Not necessarily. This depends on whether the company takes sufficient technical and organizational measures to at least mitigate the risk. If not enough measures have been implemented, we will help you to implement them. However, if risks are not responded to, this may constitute a breach of the GDPR.