Recognising that security breaches are “not a matter of if, but when” does not mean businesses get to be cut some slack in the event of an incident, especially when they are unable to show due diligence in safeguarding their customers’ data.