Workflow Checklist: Identifying when a data breach is notifiable