Correct but incomplete: GDPR also tells you to use appropriate measures to prevent breaches. And of course if there was a breach, your measures were not appropr

Correct but incomplete: GDPR also tells you to use appropriate measures to prevent breaches. And of course if there was a breach, your measures were not appropriate so you need to change them.