Assessing data breaches

I'm trying to figure out what this means - when we should or shouldn't notify customers.

The sort of data we typically have is:
- IP address
- Full name
- Email
- Home address
- Work address & name of work (sometimes)
- Purchase history (we sell clothes)
- Other less interesting things such as what pages have been visited, which marketing emails have been opened, etc.

Based on my limited understanding, the most sensitive information we have is a customers's size data. If we leaked, say, 100,000 records it may directly or indirectly contain information on someone's size. Can you help clarify this?

Answer: I think you will find an answer to this if you read our “Assessing the severity of personal data breaches according to GDPR” (https://info.advis era.com/eugdpracademy/free-download/assessing-the-severity-of-personal-data-breaches-according-to-gdpr). This document will provide you with a simple “out of the box” methodology to asses your data breaches.