It depends heavily on what type of data though. As far as I understand if you have no PII or anything close to it you are mostly safe - especially if it's customer data but aggregated.