A data breach will be deemed an Eligible Data Breach when the following three criteria are satisfied:1. Personal information is compromised — either through unauthorised access, unauthorised disclosure, or loss.2. A reasonable person would expect serious harm to result for the individuals affected.3. The organisation hasn’t been able to prevent that harm through remedial action.