Under GDPR legislation, organisations can be fined up to £17 million or 4% of their global revenue if they fail to implement appropriate measures to prevent, detect and report personal data breaches.
The constantly evolving nature of threats means that no organisation can be expected to completely prevent breaches. The ICO has stated however that organisations that have made demonstrable and proactive efforts to minimise security risks will be looked upon favourably.