The risk to the people affected decides whether you must notify IMY and the individuals. Consider the type of data, how many people are affected, how easy they are to identify and the possible harm.
The short version
Start with what already exists. Most organisations have routines, documents or tools that cover part of the need, and connecting them is faster than building something new.
A quick check
- Sensitive data raises the risk
- Encryption with a safe key lowers it
- Record the reasoning behind your decision
Making it stick
Use a consistent scoring method so decisions are comparable. Review the result after three months and adjust. What works in practice is worth more than what looks complete on paper.