To qualify, you generally need to establish that your personal data was compromised during the breach, that improper actions were taken by the data controller or processor, and that you experienced harm, either financial or psychological.