1. Failure to define and respect a data retention period appropriate to the purpose 2. Failure to comply with the obligation to provide information 3. Failure

1. Failure to define and respect a data retention period appropriate to the purpose 2. Failure to comply with the obligation to provide information 3. Failure to ensure the security of personal data 4. Failure to carry out a data protection impact assessment While not a direct security breach investigation, these have high impact on user data. (edit: formatting)