In practice, a company finding one copy might delete it and then claim that it was as if there had been no breach and so that it does not have to report it, or do anything to protect, or even warn, the people whose information was stolen. Uber took this position after merely paying the intruders to say that they had deleted the data.