Statistics of Don’t Put the Cart Before the Horse – Effective Incident Handling Under GDPR and NIS Directive