Personal Data Protection Act 2012 (as amended 2020); breach notification threshold: significant harm or 500 or more individuals; extraterritorial effect.