12 key steps in responding to a data breach