Preparing For The Worst: A Breach Notification Under The GDPR