An ongoing management issue involving the risk that personal information and other data may be leaked or improperly obtained through external intrusion or employee error, resulting in reputational damage and claims for compensation, and the measures to prevent this.