incurred as a direct result of the incident.