Your obligation in business is to take all reasonable steps to protect data, and this includes protection against potential hacking events. Privacy protection doesn’t have to be complicated; just understood.
Make sure you review your policy and procedures annually to ensure that you are meeting you privacy obligations and feel confident that the processes you have in place work.
The following articles have been included for your perusal.