Notification obligations, potential penalties, and reputation damage, but preparation changes everything. Documented safeguards, encryption, and a tested recovery plan dramatically reduce both harm and liability.