Regulators logged over 400 personal data breach notifications a day for first time since law came into force