Incident response is not just about stopping an attack - it is about deciding fast whether a cyber event has crossed into privacy-law territory.