If a data breach involves personal information, it must be disclosed if the breach is likely to result in \”serious harm\” to any affected individual.