A recent statement issued by British Airways calls into question whether the data breach reported last month will be considered a 'personal data breach' under GDPR

https://www.out-law.com/en/articles/2018/november/british-airways-data-breach-GDPR-/