Personal data breaches: Assessing the risk