The GDPR is meant to be a global gold standard for data protection but compensation is unlikely after a security breach.