If a data breach is likely to put people at serious risk - like identity theft or fraud - the company must tell those individuals directly, not just the regulator.