how to report a data breach legally?